3fa63ea453e75c0338f8f1444b511f38decdd002e17922a910aec5e29b85b751

Analysis

user interaction
yes
max time kernel
45s
max time network
38s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
balenaEtcher-2.1.9.Setup.exe
Size 261.5MB
Sample261023-c9186ahs91
SHA256 3fa63ea453e75c0338f8f1444b511f38decdd002e17922a910aec5e29b85b751
MD5 96b455aee6316c00ad7da5bb84e4d0b0
SHA1 c4156941b16721c135c6611418d04aa2fe215f2a
SHA512 0d7dc5719b82284269cf0f72afddfb53406b931016eb7c3447579b078fec610827327f82e66e41bcba52f3fd213ff53104a70a5f5ba17bc12e440580079d1b7d
SSDEEP 6291456:mCxfVtABIkfKHFtBVMPYYCEUcMMZduSEy5pXat96Eaupyx:mCR+ZoFtBVMPYM/daqqecS
TLSH
T11FD83377C05384BEDA24B533C1868A3CB776FE37996E087732463B6844FA1B19136672
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
11	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	etcher-util.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 11 IoCs

pid	Process
2740	Update.exe
2372	Squirrel.exe
3616	balenaEtcher.exe
2572	Update.exe
468	balenaEtcher.exe
2480	balenaEtcher.exe
1276	balenaEtcher.exe
2164	balenaEtcher.exe
5664	balenaEtcher.exe
2668	balenaEtcher.exe
2196	etcher-util.exe

Loads dropped DLL 13 IoCs

pid	Process
5664	balenaEtcher.exe
2164	balenaEtcher.exe
5664	balenaEtcher.exe
5664	balenaEtcher.exe
2164	balenaEtcher.exe
5664	balenaEtcher.exe
2196	etcher-util.exe
2196	etcher-util.exe
2196	etcher-util.exe
2196	etcher-util.exe
2196	etcher-util.exe
2196	etcher-util.exe
2196	etcher-util.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	etcher-util.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5544	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	etcher-util.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	etcher-util.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	balenaEtcher.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	balenaEtcher-2.1.9.Setup.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	etcher-util.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	etcher-util.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	etcher-util.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	balenaEtcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	balenaEtcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	balenaEtcher.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\etcher\shell	balenaEtcher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\etcher\shell\open	balenaEtcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\etcher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\balena_etcher\\app-2.1.9\\balenaEtcher.exe\" \"%1\""	balenaEtcher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\etcher	balenaEtcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\etcher\URL Protocol	balenaEtcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\etcher\ = "URL:etcher"	balenaEtcher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\etcher\shell\open\command	balenaEtcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	Update.exe
2740	Update.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	Update.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe
Token: SeShutdownPrivilege	468	balenaEtcher.exe
Token: SeCreatePagefilePrivilege	468	balenaEtcher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	Update.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 2740	4340	balenaEtcher-2.1.9.Setup.exe	88
PID 2740 wrote to memory of 2372	2740	Update.exe	89
PID 2740 wrote to memory of 3616	2740	Update.exe	90
PID 3616 wrote to memory of 2572	3616	balenaEtcher.exe	91
PID 2740 wrote to memory of 468	2740	Update.exe	92
PID 468 wrote to memory of 2480	468	balenaEtcher.exe	93
PID 468 wrote to memory of 5664	468	balenaEtcher.exe	94
PID 468 wrote to memory of 1276	468	balenaEtcher.exe	95
PID 468 wrote to memory of 2164	468	balenaEtcher.exe	96
PID 468 wrote to memory of 2668	468	balenaEtcher.exe	97
PID 2164 wrote to memory of 5544	2164	balenaEtcher.exe	99
PID 2164 wrote to memory of 2196	2164	balenaEtcher.exe	101

C:\Users\Admin\AppData\Local\Temp\balenaEtcher-2.1.9.Setup.exe
"C:\Users\Admin\AppData\Local\Temp\balenaEtcher-2.1.9.Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\Squirrel.exe
    "C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:2372
- - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe
    "C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe" --squirrel-install 2.1.9
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Users\Admin\AppData\Local\balena_etcher\Update.exe
      C:\Users\Admin\AppData\Local\balena_etcher\Update.exe --createShortcut=balenaEtcher.exe
      4⤵
      Executes dropped EXE
      PID:2572
- - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe
    "C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe
      C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\balenaEtcher /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\balenaEtcher\Crashpad --url=https://f.a.k/e --annotation=_productName=balenaEtcher --annotation=_version=2.1.9 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.9.1 --initial-client-data=0x4c0,0x4c4,0x4c8,0x4b8,0x4cc,0x7ff7f6e7ca18,0x7ff7f6e7ca28,0x7ff7f6e7ca38
      4⤵
      Executes dropped EXE
      PID:2480
  - - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe
      "C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\balenaEtcher" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=2312,i,12385679374503286397,15472182056395846021,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2316,i,13201407050004012606,16486193602744567807,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5664
  - - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe
      "C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\balenaEtcher" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2312,i,12385679374503286397,15472182056395846021,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2316,i,13201407050004012606,16486193602744567807,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:1276
  - - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe
      "C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\balenaEtcher" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-user-model-id=com.squirrel.balena_etcher.balenaEtcher --app-path="C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2312,i,12385679374503286397,15472182056395846021,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2316,i,13201407050004012606,16486193602744567807,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3164 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "set ETCHER_SERVER_ADDRESS=127.0.0.1 && set ETCHER_SERVER_ID=etcher-eytk6k && set ETCHER_SERVER_PORT=3434 && set UV_THREADPOOL_SIZE=128 && set SKIP=1"
        5⤵
        Executes a command shell one-liner
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\resources\etcher-util.exe
        
        C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\resources\etcher-util.exe
        5⤵
        Enumerates connected drives
        Executes dropped EXE
        Loads dropped DLL
        Direct Volume Access: Opens a physical disk for reading
        Reads the TCP/IP host and domain name from the registry
        Checks SCSI registry key(s)
        
        PID:2196
  - - C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe
      "C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\balenaEtcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\balenaEtcher" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-user-model-id=com.squirrel.balena_etcher.balenaEtcher --app-path="C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2312,i,12385679374503286397,15472182056395846021,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2316,i,13201407050004012606,16486193602744567807,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Generator.node

Path C:\Users\Admin\.cache\pkg\24e5c2ab0793424f036ee67e0a414c626aee3f9fbec60681884b28ba5426c2c1\winusb-driver-generator\build\Release\Generator.node
Size 3.1MB
SHA256 24e5c2ab0793424f036ee67e0a414c626aee3f9fbec60681884b28ba5426c2c1
MD5 f90521b3e0919a292982a6adf1892547
SHA1 faabb1d62582aab4f63e774225dcffa0510d641a
SHA512 590eb8cc85137543ef03cae0edc56d3cb2627ae35bf92c4ebd4b81c4c4a9cb8606e8c5ebea0acbac3749d4434fae3cee9044e64cb1e32240c5a2c64f0e345701
SSDEEP 49152:YUBXQz/hPzxRwPdcOxRUp077GQSph1DxQOzAFXEfEacq1XT7Hvj:ZBc/lw+OSoe1GEf5j7H
TLSH
T17FE51252ABE810B4F5A6B67896B74F03D7317894D77082CF5290D49C2EB23D18E3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_x86.lastbuildstate

Path C:\Users\Admin\.cache\pkg\24e5c2ab0793424f036ee67e0a414c626aee3f9fbec60681884b28ba5426c2c1\winusb-driver-generator\build\Release\obj\installer_x86\installer_x86.tlog\installer_x86.lastbuildstate
Size 193B
SHA256 6ac74f701d72c2345047c6d98c37c668c26b0215759baff3f411ce2944b0292b
MD5 dcf36ddb78f390bf4526f7c8d9c91b30
SHA1 1a33c8a12ab75326dac9f01f7bd2bbde101494c6
SHA512 b4410c09e2e74bb2dc5cc23f79e858019a8e7cc40d739693c0938c4f27659de9a805a8ab0eb60ecde25989e7b596678a786983c3d872e1bb9a30356c0f85fdb2
TLSH
T1D0C02230A6B492F2E803A707B0E1006AA3F853B2C462B0AC8E0C272E6F4E8180063137
MD5 SHA1 SHA512 TLSH

Submit Download

addon.node

Path C:\Users\Admin\.cache\pkg\31ec773c15eca6b18d7df945a58da1ba8a8119889d18e7f9fc2f7cf3f33da903\xxhash-addon\build\Release\addon.node
Size 137KB
SHA256 31ec773c15eca6b18d7df945a58da1ba8a8119889d18e7f9fc2f7cf3f33da903
MD5 ed8c433937acd816bb36e4965020440f
SHA1 d5d354f07f8ece84dfafd8110de6295cda56c25c
SHA512 2705e6893e3745b2d8dc31632462924649641352de79bb4d7d65586884416b425fb997286415a8a9566d0cf998b1212ed63baa218e1e478ddc4a048c29bbcf72
SSDEEP 3072:2RsVIiNRz2ICvgzoIqRwWKUy+XGMmTNA1BMe0ZN:2RMz5CvsgCUBXouGZ
TLSH
T18ED35C4BB6A500BBE177C23CC5A70A46F7B2B81457609FEF43A442661F533D09E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpfp_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\dpfp_2019.vcxproj.filters
Size 866B
SHA256 db9faf2f62037c380727b960c87caa9fa409c96c6a1bbff04f118b5e11d6c143
MD5 873087b2aae366437a4df7cad67c922a
SHA1 15fefe17e9ecf8eb2fa0c4ef6e2bb9ef3022939e
SHA512 367dde88caa684c86ce45add46f326fe077ffce141dfb67c5d523a77acd9ed8fa840acc1dc120e1387530f5d16c2c611d6d612fff78b7afabd91e70a826d0c65
TLSH
T13A11E521C8DC3B582132492EF7C5DD14FB29B3E760C5155872A9E04B3BF2218E277664
MD5 SHA1 SHA512 TLSH

Submit Download

dpfp_threaded_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\dpfp_threaded_2019.vcxproj.filters
Size 866B
SHA256 a41aee8c44b54fc66aa0945f7fa8ec86eacfc9c514c0bc85001fa994d29f75f1
MD5 9e8d392f143e1b82026c6343d4df63de
SHA1 8cca88c6820c68ebd3b8b5e160ab5cd8747791ad
SHA512 b817fe451b5ca7f0b66c4c0762c38868099afb1b0a39c53f2b8bac3768cb4a45c3b11031008d3ddcab264facaa6b974715e5c2acf58930fc55b20fc3fb33bdac
TLSH
T13F11E521C8DC3B482132492EF7C5DD14EB29B3E760C1055876A9E04B3BF2218E277664
MD5 SHA1 SHA512 TLSH

Submit Download

fxload_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\fxload_2019.vcxproj.filters
Size 1KB
SHA256 e66ae56d17591c5d5abe6e7050e09604462efa2fc9e2f33fd921d9b4d43d06b9
MD5 dcadb0b7d30e68353eeed4e0bcd76c97
SHA1 79fa35672da84b7a6b08e5a54b09dfbac8d30ad1
SHA512 2ff29af336c43f3ecf664c53f13d96d1cad33474ed0621c96066eb4186666854159b93fc9d389bbec95a6530c49a832c9721ec4dc7295aac2a7482665ec86c3d
TLSH
T1E3219221C5DC6F8C21325957F7C9DD05EB28B3E7A081064976A8E1476FF3208D267668
MD5 SHA1 SHA512 TLSH

Submit Download

getopt_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\getopt_2019.vcxproj.filters
Size 875B
SHA256 c4020c2dbd020daaeaee52d256876ca50bc1d07ab7a0d3d24a2d4fb3ff348e10
MD5 bde13032600f50760b2147b990831f25
SHA1 2d99650be72b0a7660c93c15fac58b17032039c9
SHA512 63a9101ce3e03a365eeac61cbef72a6544d090fd21d31dac2052b0fdde51ef125db9eb1fc1a9a1ef647905702b06f43633d5384e5d367e55ccf8de30e327003a
TLSH
T10E11C821C4DD7B5C203649ABFB84DD15FF69B2E730C405447AA5E00B6BB321CD277668
MD5 SHA1 SHA512 TLSH

Submit Download

hotplugtest_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\hotplugtest_2019.vcxproj.filters
Size 783B
SHA256 d6c34d2da7133f155e5aadda2ae206292e4fdd050d252efaad99b42ace3ab83b
MD5 ffeeb2703286c2cc1977d7f669010a32
SHA1 203fbc54694367a576db5e21c7d05397b9b41c57
SHA512 31cf2a563dcbb028527d8a849cc329ac35a19402c4d0dff9c553c8cac458cea5ca1100322cc949c175f45019a01ef2c4f9918c356a874129b70bbfb9c6bcdf0e
TLSH
T15501F52189CC7B482132882BFBC5CC54EB69B3E320C11544779AE10B2BB2318D33B624
MD5 SHA1 SHA512 TLSH

Submit Download

libusb_dll_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\libusb_dll_2019.vcxproj.filters
Size 3KB
SHA256 d8b13833a2e845d5111b65aece7b4adccaee33e721d1a7999312871d1d8a331f
MD5 0465d862e05f26843180e8304e2cbc7e
SHA1 bb58a2822c22d9b2403a3dc1c8aed3acbad051f4
SHA512 83fb8855a64464822569d835b452d183caf44aa2113fb0ef461f267372aca9c72b389e941a66e82ab7be0f1bc7da6e082aba70b2470b2ed65b0a4f3428f5b845
TLSH
T13A614832C1DC6A8C74331597BB8DEC05EF68B2EB5051120D7A68E08BAFF3119C2675A8
MD5 SHA1 SHA512 TLSH

Submit Download

libusb_static_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\libusb_static_2019.vcxproj.filters
Size 2KB
SHA256 d1d27d197a050094a649605f7b193183579b878f36db4a9272ce651b1340356a
MD5 17aa53e03a5bec60e9074ff378302c14
SHA1 2af5336090a2d8f32c038ea2f76906c0a19b24e5
SHA512 19a9ec33c6b19eda0e50c9ef239c4f246f56810f14e1486d133ad5a8ff0c9780ea2e9589b0d13d91b3c0c13902c81cd63dfbcc8dd0089bf605d324cdf5112918
TLSH
T114512936C1EC6A8C74331657B79DEC05EF68B2EB5015120D7A68F08BAFF3419C2675A8
MD5 SHA1 SHA512 TLSH

Submit Download

listdevs_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\listdevs_2019.vcxproj.filters
Size 780B
SHA256 01ecde7bf9abd54cd78cb9a2910c69723d08c0ef5d8c75a3e76dc4edfd7da43e
MD5 40ca2c74f4b20aee079d7ed8d8a5c9eb
SHA1 f9b244304c2c087ed0528d2a3f61a6e9b1331332
SHA512 3eb627d47cb84e2c43ec3863b61e876853a3e32e3e8e961ec7942d48cb6020f5b8970819c509f420846cba6656d143e16ed2d56f66b8e2341585dee3d62673e4
TLSH
T14F01D821C9DC7B5820334A2BF7C6DD04EB69B2E760C1154877A9E14B6BB2318E27B764
MD5 SHA1 SHA512 TLSH

Submit Download

sam3u_benchmark_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\sam3u_benchmark_2019.vcxproj.filters
Size 880B
SHA256 191db73b1258dab6bd9c4d1fffdf4d85e14fb0da59e88b8a073afc947bc0c76a
MD5 24cdc1f036a7dedc320fcd634c6eee83
SHA1 0b95c7e59c67e34b44e1575fa9493b7264e83f32
SHA512 86fb533b4d46cb15d441314bc52880f1c8c5b3efba40f8e5f12401ebb2463d80b8f83d0a42d3fa70c5322852dd28f119e339f173a9a2ba61b8d2f01480fd517e
TLSH
T1B411E121C8DC7B4C2137892BFBC5CD00EB28B3E3608106487699E54B2BB2218D277668
MD5 SHA1 SHA512 TLSH

Submit Download

stress_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\stress_2019.vcxproj.filters
Size 1KB
SHA256 eeb23b092b307ad7b5b4d0d9b2242f95aea751113bd53f8318c3b6e49edabea0
MD5 2f21b7f81bb22295a37e27c1d7ad4049
SHA1 385aaae9d975d3d9840c3530ff80e677dec21240
SHA512 6eb1a4ba6cbdb6e262f614ba369763a80563f8f3964af4eab41c369f0d8033b234854807da39f40c530abe7493a311a04b20d30a5cead227ecd545c0baa9834f
TLSH
T1C6117C31C4DD7F8C3033892BF7C9DD05EB69B2E76181054876A9E14B6BF2218D26B668
MD5 SHA1 SHA512 TLSH

Submit Download

testlibusb_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\testlibusb_2019.vcxproj.filters
Size 782B
SHA256 6ae343c05d8d037971620f8c62be5af01102bd258046913c35974609aa33003c
MD5 e25e13df1d387f098e438c339d128326
SHA1 a8c28a81127d62fa81e5f89bcc1d743749bd352a
SHA512 2cb76043145bb076cd3a424b1783f9cbddf6a579bf38711256e1a9a48d91acf882c0a0575e8475a75cae51095b88ab8747d255451de96b303cef79692507932e
TLSH
T16001B53189DC7F482132852BF7D5DD11EB69B2E320C1154473A9E1472BB2319E27B768
MD5 SHA1 SHA512 TLSH

Submit Download

xusb_2019.vcxproj.filters

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\libusb\msvc\xusb_2019.vcxproj.filters
Size 776B
SHA256 e49a7b5ed4857e49fdc159fff4ddddfca42332dfe1c806b5714dcfab5b4053fd
MD5 fca168e8b5588832b92ececa6b6e9cf4
SHA1 88edeff0e991eaff25493100ac2192eef3f33d45
SHA512 6abd2cda035421ad0bcd988117054b84baf20970e5107be9d7638a0b57ac4596c84ae24d85c6a8ba8752d5f8faa50ad1b58fc8a61a45c8d837729ed6cbb7a405
TLSH
T19B01B52089CC7B482132592AFBC5DD05EB29B2F760C115557699D00B2BB2318D27B664
MD5 SHA1 SHA512 TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71\usb\prebuilds\win32-x64\node.napi.node
Size 702KB
SHA256 60d629f72cade841978aea6fac2fa31b38958a2da136082dee0f6e4be4d8ec71
MD5 afd6f9a86c6dec4fdf285ee6d505a928
SHA1 1a9f5182185d6993cd87323ba3a6caed263d239d
SHA512 f4afba605b760cee78b59eabbdca0beb69530257a089473d7dac570eef67a892de8e17c71739adcdcdc4d96700d4b9411b20a9455b4e6e6bd068d09fa94ae8e2
SSDEEP 12288:8bwR7AnL1yKL0DtjmAbTxzUnJIB9uQQelrssfHVzhKkpBv0ZulJ+MLeLLNBNS3wk:ku70ND/qm01Fr5446t
TLSH
T170E49D2662E801F8D0BBE135899B5616E7B17449132167DF83B04A9A2F3B7F19B3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma.dll

Path C:\Users\Admin\.cache\pkg\c738ba03c84330556184b07d4f9a94bb875807834f46c0b49ea42c8e45df714f\lzma-native\prebuilds\win32-x64\liblzma.dll
Size 147KB
SHA256 fc7348418be392d5ecebd7b9f07c1ae5bc530260fef923801b140088eddce96e
MD5 2e91129e126d90edccef94ebf7abd6e1
SHA1 a8d221d3475216c11f4beaed8c9b9f33ccee32fc
SHA512 dbae0120c0b3709811fe9a738a4d66da4b47a1d09f0e5be373a77330d57fd87068963c76f294eac81723856dac500e3b824e7def828a1646fef611230d42898d
SSDEEP 3072:SLkFJu59WjUfFwgJEvCSYuw1flpY9mNoWPwx:fFJu5EjUfFxqvCj76YOWPw
TLSH
T101E3F756A292F4D9E767CC34CAA26F33E4F0781642206E29539CD73C2A6FFA1161D713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\c738ba03c84330556184b07d4f9a94bb875807834f46c0b49ea42c8e45df714f\lzma-native\prebuilds\win32-x64\node.napi.node
Size 796KB
SHA256 c738ba03c84330556184b07d4f9a94bb875807834f46c0b49ea42c8e45df714f
MD5 218fc90e5725a6a7ddfdd1edb760c12a
SHA1 2fd9c618e6105a81c1f812d55f405a947b61fe3b
SHA512 7d6d0cef3b33a092d9a8f37e2fa2f3ec44b843f4bc0d3415d832f3c183318cdfa3d05590d94c552a1ef322de2d67bcb24864c65f4fe43293891755b94bd8062a
SSDEEP 12288:7vWhpNRexpxqf8qFl9CfrumyKlAsppNDInGPpbn+JY2ef5HDek7hEDi:LKRexefIek7hE
TLSH
T16F057D662BA812A1D4B7D13DC9978F56EAB1F8144730A7CB01D0459D2F13BF89A3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

binding.node

Path C:\Users\Admin\.cache\pkg\ccbb4433b3278687561ab1a9a19c3534736e7bb0b477dc48c38665eca118790f\@ronomon\direct-io\binding.node
Size 168KB
SHA256 ccbb4433b3278687561ab1a9a19c3534736e7bb0b477dc48c38665eca118790f
MD5 8105bc96a5036899c9f80d94c0ad3ddf
SHA1 30b87ee93ff5090963994a9a60e5a4278ca04343
SHA512 87718ea44a3942d10a1d4b61b17942c9cccaab78838c6c8fc76d2087ecee131873654c9f0ea98bd40f061de5a5639f80eb8c7abaaf8a9320e4d27d7b739a41a1
SSDEEP 3072:X/19MgH1E2XZ8lfs5FExfICP+W7Lwv85ToV5tp0JkLWxJqUhQzHnAkMbFYIQx:PbPH1xWlkyHtLs8rQx
TLSH
T18CF34A46B3E500BBF5B79238C8A34606E772785157609BDF03A0437A6F277D19E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivelist.node

Path C:\Users\Admin\.cache\pkg\d8a1e75f37a273b36ecf06fc12307a63465602ce3f805301efc4ea8f9e3346a4\drivelist\build\Release\drivelist.node
Size 191KB
SHA256 d8a1e75f37a273b36ecf06fc12307a63465602ce3f805301efc4ea8f9e3346a4
MD5 32cadb3963f3604bcaaed507252ade87
SHA1 9255ae3354ad9e9b89fc84324b41c3c40d08ba02
SHA512 b5e7c5c6407ba6fcb91c6496248243c8ce998376b753560ee33e975dd32bfd48fdbb9381a7a119ad69cbc96617c9ef235680f85a05e9c67cce26504ddf7b24c3
SSDEEP 3072:0t9lx8+YBlaYjtWC0p2IQTnAoQabEScVM+y/AX+U2:+9P8cYtWdUjAofESlFV
TLSH
T1E9146E1AB6A5007EE9BBC179C9438D01EB72784507A07ADF47500BB58E2F7E09E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 84B
SHA256 9be58a3ac8827f0377fc88454683303450a02c35c7855dadd6be17b43ac9f8a5
MD5 3e2c46f6e4d707e0a68f5ab848a46146
SHA1 80470a129f8211b3906d9e87332f27e60456e424
SHA512 c15c4acb3c90b191616332e0702ca49a7319faa643b9daa87a4490758d9281fc63e42beba966887800f22f9f5b4847e9fde5df44d5bdb925c4ded6ae0c99c912
TLSH
T1A8A012D8431A42B59888226141200003882915385233D095180840B229140F09510440
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 3af08cef8c5be4d7c91c6341b56bf59f43a3aa6a14aa6aad488b33759092c02e
MD5 e5f6593161d395c54bad3be862e41715
SHA1 6e78fc88d63a111bdf8fece9d73b260678e31c2d
SHA512 207f56eab647a291729fefc2db941f18abd7dc59b9e6767d6b0c655f07c2355685f367b9589f475806adf6afcf3909963084a069bbb1a2b80ec46163c3983c2c
SSDEEP 24576:0WltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2l:Rt3UCiag6CKM2zCyZuOjJaxSS5qht
TLSH
T1B5956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 5KB
SHA256 21762dedff586bffa6fb48fdeedd32dc8e7aa5fb3b4424e2865033857a52a547
MD5 185ee8b41d0fdb31da295afc982f9094
SHA1 1ef6574e7d7d2a278c4b43c25c91ffaa3f82745d
SHA512 8abfa3077b1611d20f7994a4ff518417ceb80794e32db35e4c9227f3c5d6956dcc3bfd1d8d4b0da201d64b731ce3ac3d7d97537741e0fe98692abdbf098e35e1
SSDEEP 96:BPkAW1XqAw8uUK5xsoikOTI+Jm6XGgDAKvqm9Nf2vXvql4sxgsoNM6Z3yOB2bRUT:BcAWJqxh3turNfCXEOVysaRol
TLSH
T15CB17C02F3895909ED1D73B55DEB822F8890E0FA22F9D820528C567EF84DA396122E0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 361KB
SHA256 847d8ea06ae44f4825b761f0f66a58d6282f67193fe279d8cfd207a31d211e38
MD5 0852a9a35eeb410eab7f6b0d00fa9a93
SHA1 66899f756884495f267bd48ccc874115345a0e58
SHA512 25d6ec49a169754ed7ab59ae2f65515ac3d29045c17873dcfeeab37ca540e5278243a23dd2ab9d6a54d92723e186273bf953d51536e53f621e4f1c00a1fc3026
SSDEEP 6144:BAAGRcIMoAYdTko2doLmLOaycIMiqH45MOfcDAkV6jFVDW+l0lyXQhVMEKNVQQQN:BAAGRcIMoAYdTko2doLmLOaycIMiqH4W
TLSH
T15A7426BBE587E07ED4263830EA16817CB719FD33594E21B67A993A9C09FB1781771230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\chrome_100_percent.pak
Size 702KB
SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
MD5 8bd180ba5ae087e7348c8e5d3fc747b9
SHA1 032e54936f0a96b9e008a77666e8739f6ff56341
SHA512 8f52ca1c25bbfacefdeb869ba8b2725a12269f5df40ae50744bcb7f4f68df6cf8ab6a6a63116969d07a9ca80caaadcd6b3542f056cf1317e55e7c1bfe8c2b28b
SSDEEP 12288:QI3HWfJwNjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnzzmg/YJblIt6kjKQCrC:H32Bw7zEEmPLVbTe+gnzzmgwbc6kGQt
TLSH
T159E412E77370AC7DEEAB1677426614B0FC375A280B51060A17DAF8796923B48D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\chrome_200_percent.pak
Size 1.2MB
SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
MD5 62dc1994f062c83fce3944c829165007
SHA1 1ab2de2406114a4c4e32ca3dc4d6f8515cb4d6cd
SHA512 1d4b7acedaa54d376764ea1709750cb102b326fa4a993bad7b8ef4c4961950c52541dd79a8789709bfaa5aebbed0c6fe5a781866512c56da660ea7ed2c55befd
SSDEEP 24576:73WBS9n2zLmmibkFR8+mZiqr8BWhQumesXRvQtgIQwuSXAkpbaUGQ74:73P23mNbkFRJmQ+8khQRn1Q68uSXAk78
TLSH
T1754522D7D770AC3EDD520B77939B20E0FD7600271A61190F0B26BD7929276C8DA96B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\dxcompiler.dll
Size 24.6MB
SHA256 40b7442584b27853872ad6a5522d5aab05fd892fbd89ec18b4c32e1ac950d487
MD5 04835ff11cf246c10338a8362cd0525d
SHA1 b67872b10bb72c95c1d6dc046db5d1556ab27bf7
SHA512 b853bef3207334682a8cac4b314b70a31705e21852a760306bbe1eaaebaa1b074f06be09400d57e0152c224e5b3fa8b048277e419f95b9f43673bae514d030d7
SSDEEP 393216:XQr4pu+3f1Nfcue8m7ibHKrGOw9mrbzAYj1NZCpFF:Xw+ve7ibHBOTrb7j1sFF
TLSH
T14A472A122646D49CC099C879C7678B268A6C30E73FA7B9DFC0F461212B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\ffmpeg.dll
Size 3.0MB
SHA256 b74d49b6b617d238951942fc11c4c970d5c99c045220453ec84d591bb178089c
MD5 6fe80d847073240da98bcb937dcf0932
SHA1 a9dfe60e91fdc0a1bd0b060fda818093545d4d81
SHA512 d3f405bfc9a275200eed56cad2d1f3d9cbcbf1df5e1519b59a081f761229477caacd1afe0d137ece5fc87565012a527ff229a34a6f65a6e76b1ce846cdf58101
SSDEEP 49152:Tagye0i1JBlvS0ZU3oAQULMsvpTwDowaY9/Gz/YaLuPPuf0E6OOlz2kz5:TJ1lS0ZcoAs9HaLu3heI
TLSH
T136E5AE03F6D251EDD019C03497AB9213F271780A8F205AEF17A05A253F66FE86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\icudtl.dat
Size 10.4MB
SHA256 da53f0b69843aaa43315f0f210a67e4a874b0be338f3dae08ff57b8afe76ab0d
MD5 d5136270d87d40d2c1c6df098f53002a
SHA1 d167e8c8183258dc8714a84993b823dbd7390add
SHA512 55709f3a14e9402860ff2648bde887e7bb7674278c088e36ce20e6b107735cca68a210a091ca72f816803d27998e188b78aedf18cbfa24ad17cbfd4caec9376b
SSDEEP 98304:g/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjnd0p89s:g/cBhORok2HiXUxO/RJk3IWhlYntjdPs
TLSH
T136B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\locales\en-US.pak
Size 572KB
SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
MD5 3d66180f21df40a9eb941814676972eb
SHA1 b74b6ceba72cd5ca9e662acca19285037995c362
SHA512 4ef14702236e389409bd875dfc0b3f467f8b15c9e97c13dacedfc751642445141de31d6ccc574c8aa4dd788c2e756a16ded3262eb0c577b2b0e82ff526638efc
SSDEEP 6144:pUTO8xSUd/7b7/wg7HfwKOF7Nt3/p9XhMP96hgREfaY+43Um8tjmngcs/wEwj:mqL8f7/weHfwpNbMUhgR2uj1wj
TLSH
T12AC44D1FF784122A05935262BF099572FF32D06CA36112663CBD812C3376B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\resources.pak
Size 11.9MB
SHA256 9611f9a65a37eea7d7f631eba0ed2cc49205f47aaa8a2937694ca2de2d821bd8
MD5 833e5095756c9adfd7b0448db0bab21b
SHA1 0517ac1f2294885172054feff643f31dc1288fe2
SHA512 952c59cc681c141292656918bf07eb13f019dcd716cacbbe90b55533e46cca084b158e47ae07f17ed923626ce11dc486097a907788b98e24a4c4072e2ba5514c
SSDEEP 196608:PRR3ZeqsPzZOgYimq8oR/5e7sbaQSX2CeVh2uDK3Q12OmsE5OkrFAceC/Zh2tX3L:PLZelLgg9mno8sbV02CM8fOkrFJeCD2N
TLSH
T109C633983764286FDE2123F3822D1237DA69DD0B156550E30EAC3058DEB396C9FDE939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\resources\app.asar
Size 5.3MB
SHA256 fd82f6bf2d54ec6048f0eec6a91926f583fafa3d876e08043f9fedd301e03554
MD5 074eed445ef9c1c69d89a690e6c6dd0c
SHA1 f4135abeb73a0bfdfaa517b0507e423c6b5a70fe
SHA512 e5c264e49110185975e1c4ad03e2e38c223a60df3d49e348baf38aadb45867313ee8e1964bd6267a92592b5b6b044b5031678c3f130f48f563328a27982e6fce
SSDEEP 98304:P6mJf03C1aq4EJtzD46VodHHYYzgYZ4BjYYCRazi0:yeZIo4Raz/
TLSH
T175467DCA72E27062C3D355F5407B4107F3366919B80D8068F264E9DEB8BA849A277F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi1.node

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\resources\app.asar.unpacked\.webpack\renderer\native_modules\prebuilds\win32-x64\node.napi1.node
Size 158KB
SHA256 04329ea8bb8462e7b551099c52b02d63a007cd58f93d170c9b6790e0dea22053
MD5 191db863ed7637e39a6bd90735aa020a
SHA1 059e75d3109ddd0a263b78265770a761a58c738c
SHA512 e878cd25317e897b30f46f8b2859c2194f6042884228684c6acaf9d6e80a78a8a76694e066407ba89ddc10cb94ad5dce2b16d6b861e0437ed3426553304aa4ec
SSDEEP 3072:2gz9n2X1EkpqSlOpeaKwW2i4efo2zWqsVjPeO9Gs+M:n9nuEOqoOwbvl4iIPEM
TLSH
T19EF37D57B3A400BBE5B79238C8A34646E77278511760DB9F03A4437A2F237919E3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\squirrel.exe
Size 2.2MB
SHA256 e9e12c2ab58dee5b67e1518b915d87baed446ba2b71b9646bb4ba318d278adb3
MD5 9fc75674fd6a31b9b8f37d6e75fb3f81
SHA1 d5aade7cdedabcd0b1077c1f3153cbd853bd81fe
SHA512 d095b7dbbb49c9d25a581129c9d514dcb74180b7399ac9c391eefa6f75cb6c90208859a2f3f0f107079182d5c029d285ab47f3b02a8e2dd2f81f080a30570c5d
SSDEEP 24576:sWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m+B:Zt3UCiag6CKM2zCyZuOjJaxSS5qhp
TLSH
T174B5C433E69B5A3EE45A3675E020057C33A2FDB3626DA77B364861692AD37304931373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\v8_context_snapshot.bin
Size 725KB
SHA256 32cf2769c5912fdbe791a972570c51488c96585c0835601b6c86237033ed37e2
MD5 42b87bcf11fec7cdf5f338c29695a518
SHA1 12a1977499da733a495954d42be024b28a4aa85d
SHA512 d13c316b54ecea76331192e3bd8ef12a88103c3d90a83fd5be3b6c13551e5035f36a1def5a4810319bca8b914255cbd8d8e29d934ba395cf7e65250f3216c243
SSDEEP 6144:Kt+HwX1l/5K7Rfqz2W6twrYVLrgV2wXuIr2ffLkzdjTncO6vTB5lU7HqpAO1UjM6:MrBK1fqz2W6dPsKXCwlz5DHtM
TLSH
T1C1F4B2B6F50B8B35CA951B3D8EEB8E4B3A74F09DEE87C10B3151577C65B96A08E4240C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\balena_etcher\app-2.1.9\vk_swiftshader.dll
Size 5.3MB
SHA256 18360989b77687b0bbd40b7c0b89c1cd04fc366f5bbb2c0fa5fc0e81e3c13274
MD5 008c1510d375bbd67cc83f8457bed31c
SHA1 baf8c9475b73123f212d88b9a20839ab308ebd1c
SHA512 8077e336b3e7e94ca5f02f1e67e017405b617c6926b515075bc860c7f939083dbf98de4e8b090626d14a74f6699a8507638ccd1795cb2454ea6c8742dbe203a5
SSDEEP 49152:AAYcIG6hbYI8JKh6tIfH1GBMfoeRqmX1TNj5/9swRsZGiAxOTQRaeMHed8RwwlWF:AAYcA38XPgrpAeq9U
TLSH
T148464903F69681D9C06DE6798B5FA623F631F8800B2276DF56A00F192E66FE0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balenaEtcher.exe

Path C:\Users\Admin\AppData\Local\balena_etcher\balenaEtcher.exe
Size 621KB
SHA256 b35b9c9d6dc035c1d9e0241003b4dca7a1674a7f2999fa14fddfba3b6f198dfd
MD5 d22c3259e6064c3808a3119b4a2bb66f
SHA1 a067be6dc1604cd63f45a861c0690cc1e1a62496
SHA512 278e48a822c7bca745d65e3dae92752d795dfa72881ad7dae0a105a7a00165736ec518f6c941427447950bceee58bc23c3d5b89a2e0fcd96854edc83cda16e35
SSDEEP 12288:bJ+2Z4nShVY5bAAGRcIMoAYdTko2doLmLOaycIMiqH45MOfcDAkV6jFVDW+l0ly2:b4nRK3Un
TLSH
T181D46B77F583A07ED0223830D9A992BCBB29FC330A4E257736893B5D0AF61B45671671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\balenaEtcher\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\balenaEtcher\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\balenaEtcher\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\balenaEtcher\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\balenaEtcher\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/2196-994-0x0000000063CC0000-0x0000000063CEC000-memory.dmp

Download

memory/2372-105-0x0000000000D20000-0x0000000000F50000-memory.dmp

Download

memory/2572-117-0x0000000002B40000-0x0000000002B60000-memory.dmp

Download

memory/2740-84-0x0000000020AF0000-0x0000000020B2E000-memory.dmp

Download

memory/2740-85-0x0000000020AB0000-0x0000000020ABE000-memory.dmp

Download

memory/2740-10-0x00000000005E0000-0x00000000007B6000-memory.dmp

Download