sectoprat | 414c9037dce4594441fcf9e835ed11520ec9b6d434718913351ef6d6ba1f547e

Analysis

max time kernel
298s
max time network
281s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
port80.msi
Size 5.0MB
Sample261114-ej1wtact9z
SHA256 414c9037dce4594441fcf9e835ed11520ec9b6d434718913351ef6d6ba1f547e
MD5 501238e875efc3ff4353f4deb2e3df98
SHA1 148edb93f4c137105cdb8ef0db51e870fdf55412
SHA512 f0574c3ae1ef7759de08981f292403884cc017b4097c443abc2cc6880c1ceae970edc930881e8d312dfef025ef152a660bb9e00a33c29eb64e8e4be2f91ceb14
SSDEEP 98304:BdIgmwEx7PQ4aqGr1r0gmlxEOrtPb51rglvUFzF0mB9yVomXI8Yu9u7:IVx7Q4bfgms0tNh2UFKm18RA
TLSH
T17E3633ACB59A2717F4175131370C2932D72EDFA5A78A4347A6D6FE2C2F72EB4906024C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sectoprat persistence privilege_escalation ransomware rat rootkit spyware stealer trojan

Malware Config

Signatures

Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral4/memory/4360-121-0x000001FCADF40000-0x000001FCADFAC000-memory.dmp	family_sectoprat

Drops a kernel driver into a user folder 1 TTPs 1 IoCs

Places a kernel driver outside the normal driver folder, which installers may do while staging drivers; malware can do it before loading its own driver to gain kernel-level control.

rootkit

Windows Service

T1543.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Pattern_Similar_Bike_Mandate\mixture.sys	msiexec.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monkey2023.vbs	AutoIt3_x64.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monkey2023.bat	AutoIt3_x64.exe

Executes dropped EXE 2 IoCs

pid	Process
5452	AutoIt3_x64.exe
4360	AutoIt3_x64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Environment\UserInitMprLogonScript = "\"C:\\ProgramData\\Monkey2023\\AutoIt3_x64.exe\" \"C:\\ProgramData\\Monkey2023\\Monkey2023.au3\""	AutoIt3_x64.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59b963.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b963.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F4FAF7CF-7920-422C-83F5-FD48BB572D26}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDB8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7C2DD97F189EBA48.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3F07C740F2993EE0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA256117AC306A35A.TMP	msiexec.exe
File created	C:\Windows\Installer\e59b967.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA4BDEF649D862ED1.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4644	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4248	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3_x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6044	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Monkey2023\winmgmts:\root\cimv2	AutoIt3_x64.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
968	msiexec.exe
968	msiexec.exe
4360	AutoIt3_x64.exe
4360	AutoIt3_x64.exe
4360	AutoIt3_x64.exe
4620	chrome.exe
4620	chrome.exe
4360	AutoIt3_x64.exe
4360	AutoIt3_x64.exe
4360	AutoIt3_x64.exe
4360	AutoIt3_x64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4644	msiexec.exe
Token: SeSecurityPrivilege	968	msiexec.exe
Token: SeCreateTokenPrivilege	4644	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4644	msiexec.exe
Token: SeLockMemoryPrivilege	4644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4644	msiexec.exe
Token: SeMachineAccountPrivilege	4644	msiexec.exe
Token: SeTcbPrivilege	4644	msiexec.exe
Token: SeSecurityPrivilege	4644	msiexec.exe
Token: SeTakeOwnershipPrivilege	4644	msiexec.exe
Token: SeLoadDriverPrivilege	4644	msiexec.exe
Token: SeSystemProfilePrivilege	4644	msiexec.exe
Token: SeSystemtimePrivilege	4644	msiexec.exe
Token: SeProfSingleProcessPrivilege	4644	msiexec.exe
Token: SeIncBasePriorityPrivilege	4644	msiexec.exe
Token: SeCreatePagefilePrivilege	4644	msiexec.exe
Token: SeCreatePermanentPrivilege	4644	msiexec.exe
Token: SeBackupPrivilege	4644	msiexec.exe
Token: SeRestorePrivilege	4644	msiexec.exe
Token: SeShutdownPrivilege	4644	msiexec.exe
Token: SeDebugPrivilege	4644	msiexec.exe
Token: SeAuditPrivilege	4644	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4644	msiexec.exe
Token: SeChangeNotifyPrivilege	4644	msiexec.exe
Token: SeRemoteShutdownPrivilege	4644	msiexec.exe
Token: SeUndockPrivilege	4644	msiexec.exe
Token: SeSyncAgentPrivilege	4644	msiexec.exe
Token: SeEnableDelegationPrivilege	4644	msiexec.exe
Token: SeManageVolumePrivilege	4644	msiexec.exe
Token: SeImpersonatePrivilege	4644	msiexec.exe
Token: SeCreateGlobalPrivilege	4644	msiexec.exe
Token: SeBackupPrivilege	4732	vssvc.exe
Token: SeRestorePrivilege	4732	vssvc.exe
Token: SeAuditPrivilege	4732	vssvc.exe
Token: SeBackupPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe
Token: SeTakeOwnershipPrivilege	968	msiexec.exe
Token: SeRestorePrivilege	968	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4644	msiexec.exe
4644	msiexec.exe
5452	AutoIt3_x64.exe
5452	AutoIt3_x64.exe
5452	AutoIt3_x64.exe
4360	AutoIt3_x64.exe
4360	AutoIt3_x64.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5452	AutoIt3_x64.exe
5452	AutoIt3_x64.exe
5452	AutoIt3_x64.exe
4360	AutoIt3_x64.exe
4360	AutoIt3_x64.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4644	msiexec.exe
968	msiexec.exe
4360	AutoIt3_x64.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4908	968	msiexec.exe	94
PID 968 wrote to memory of 4248	968	msiexec.exe	96
PID 4248 wrote to memory of 5452	4248	cmd.exe	98
PID 5452 wrote to memory of 4360	5452	AutoIt3_x64.exe	99
PID 4360 wrote to memory of 4620	4360	AutoIt3_x64.exe	101
PID 4620 wrote to memory of 2580	4620	chrome.exe	102
PID 4620 wrote to memory of 3808	4620	chrome.exe	103
PID 4620 wrote to memory of 6044	4620	chrome.exe	104
PID 4620 wrote to memory of 3424	4620	chrome.exe	105
PID 4620 wrote to memory of 5756	4620	chrome.exe	106
PID 4620 wrote to memory of 4852	4620	chrome.exe	107
PID 4620 wrote to memory of 5360	4620	chrome.exe	108
PID 4620 wrote to memory of 708	4620	chrome.exe	109
PID 4360 wrote to memory of 4620	4360	AutoIt3_x64.exe	101
PID 4360 wrote to memory of 4620	4360	AutoIt3_x64.exe	101
PID 4620 wrote to memory of 3412	4620	chrome.exe	111
PID 4620 wrote to memory of 3956	4620	chrome.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\port80.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops a kernel driver into a user folder
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4908
- C:\Windows\system32\cmd.exe
  cmd.exe /c start AutoIt3_x64.exe Monkey2023.au3
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Users\Admin\AppData\Local\Pattern_Similar_Bike_Mandate\AutoIt3_x64.exe
    AutoIt3_x64.exe Monkey2023.au3
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\ProgramData\Monkey2023\AutoIt3_x64.exe
      "C:\ProgramData\Monkey2023\AutoIt3_x64.exe" "C:\ProgramData\Monkey2023\Monkey2023.au3"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Registers new Windows logon scripts automatically executed at logon.
      Reads the TCP/IP host and domain name from the registry
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4360
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv"
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4620
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff9f48bc728,0x7ff9f48bc734,0x7ff9f48bc740
        6⤵
        
        PID:2580
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1656,i,16551843194942626580,4695693263884893719,262144 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
        6⤵
        
        PID:3808
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,12996375954056572624,9795671557075758193,524288 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:6044
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,6893252083679073988,2038543927730935327,524288 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
        6⤵
        
        PID:3424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2800,i,11250769209813223773,15891320193510654782,2097152 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:1
        6⤵
        
        PID:5756
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2824,i,8226011175353319559,10615022493386402278,2097152 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
        6⤵
        
        PID:4852
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=2964,i,18018757021559877283,13593130755676547906,2097152 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
        6⤵
        
        PID:5360
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3000,i,8435589140826710728,581658496118053442,2097152 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:9
        6⤵
        
        PID:708
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4024,i,12711216110786572792,15963532062331237603,2097152 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:1
        6⤵
        
        PID:3412
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4476,i,7023946551427724358,17184792672403971899,2097152 --field-trial-handle=1952,i,4353885073330505686,7344716091429677408,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
        6⤵
        Drops file in Program Files directory
        
        PID:3956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59b966.rbs

Path C:\Config.Msi\e59b966.rbs
Size 24KB
SHA256 0796a7c3d612a77dbedda70893359dca86988addf1300a00584060be5725aee3
MD5 1b128fe1999f0452f132403702193a84
SHA1 9683cc05fa3e40c6c2d8ca133ea74dc27c557fee
SHA512 e65f956417d84d03bb5e4fdb2c2a9c3d42334bdcc3f60e375bae31b6987774ba306ff343fec7acead2b96a71094240f2e8f43237e8cba3a22f184b753d11b0c1
SSDEEP 192:GUicwEsmYG2zr5s7o2fNWvLokjC33APEyw+IlEyw+xIppdGpy7DZf0R9AHssolbR:GUpv2zruoDDEyw/Eywq3yhsTYot
TLSH
T13CB21200FD85CEBEE80C057B4552E658DA648516EF0C374E9DCADBAC059389EA8DB4F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3_x64.exe

Path C:\Users\Admin\AppData\Local\Pattern_Similar_Bike_Mandate\AutoIt3_x64.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Monkey2023.au3

Path C:\Users\Admin\AppData\Local\Pattern_Similar_Bike_Mandate\Monkey2023.au3
Size 36KB
SHA256 168389740e1409e0802b6d97dae81b16ad3a93c502ecf1459700af70624ac4f2
MD5 18080f7a0624a5fb0cdce398234b5d31
SHA1 7e0280c803db0ef444348dd22125e8be6b81fa21
SHA512 038632f525f43da48532f595177f327424ba05abddd43962bf4c90c15a49aaf11041a2f6e1bc442f03d1b3b05b0abb806773fcd7a8c54a622d928e605ef6412e
SSDEEP 768:1Rn6NKaRVRUsEVBLuWID5ZTULngVKeBNxSiH+I+PIUrXKZP1h1x5TRM/:SRRVRUPBVIDrQLWD5wbKZthTXU
TLSH
T11DF2F1FD589C9AE59610360336756C3B237D3993F9AC3B5110056B6B68BAFCF0016B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv7-w64-mingw32uwp-nm.exe

Path C:\Users\Admin\AppData\Local\Pattern_Similar_Bike_Mandate\armv7-w64-mingw32uwp-nm.exe
Size 15KB
SHA256 b0b48a418510f50574b73ed6728dec643f09a1ad1798f0ccdbe654ca33dcfffc
MD5 47e42c2da9b0093ba923e9b2d0add91b
SHA1 b41625218968753601d23c7801e687f206cffc79
SHA512 cfdc620e2d7452dc6f14f098aa87db84873aeac1408fc9630a42e0531c5dc47f8feab4bb6e46c200a6cdd39035efda356aefbce2854dad28954f6e6bd9b48d14
SSDEEP 192:h9T64q3WGb55+jnT4mBb7ojS/NigAxgAJJ96KtzvsgMrrw:3TTAtknMi/oj4NigSgg97tzUgkw
TLSH
T1E262F9051B6201EDDE1B427E85730672F2B1FA11576129DF0762A2212EB1FE02FBF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i686-w64-mingw32uwp-c++.exe

Path C:\Users\Admin\AppData\Local\Pattern_Similar_Bike_Mandate\i686-w64-mingw32uwp-c++.exe
Size 16KB
SHA256 9aefd53dd91fd0e6541f27170a8321903c1ce3edf44a974586beb96c7336dda2
MD5 35b8fffd620c4a9a50fcfd66498e9e41
SHA1 f6efd131aa00d6ebc7b0b420fd806968cbcfce8b
SHA512 8a3e39a413f1e54babcd610345f78c564d0a78c7bd5a6490a389d4a4f113cd0ae8f83c7d71dcb260374639a10cb474d99337166a36c3699a0595b80830f24cf9
SSDEEP 192:YOKiSnEEN3n0gbLh9NriRAutpLfwo6/9zPx73tfmLpvp2J9RbtzvsdPXI:YHPN0S/ZiRAyNfwo6NPxxipm9htzU
TLSH
T1BE721945668501EDEA2AC53EC622523BE170F9110B3369EF1B5262211EB1FE05F3EDE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

link.19940-cvtres.write.1.tlog

Path C:\Users\Admin\AppData\Local\Pattern_Similar_Bike_Mandate\link.19940-cvtres.write.1.tlog
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

mixture.sys

Path C:\Users\Admin\AppData\Local\Pattern_Similar_Bike_Mandate\mixture.sys
Size 419KB
SHA256 5f61ef78bbcf323de8f6c7a63f55a672bfc5fb5783604a8b88c0d934b68e051b
MD5 87ede83fc8472fbdc841dda731a17f38
SHA1 4fc9347e100f69ea3dafc6e523d6b711372e0daa
SHA512 5267b03c3eaae3f8153709003a10bbec615b1c52fe2091b322c1c8b07f97faecf07087bac49a4a01714ac411a236d5df788b9019fe868cad7ba748381796629f
SSDEEP 12288:CMuefgTa8QuQAEXlxRwAk5jQCV4Ltr2cw+7cSbgaZ8W:CMsQVHueyoKq8sp
TLSH
T19B9423DA35250204D47DB279C2D83C5FC53AD1ECA2CA0AA564F2DA3CAF87E43528752E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Crashpad\settings.dat
Size 40B
SHA256 9da7fd4aad597ac7494ea677b56562012e315a881b48280b0d6b2975f7cc3f2f
MD5 0913eac92575d1261aa2f489c6f53201
SHA1 518e8b42c4c154ba7a8416341fbde20725c6c3ee
SHA512 464da569fd1c58377ce7e6f6ff5baaac47c2c836cc33f872fc46d4919186b9594e2a1a681019be464202f7e9f427383a8ef52fbfee492af122ec29de48b9f9ca
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 18fed023547d30508375b7f7550c0bea25a69b922376107e441e2cfc6a3d42be
MD5 78bc39db45801ccf32e98dc80ba50882
SHA1 8949578b524a5ccdd3d49f946d13af391aac3a8e
SHA512 06f40fa040f698d0aa6ddbc5af9a3ffa38f3c5f584fe31ef2e937bd30fec79575390911a5aa2e76083d77a5f404e51c816551f8b63227bd7fbbb8c9fd3ad0863
TLSH
T17CE02B81828C0F0DD32DA6F7CDAA03088A0A92C42ABE7603A881C6C23312424124C623
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6c07d49472469dd2fac41a10960a51886a1d0d9a9223b6840e7a7122831bad1e
MD5 18fc13cf2a1287fbf9b7ae70c7360d03
SHA1 0a6960dfc495f5d28727f1addcee1cf8aad66598
SHA512 38d062de2c0d1f3b74980e63ec5d53996060c2ac7adb81f5daedfc850abc35d6a0e2ef77fe52e986619a3930606678d03509e58b54683b6bc8cac350f3ad92b4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 e851d54abbc287d29b7c9767754074c5dfaa02a8e18e2e77d963205a4db4ccc5
MD5 2eeaa2b9174f19ce4923a0a932bd2127
SHA1 e2a5dc660056f0805def98d4c9a7e3994285593e
SHA512 b5719c2d7cd31f59e66c0b0018fe2bc740e70b524dfac218f2271b3d4b0386639fcc904443cf938a18acc8c3f63193150259f3cc1377bd2a2f6ee808e1c2869f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\DawnGraphiteCache\data_1
Size 8KB
SHA256 35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09
MD5 259e7ed5fb3c6c90533b963da5b2fc1b
SHA1 df90eabda434ca50828abb039b4f80b7f051ec77
SHA512 9d401053ac21a73863b461b0361df1a17850f42fd5fc7a77763a124aa33f2e9493fad018c78cdff63ca10f6710e53255ce891ad6ec56ec77d770c4630f274933
SSDEEP 3:MsEllllkXl:/M/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\DawnGraphiteCache\index
Size 256KB
SHA256 edf5353c237145732134e2e56796f909a70f13fea46d78dc27298cf7286abf8c
MD5 0106cb2089d9035f01db6ac00dcc65b0
SHA1 badee834117be0ce9c7d1d9acfb5f68fec4c7b58
SHA512 8072b9523aeb0fc46d618636b0e0c9a922934823897ffffaedd7728b235d2c103bac802189607265480de8f159559475a6c4883b8435915e36edcec872f489ab
SSDEEP 3:LstlllB+X:LsX/B+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\DawnWebGPUCache\index
Size 256KB
SHA256 f0103e913b98690a75d295f8b1cd9605d5de5cd864c71584d729dd15d9c1c1c8
MD5 0ca1bb82297c740a991cb82e971593c1
SHA1 4f7a347b34473266a6e30af914312f71c7cc28e6
SHA512 d9f40a967c6b2da57b878b72ed030b0c91affd00e2336a6f6c4a93ae540ee78bc478a6dcfd70036a2b9390f47bfc6b3554955d16fd9e52a329ad62e0175f5c85
SSDEEP 3:LstlNllklkXlDvu1:LsX3lP61
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\GPUCache\index
Size 256KB
SHA256 66a6ad41956de89609663867f980cd3ad96c053cd88226ffe2ff8fb0d8c2cf6a
MD5 ed8a796498147d3ecd457fe01255b3bd
SHA1 0308ff76ad4b73c56f442f7f455c951ce4356791
SHA512 597a2be87d4d9051644eceb73ad5252115b99f98e99a21777a31386fc4a5d4592d9bc5dcdbffe22110dd6e2e91288af99b41b236d7685e7e59049b3ecaabaae7
SSDEEP 3:LstlNllklkXl37et:LsX3lPLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\Preferences
Size 3KB
SHA256 ec9aecdeb4f112a18ff57dc194fe167a4f8ee3dbb19a35b7e56e9ba730ba0c59
MD5 ca845476c77fef659a83b2f24481d454
SHA1 f3f68809fd56e51faa88254981410ccb3ba06b8b
SHA512 3eb7e7bcf00bb3f460b5f48daeae0be13e47c560ac4d7485c858a9dd22adab17416a6f495cca65a4abab2611c25c4c2331c59f3cc7d494166b076bd35064ad84
TLSH
T1E4618268C4A80CA72EB67B74B82D0782FA51477F0240080A7DBD658C4FB2A778080F6B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Local State
Size 1KB
SHA256 90753715ccdc741499be238c5e82d9e73da172a08c8fd27b496f7b891fc9d940
MD5 70dfbc94d849dcc9392729c0bab0c53a
SHA1 0286e3b92f8abd818767200ccb3d5db8638bd885
SHA512 2dfb141192552aef10d006655cf0b1981a11c64f772d25f0280cbe4014032e1a58380e1202577b5aca69eee34cd5e6020250f8f51bf69184824563bf8a9e018d
TLSH
T1DE114FB035A47BB1B98182165700E65B4E74A2BBE1A38DC95DCC2C1502BA6AC2A0AC34
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\fqtt3vef.ajv\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

tmpD9AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD9AE.tmp
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpD9EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD9EF.tmp
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59b967.msi

Path C:\Windows\Installer\e59b967.msi
Size 5.0MB
SHA256 414c9037dce4594441fcf9e835ed11520ec9b6d434718913351ef6d6ba1f547e
MD5 501238e875efc3ff4353f4deb2e3df98
SHA1 148edb93f4c137105cdb8ef0db51e870fdf55412
SHA512 f0574c3ae1ef7759de08981f292403884cc017b4097c443abc2cc6880c1ceae970edc930881e8d312dfef025ef152a660bb9e00a33c29eb64e8e4be2f91ceb14
SSDEEP 98304:BdIgmwEx7PQ4aqGr1r0gmlxEOrtPb51rglvUFzF0mB9yVomXI8Yu9u7:IVx7Q4bfgms0tNh2UFKm18RA
TLSH
T17E3633ACB59A2717F4175131370C2932D72EDFA5A78A4347A6D6FE2C2F72EB4906024C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 f5dc50d26c86c965ed4126bfef361de6d314d8a8c22cff2ab8404e5893871e0f
MD5 eb2e02da6f9dc169cb64ed6a65350246
SHA1 e611f14ec5c7ea6f0d28f0520da790d1cc5b7166
SHA512 a25dd69a6dd431556349acdc3d586af892cb8327f365c3421585f8e375634ed65ca7656ecbf125d191ad0c52e7a3f390884beb788e1456f6b33e4a3818c6f310
SSDEEP 24576:iFo3DMPLdoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKeQ:IHw
TLSH
T12257042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b3a7f790-d417-4c8c-95b5-40dc2c0c0940}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b3a7f790-d417-4c8c-95b5-40dc2c0c0940}_OnDiskSnapshotProp
Size 6KB
SHA256 8545e663836dd678667f43be1a410ae36ffdaa2dda82a7b4a15f59bd026bbb6c
MD5 4764ad02c73cc51be659a40320078152
SHA1 571a41fef334c3a6eae6424b20f4d6c57edfeb0f
SHA512 3d328152d2dde2b30d1e785c3800ece048c51c348449ab8e506efe41a761a54b10a02ddb37c20ddffa8cdb9b62d2215039a1577056c05dfdf0b737824601fdbd
SSDEEP 96:Ff7PHIFuvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:V/rb++uVmN
TLSH
T135D188185AF54711E2B3AB7129F18557A477B911EF33CB8E0198238E2631910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4360-126-0x000001FCADFB0000-0x000001FCADFCE000-memory.dmp

Download

memory/4360-123-0x000001FCAE000000-0x000001FCAE050000-memory.dmp

Download

memory/4360-120-0x000001FC95850000-0x000001FC958B9000-memory.dmp

Download

memory/4360-127-0x000001FCAE050000-0x000001FCAE070000-memory.dmp

Download

memory/4360-125-0x000001FCAF590000-0x000001FCAFAB8000-memory.dmp

Download

memory/4360-124-0x000001FCAED40000-0x000001FCAEDB6000-memory.dmp

Download

memory/4360-121-0x000001FCADF40000-0x000001FCADFAC000-memory.dmp

Download

memory/4360-122-0x000001FCAEE90000-0x000001FCAF052000-memory.dmp

Download

memory/4360-239-0x000001FCAEDC0000-0x000001FCAEDD2000-memory.dmp

Download

memory/4360-240-0x000001FCAEE20000-0x000001FCAEE5C000-memory.dmp

Download

memory/4620-149-0x00000192E2840000-0x00000192E2860000-memory.dmp

Download