Benign windows Download

thinkrail

“The worktree IDE by JetBrains for the pi coding agent.”

Clipboard monitor feeds a named-pipe command loaderReads a browser profile store and watches the host

SHA-256407056f85c9605a4014fa27702f6d57b1b3c4551d02a3b5489ced47295e525a6

URLhttps://github.com/JetBrains/thinkrail/releases/download/v0.1.2/thinkrail-windows-x64.exe#/thinkrail.exe

MaleculeK₂(Li₅Te₂)O₁₃(Ca₂CoAlAs₁₁C₁₃DyEr₅Eu₄ILaP₂S₄Xe₃)H₁₁(Cm₄₃Cr₁₀Db₃₁DsF₃₁Hf₂Mg₃Os₂₇Po₃₃Ti₂U₂)Md₈(Bi₁₆Bk₂Pa₂PtSi₄)

Evidence

Large PE with elevated code entropy 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x4004157415641545657534883ec4883fa01AWAVATVWSH..H...
0x4100f8528030000c605031b440501488b05..(.......D..H..
0x420041b44054883f8010f8520020000488b..D.H..... ...H.
0x430056b5d44054883f8010f856e02000048.k]D.H.....n...H
0x4408d0d7a5d4405ff15fc262c05b8010000..z]D....&,.....
0x45000f0480fc1057e9d4405483d00400000..H...~.D.H=.@..
0x460be00400000480f42f0488d3d605d4405[email protected].=`]D.
0x470c6043e00803d555d440500740c488d0d..>..=U]D..t.H..
0x4804c5d4405e877417401c6043e0a488d0dL]D..wAt...>.H..
0x4902c5d4405ff152e2e2c05488d053f4c74,]D.....,.H..?Lt
0x4a001488905085d440548c705055d440500.H...]D.H...]D..
0x4b0000000833d3ae23505000f8447020000....=:.5....G...
0x4c0833d29e23505000f84f2000000488d1d.=).5........H..
0x4d05e242b0548895c2438488d057b0b2105^$+.H.\$8H..{.!.
0x4e0488944243048c744242800000000c744H.D$0H.D$(.....D
0x4f02420050000004c8d0509d92a054531f6$ ....L....*.E1.
0x50031c931d241b903000000e801c37301481.1.A........s.H
0x5108d359ae13505488d3da0d92a0549bf00.5..5.H.=..*.I..
0x520028000003000004c8d25f5552505eb28....0..L.%.U%..(
0x5308b0e4c8b4e104889442428894c242031..L.N.H.D$(.L$ 1
0x540c931d24989f8e8c5c2730149ffc64883.1.I.....s.I..H.
0x550c6204983fe36742a837e0400741a4889. I..6t*.~..t.H.
0x560d84183fe2d77c94489f0490fa3c74889.A..-w.D..I...H.
0x570d873bd4c89e0ebb84889f1e8200e0000.s.L....H... ...
0x580ebdc4c8d0565f62a0531c931d24531c9..L..e.*.1.1.E1.
0x590e87bc273014c8d050af62a0531c931d2.{.s.L....*.1.1.
0x5a04531c9e868c273014c8d058fd92a054cE1..h.s.L....*.L
0x5b08d0d5a41210531c931d2e851c2730148..ZA!.1.1..Q.s.H
0x5c08b053ae835058d0cc50000000065488b..:.5........eH.
0x5d031483df00200000f84480100004885f61H=......H...H..
0x5e00f845801000080beb400000001750b48..X..........u.H
0x5f08d4e3031d2e8162a0000488b7e104883.N01...*..H.~.H.
0x600bf58050000000f8432010000488db760.X......2...H..`
0x6100500004889f1ff152c252c05488b8f58...H....,%,.H..X
0x62005000080b9b400000001750b4883c130..........u.H..0
0x63031d2e8d92900004889f14883c4485b5f1...)..H..H..H[_
0x6405e415c415e415f48ff257a2c2c056548^A\A^A_H.%z,,.eH
0x6508b3425300000004839f00f84cefdffff.4%0...H9.......
0x660488d0dc9184405ff15db242c0531c0f0H....D....$,.1..
0x670480fb135b01844057521e8d100000048H..5..D.u!.....H

Brave browser profile directory path 0x4d8035e–0x4d8064e

0x4d8035e6c69636174696f6e5c6368726f6d652elication\chrome.
0x4d8036e6578654368726f6d69756d5c4170706cexeChromium\Appl
0x4d8037e69636174696f6e5c6368726f6d652e65ication\chrome.e
0x4d8038e78654272617665536f6674776172655cxeBraveSoftware\
0x4d8039e42726176652d42726f777365725c4170Brave-Browser\Ap
0x4d803ae706c69636174696f6e5c62726176652eplication\brave.
⋯6 more rows
0x4d8041e746368726f6d652d686561646c657373tchrome-headless
0x4d8042e2d7368656c6c2d77696e36342f636872-shell-win64/chr
0x4d8043e6f6d652d686561646c6573732d736865ome-headless-she
0x4d8044e6c6c2e657865476f6f676c655c436872ll.exeGoogle\Chr
0x4d8045e6f6d655c5573657220446174615c4465ome\User Data\De
0x4d8046e76546f6f6c73416374697665506f7274vToolsActivePort
0x4d8047e476f6f676c655c4368726f6d65205378Google\Chrome Sx
0x4d8048e535c5573657220446174615c44657654S\User Data\DevT
0x4d8049e6f6f6c73416374697665506f7274476foolsActivePortGo
⋯5 more rows
0x4d804fe72744272617665536f6674776172655crtBraveSoftware\
0x4d8050e42726176652d42726f777365725c5573Brave-Browser\Us
0x4d8051e657220446174615c446576546f6f6c73er Data\DevTools
0x4d8052e416374697665506f72744d6963726f73ActivePortMicros
0x4d8053e6f66745c456467655c55736572204461oft\Edge\User Da
0x4d8054e74615c446576546f6f6c734163746976ta\DevToolsActiv
0x4d8055e65506f727400000000005414d8440100ePort.....T..D..
⋯4 more rows
0x4d805ae000038000000000000003815d8440100..8.......8..D..
0x4d805be00002b000000000000000f77733a2f2f..+........ws://
0x4d805ce3132372e302e302e313ac0002d2d7573127.0.0.1:..--us
0x4d805de65722d646174612d6469723d62756e2der-data-dir=bun-
0x4d805ee6368726f6d652d2d72656d6f74652d64chrome--remote-d
0x4d805fe6562756767696e672d70697065002d2debugging-pipe.--
0x4d8060e686561646c657373002d2d6e6f2d6669headless.--no-fi
0x4d8061e7273742d72756e002d2d6e6f2d646566rst-run.--no-def
0x4d8062e61756c742d62726f777365722d636865ault-browser-che
0x4d8063e636b002d2d64697361626c652d677075ck.--disable-gpu
0x4d8064e002d2d64697361626c652d657874656e.--disable-exten

Windows schtasks create command 0x4d92d7a–0x4d92efa

⋯7 more rows
0x4d92dea206d616e75616c6c7920776974683a20 manually with: 
0x4d92dfa7363687461736b73202f637265617465schtasks /create
0x4d92e0a202f786d6c203c66696c653e202f746e /xml <file> /tn
0x4d92e1a203c6e616d653e202f72752053595354 <name> /ru SYST
0x4d92e2a454d202f661950726f63657373206578EM /f.Process ex
0x4d92e3a69746564207769746820636f646520c0ited with code .
⋯12 more rows

Poll clipboard change counter 0x52b9ce0–0x52b9fd0

⋯3 more rows
0x52b9d106f000000000000807000000000000080o.......p.......
0x52b9d2073000000000000800100000000000080s...............
0x52b9d3002000000000000800300000000000080................
0x52b9d4004000000000000803900000000000080........9.......
0x52b9d5005000000000000803700000000000080........7.......
0x52b9d60380000000000008006000000000000808...............
0x52b9d7007000000000000800800000000000080................
0x52b9d8009000000000000800c00000000000080................
0x52b9d900d000000000000800e00000000000080................
0x52b9da00f000000000000801000000000000080................
0x52b9db011000000000000801200000000000080................
0x52b9dc013000000000000801400000000000080................
0x52b9dd015000000000000801600000000000080................
0x52b9de017000000000000800000000000000000................
0x52b9df098b02b0500000000a8b02b0500000000..+.......+.....
0x52b9e00b8b02b0500000000c8b02b0500000000..+.......+.....
0x52b9e10d8b02b0500000000eeb02b0500000000..+.......+.....
0x52b9e2008b12b050000000014b12b0500000000..+.......+.....
0x52b9e301eb12b050000000028b12b0500000000..+.....(.+.....
0x52b9e4036b12b050000000040b12b05000000006.+.....@.+.....
0x52b9e504cb12b05000000005ab12b0500000000L.+.....Z.+.....
0x52b9e606ab12b050000000078b12b0500000000j.+.....x.+.....
0x52b9e7084b12b05000000000000000000000000..+.............
0x52b9e8090b12b05000000000000000000000000..+.............
0x52b9e90acb12b0500000000c0b12b0500000000..+.......+.....
0x52b9ea0d0b12b05000000000000000000000000..+.............
0x52b9eb0e0b12b0500000000f8b12b0500000000..+.......+.....
0x52b9ec014b22b05000000001eb22b0500000000..+.......+.....
0x52b9ed030b22b050000000046b22b05000000000.+.....F.+.....
0x52b9ee056b22b05000000006eb22b0500000000V.+.....n.+.....
0x52b9ef082b22b050000000090b22b0500000000..+.......+.....
0x52b9f00a0b22b0500000000b0b22b0500000000..+.......+.....
0x52b9f10c0b22b0500000000dab22b0500000000..+.......+.....
0x52b9f20eab22b0500000000fab22b0500000000..+.......+.....
0x52b9f300eb32b050000000022b32b0500000000..+.....".+.....
0x52b9f4036b32b050000000054b32b05000000006.+.....T.+.....
0x52b9f5068b32b05000000007ab32b0500000000h.+.....z.+.....
0x52b9f6000000000000000008eb32b0500000000..........+.....
0x52b9f70a8b32b0500000000c6b32b0500000000..+.......+.....
0x52b9f80e4b32b0500000000f4b32b0500000000..+.......+.....
0x52b9f900cb42b05000000001cb42b0500000000..+.......+.....
0x52b9fa038b42b050000000052b42b05000000008.+.....R.+.....
0x52b9fb064b42b05000000000000000000000000d.+.............
0x52b9fc076b42b050000000088b42b0500000000v.+.......+.....
0x52b9fd0a6b42b0500000000c0b42b0500000000..+.......+.....

CreateProcessW API symbol 0x52c35f0–0x52c38e0

⋯3 more rows
0x52c362074654a6f624f626a656374410000ee00teJobObjectA....
0x52c36304372656174654a6f624f626a65637457CreateJobObjectW
0x52c36400000f2004372656174654d656d6f7279....CreateMemory
0x52c36505265736f757263654e6f746966696361ResourceNotifica
0x52c366074696f6e0000f6004372656174654d75tion....CreateMu
0x52c3670746578570000f7004372656174654e61texW....CreateNa
0x52c36806d656450697065410000f80043726561medPipeA....Crea
0x52c369074654e616d6564506970655700000201teNamedPipeW....
0x52c36a043726561746550726f63657373570000CreateProcessW..
0x52c36b0030143726561746550736575646f436f..CreatePseudoCo
0x52c36c06e736f6c650006014372656174655365nsole...CreateSe
0x52c36d06d6170686f72654100000d0143726561maphoreA....Crea
0x52c36e0746553796d626f6c69634c696e6b5700teSymbolicLinkW.
0x52c36f00f014372656174655468726561640000..CreateThread..
0x52c37001d014372656174655761697461626c65..CreateWaitable
0x52c371054696d65724578570000250144656275TimerExW..%.Debu
0x52c372067427265616b000028014465636f6465gBreak..(.Decode
0x52c3730506f696e746572002f0144656c657465Pointer./.Delete
0x52c3740437269746963616c53656374696f6e00CriticalSection.
0x52c3750330144656c65746546696c65410036013.DeleteFileA.6.
0x52c376044656c65746546696c65570037014465DeleteFileW.7.De
0x52c37706c65746550726f635468726561644174leteProcThreadAt
0x52c3780747269627574654c6973740041014465tributeList.A.De
0x52c379076696365496f436f6e74726f6c004f01viceIoControl.O.
0x52c37a04475706c696361746548616e646c6500DuplicateHandle.
0x52c37b05301456e636f6465506f696e74657200S.EncodePointer.
0x52c37c05601456e645570646174655265736f75V.EndUpdateResou
0x52c37d07263655700005701456e746572437269rceW..W.EnterCri
0x52c37e0746963616c53656374696f6e00006901ticalSection..i.
0x52c37f0456e756d5265736f757263654c616e67EnumResourceLang
0x52c380075616765735700006d01456e756d5265uagesW..m.EnumRe
0x52c3810736f757263654e616d65735700007b01sourceNamesW..{.
0x52c3820456e756d53797374656d4c6f63616c65EnumSystemLocale
0x52c38307357000086014578697450726f636573sW....ExitProces
0x52c384073008701457869745468726561640000s...ExitThread..
0x52c38508901457870616e64456e7669726f6e6d..ExpandEnvironm
0x52c3860656e74537472696e6773410092014669entStringsA...Fi
0x52c38706c6554696d65546f53797374656d5469leTimeToSystemTi
0x52c38806d650000930146696c6c436f6e736f6cme....FillConsol
0x52c3890654f7574707574417474726962757465eOutputAttribute
0x52c38a00000950146696c6c436f6e736f6c654f....FillConsoleO
0x52c38b075747075744368617261637465725700utputCharacterW.
0x52c38c09d0146696e64436c6f736500a3014669..FindClose...Fi
0x52c38d06e64466972737446696c654578570000ndFirstFileExW..
0x52c38e0a80146696e64466972737446696c6557..FindFirstFileW