Malware Analysis Report

2025-08-11 06:15

Sample ID 231118-ggz8lsch6y
Target 1177d948403b0efc96899542aa7121d3.exe
SHA256 db356737d8940879b057bd0173aae780602b9ceb0a5790bd90e12c5cfc194088
Tags
rat dcrat evasion infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

db356737d8940879b057bd0173aae780602b9ceb0a5790bd90e12c5cfc194088

Threat Level: Known bad

The file 1177d948403b0efc96899542aa7121d3.exe was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion infostealer

DCRat payload

Dcrat family

DcRat

DCRat payload

Disables Task Manager via registry modification

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-18 05:47

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-18 05:47

Reported

2023-11-18 05:49

Platform

win7-20231020-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe"

Signatures

DcRat

rat infostealer dcrat

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 796 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 796 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 796 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 796 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 796 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 796 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 796 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 796 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat
PID 796 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat
PID 796 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat
PID 796 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat
PID 1736 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat C:\Windows\SysWOW64\WScript.exe
PID 1736 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat C:\Windows\SysWOW64\WScript.exe
PID 1736 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat C:\Windows\SysWOW64\WScript.exe
PID 1736 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat C:\Windows\SysWOW64\WScript.exe
PID 1980 wrote to memory of 2496 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1980 wrote to memory of 2496 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1980 wrote to memory of 2496 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1980 wrote to memory of 2496 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2496 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2496 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2496 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2156 wrote to memory of 2680 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 2680 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 2680 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 2856 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 2856 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 2856 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2496 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2496 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2496 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2680 wrote to memory of 2552 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2680 wrote to memory of 2552 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2680 wrote to memory of 2552 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2552 wrote to memory of 2792 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2552 wrote to memory of 2792 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2552 wrote to memory of 2792 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2552 wrote to memory of 2728 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2552 wrote to memory of 2728 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2552 wrote to memory of 2728 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2792 wrote to memory of 536 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2792 wrote to memory of 536 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2792 wrote to memory of 536 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 536 wrote to memory of 2236 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 536 wrote to memory of 2236 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 536 wrote to memory of 2236 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 536 wrote to memory of 3040 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 536 wrote to memory of 3040 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 536 wrote to memory of 3040 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2236 wrote to memory of 932 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2236 wrote to memory of 932 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2236 wrote to memory of 932 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 932 wrote to memory of 1196 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 1196 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 1196 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 832 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 832 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 832 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 1196 wrote to memory of 824 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 1196 wrote to memory of 824 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 1196 wrote to memory of 824 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 824 wrote to memory of 840 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe

"C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe"

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

"C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe"

C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

"C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Runtimemonitornet\CYRXQuRYufl9oKefmNyIPlQ7hY.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Runtimemonitornet\Xr0neB4HusMZHl.bat" "

C:\Runtimemonitornet\portbrowserdriver.exe

"C:\Runtimemonitornet\portbrowserdriver.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67e49733-b4c5-4130-acf9-a78ba3967524.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fea66b2-086a-4441-977c-b349372b1a1e.vbs"

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\352288e5-d9c5-4656-8231-27bbe2ced0e9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e1534f2-baf8-433d-8f9a-ed7bbacd6241.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3f5db80-f491-4a45-8368-23f6e6fb2ebe.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ccd30e05-e8ed-4f52-a80c-610b93a94684.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93e0208f-0aba-4a73-9dfb-bbd3c5b46033.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35dc515a-c992-4691-beb2-97b8b4139d9f.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c42be368-799a-44df-aaa1-c6698b01076b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd229b93-f6c8-4fe1-976f-03975d4551f1.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e000e3b2-7283-40b0-8e42-8c75bff24975.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b83579b2-f048-4bd8-8083-ac2edbc76e28.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12458de5-a6f7-4828-b032-ba8b8ee008b4.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\642932c7-561b-401c-af14-d183374bbb8d.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7b8d7da-02ba-458a-84f7-6aa96f90c2e9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44a6cc19-e0f5-43de-ab94-27fcf6b158ce.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e4df2ab-8bf5-45c6-bc64-70a316738c9f.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd8fafa1-116b-44e6-b251-03b5cf8c4e1f.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ac396a1-d612-4806-a7ad-882060e1b2ce.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6853fd4b-c6e9-4dfc-8fb5-b8c7b2ba354a.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1418d262-1176-4024-bbf5-68ecc03efcb7.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ddf36c2-b52f-402f-881f-5035291a4892.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\644ff593-25fd-4bf8-8a5a-f5ef59cff939.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\401ce307-ad5b-4219-9419-4b1015079f92.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74d7c463-3f1b-4c74-84a2-894958209f95.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc5123b0-94cd-42a5-8f05-90c3827b3b41.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c888f66-c1a2-47ce-b07b-43a3bfe3be00.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3979c866-d26d-4aff-96b7-80328cf06459.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 078374cm.nyashnyash.top udp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp

Files

\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

MD5 16f8c13e8690e478a74743b896b83198
SHA1 96c6f52d49bb4786203185308d067249653d7b4f
SHA256 5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687
SHA512 61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

MD5 16f8c13e8690e478a74743b896b83198
SHA1 96c6f52d49bb4786203185308d067249653d7b4f
SHA256 5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687
SHA512 61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

MD5 16f8c13e8690e478a74743b896b83198
SHA1 96c6f52d49bb4786203185308d067249653d7b4f
SHA256 5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687
SHA512 61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

MD5 c1804f2b71c50f2c16dd52fb0035546e
SHA1 899b844a27275b81d99fc658aa34f49a9ad7e6b7
SHA256 25072743dadf6a8053ab2f45ecbf37c0e18c6a404665a46baf1896220ceeb67a
SHA512 29082d88915b8430c1c5fe32366fe58536ebdffc40bc101de2e2b9cfd0e5b894092aec4a2b3afd17938e2f189271118d5447572f0d8ca99a72a2d98594321416

\Users\Admin\AppData\Local\Temp\nsi5255.tmp\UserInfo.dll

MD5 9301577ff4d229347fe33259b43ef3b2
SHA1 5e39eb4f99920005a4b2303c8089d77f589c133d
SHA256 090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
SHA512 77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

\Users\Admin\AppData\Local\Temp\nsi5255.tmp\System.dll

MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

\Users\Admin\AppData\Local\Temp\nsi5255.tmp\uac.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

memory/796-28-0x0000000000400000-0x00000000007C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

MD5 c1804f2b71c50f2c16dd52fb0035546e
SHA1 899b844a27275b81d99fc658aa34f49a9ad7e6b7
SHA256 25072743dadf6a8053ab2f45ecbf37c0e18c6a404665a46baf1896220ceeb67a
SHA512 29082d88915b8430c1c5fe32366fe58536ebdffc40bc101de2e2b9cfd0e5b894092aec4a2b3afd17938e2f189271118d5447572f0d8ca99a72a2d98594321416

C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

MD5 c1804f2b71c50f2c16dd52fb0035546e
SHA1 899b844a27275b81d99fc658aa34f49a9ad7e6b7
SHA256 25072743dadf6a8053ab2f45ecbf37c0e18c6a404665a46baf1896220ceeb67a
SHA512 29082d88915b8430c1c5fe32366fe58536ebdffc40bc101de2e2b9cfd0e5b894092aec4a2b3afd17938e2f189271118d5447572f0d8ca99a72a2d98594321416

\Users\Admin\AppData\Local\Temp\nsi5255.tmp\utils.dll

MD5 aad3f2ecc74ddf65e84dcb62cf6a77cd
SHA1 1e153e0f4d7258cae75847dba32d0321864cf089
SHA256 1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8
SHA512 8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

C:\Runtimemonitornet\CYRXQuRYufl9oKefmNyIPlQ7hY.vbe

MD5 7a23d255d6096654045e124588467fa3
SHA1 fc48f5ec448a8cfa325d78687e3f77d34acbbdf6
SHA256 a2764a313331d16396cae1ae82678b5ec9b59f3da9e263156c9fab19c861453c
SHA512 4243cd89fa69179abadc8b6f0ba795097dfb970845f787ed59ae6a22078236deba6dba954edc8a289854f535b15913aab523d390717ca913b7166d5f6d18946b

C:\Users\Admin\AppData\Local\Temp\nsi5255.tmp\System.dll

MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

C:\Users\Admin\AppData\Local\Temp\nsi5255.tmp\uac.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

C:\Users\Admin\AppData\Local\Temp\nsi5255.tmp\UserInfo.dll

MD5 9301577ff4d229347fe33259b43ef3b2
SHA1 5e39eb4f99920005a4b2303c8089d77f589c133d
SHA256 090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
SHA512 77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

C:\Users\Admin\AppData\Local\Temp\nsi5255.tmp\utils.dll

MD5 aad3f2ecc74ddf65e84dcb62cf6a77cd
SHA1 1e153e0f4d7258cae75847dba32d0321864cf089
SHA256 1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8
SHA512 8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

C:\Runtimemonitornet\Xr0neB4HusMZHl.bat

MD5 8e3e659843bd305ae3a47604863d7a6f
SHA1 5d54189572d9d7e25459be0f4c65cd5f71fb1245
SHA256 2558798b22ce74da0bbbc3c15cf866117bb995d310dabd9cf2b31cfb5208c3c5
SHA512 52ed9fe42f01618ecf46ce5929e8fc08b1fd2779b8a2a796feab2ce3fc7b211ec41f515fc39abc5554ba3958b61af935153e55f247413167302cf8cffa10602c

\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/2156-332-0x0000000000D90000-0x0000000000F04000-memory.dmp

memory/2156-333-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

memory/2156-334-0x000000001B040000-0x000000001B0C0000-memory.dmp

memory/2156-335-0x00000000001C0000-0x00000000001DC000-memory.dmp

memory/2156-336-0x0000000000350000-0x0000000000360000-memory.dmp

memory/2156-337-0x0000000000360000-0x0000000000376000-memory.dmp

memory/2156-338-0x0000000000380000-0x000000000038C000-memory.dmp

memory/2156-339-0x0000000000390000-0x000000000039A000-memory.dmp

memory/2156-340-0x00000000005B0000-0x00000000005BC000-memory.dmp

memory/2156-341-0x00000000005C0000-0x00000000005CA000-memory.dmp

memory/2156-342-0x00000000005D0000-0x00000000005DE000-memory.dmp

memory/2156-343-0x00000000005E0000-0x00000000005E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2fea66b2-086a-4441-977c-b349372b1a1e.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

C:\Users\Admin\AppData\Local\Temp\67e49733-b4c5-4130-acf9-a78ba3967524.vbs

MD5 0b62d905c2db84cb33f5532b55238f03
SHA1 841dcc8d081d30e418f9d40bbdece64769320676
SHA256 59eaa1593aab683518e7980168df1455746951f6932abc017abb662476930f95
SHA512 a2e3f78e6f195a61e3c5c2e8dc89c16dd2d0cde5578930bcb9d0804b35df8f1fe91f1cb10ed931b256ba6ba32bb62d55427902d86d6c0938608fa3c4b8d70df0

memory/2156-353-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/2552-355-0x0000000000FA0000-0x0000000001114000-memory.dmp

memory/2552-356-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

memory/2552-357-0x000000001AF70000-0x000000001AFF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\6e1534f2-baf8-433d-8f9a-ed7bbacd6241.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

C:\Users\Admin\AppData\Local\Temp\6e1534f2-baf8-433d-8f9a-ed7bbacd6241.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

C:\Users\Admin\AppData\Local\Temp\352288e5-d9c5-4656-8231-27bbe2ced0e9.vbs

MD5 bf129f7b80301809978c4aa385779a79
SHA1 d9113412a647608e78039ff7d5c96f0861ce706e
SHA256 442c1410cfa9ba22c65556916349735ec60a52b2fbed67362114f9cbfad42390
SHA512 489642c2c468fc807aa6d60e539cff942b4ce4f1f9fb0ffa64c48384e523c794f50aca8204fe5b2a4770e65e35a3bf0c6dd932a1bf1cf632f16a2fb351cecb80

memory/2552-368-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/536-370-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

memory/536-371-0x000000001B160000-0x000000001B1E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\c3f5db80-f491-4a45-8368-23f6e6fb2ebe.vbs

MD5 acd5ca2cb278a1017a08b8f51e52c572
SHA1 e994f8e180f4ded1d5e53351d7a365627e19b21d
SHA256 a7358f03f0b1a8f05dfae38f013f7ba1048d5156f4e45bd81721dfebda6fcbec
SHA512 d303587331e64ffa76a524d1f28a352dad66b8842438f96b0e7422f774230709f294d12bf1901e62f881745e82f0361633054a25bfce2d56e6e8a4a2912b718b

C:\Users\Admin\AppData\Local\Temp\ccd30e05-e8ed-4f52-a80c-610b93a94684.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

memory/536-382-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/932-384-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\35dc515a-c992-4691-beb2-97b8b4139d9f.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

C:\Users\Admin\AppData\Local\Temp\93e0208f-0aba-4a73-9dfb-bbd3c5b46033.vbs

MD5 942c67cafc6a913edb2eab5211fb7450
SHA1 abf250b9a43535db1e95722b3921c75c8e2e3e8c
SHA256 41d6bc5dd4ada99dbbff7cf020a11e2febeb2a2f81802ec9810baad7cee0d489
SHA512 8a4be73ccafae5977170f2dcd274dcfd1d838dfbfd7445c7c7d7f175fb9dc4ec36a8110761dae49d128ee51859a1a56293395f73bdbfb0d4b697ba4dcb5c660a

memory/932-395-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/824-397-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

memory/824-398-0x000000001B0C0000-0x000000001B140000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\c42be368-799a-44df-aaa1-c6698b01076b.vbs

MD5 9de81755bc56b37a315e4ae49d3c9b8e
SHA1 27f371338f98f8a66e99ba84f86bd36aabbc5609
SHA256 6a24b23ace395d5fcba8864838ab5b1832e039eb731496b39eee71d52e19dea4
SHA512 34dc6cb9349d0856098f6601b7366abbda62220fc6a9699b965cc0951cc42cfb36744b869360c82d9447540dc5350c324b633c4519d10a8319ce99e12c8c9844

C:\Users\Admin\AppData\Local\Temp\fd229b93-f6c8-4fe1-976f-03975d4551f1.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

memory/824-409-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/2516-411-0x00000000001E0000-0x0000000000354000-memory.dmp

memory/2516-412-0x000007FEF4FF0000-0x000007FEF59DC000-memory.dmp

memory/2516-413-0x000000001AF90000-0x000000001B010000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\e000e3b2-7283-40b0-8e42-8c75bff24975.vbs

MD5 3651c091e0c8cda7b828aa8cbbae9817
SHA1 17e33f4b92450dcec79b4a5155978c7b61811d09
SHA256 45242ca69a812a65c5650215eda72b5856d64a3f7acd0ff761b722858663136a
SHA512 910e088c8723117a193f745c47a96419602f20cce4f82f4314de8cf230ef0434c0391b5e0385484e4801c93da3a6c3b3179c6442fa710b94563f70cea7ae413a

C:\Users\Admin\AppData\Local\Temp\b83579b2-f048-4bd8-8083-ac2edbc76e28.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

memory/2516-424-0x000007FEF4FF0000-0x000007FEF59DC000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/2216-426-0x0000000000240000-0x00000000003B4000-memory.dmp

memory/2216-427-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

memory/2216-428-0x000000001B230000-0x000000001B2B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\12458de5-a6f7-4828-b032-ba8b8ee008b4.vbs

MD5 cb653d1f16e348451218dd6a7292c3a4
SHA1 d3775f6bf2b99a98447b83844a19980d50bf7c57
SHA256 072a056c65dedf3a740428931f69e63adce8298b00f7414c2311b5a846975ec9
SHA512 d91e5147d96a365fc8e4c0b64f68b159f2f8f18f8c25fa6a8705831fda961010a94c2e0d7f36b5f9f7852fe321c7368e31a0a9a69360d141e59775328da1af1e

C:\Users\Admin\AppData\Local\Temp\642932c7-561b-401c-af14-d183374bbb8d.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

memory/2216-439-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/3060-442-0x000007FEF4FF0000-0x000007FEF59DC000-memory.dmp

memory/3060-441-0x0000000000110000-0x0000000000284000-memory.dmp

memory/3060-443-0x000000001B230000-0x000000001B2B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\c7b8d7da-02ba-458a-84f7-6aa96f90c2e9.vbs

MD5 4a7e2d837b402e28ea7e98a40b70d6c0
SHA1 f44ac4566c299f3985e493e9e489501940bd9ff4
SHA256 062981d6318a42ff4f2d5a6b4262a852b6381f75f32311a6383120bbcddf0942
SHA512 1da2d1ba2b2a7d1fb8080993bebde4fd9938942cdb4464f6a2ab3c56bac302909174bbe139065523c8885c73ad3ec8959b19a206ff281776cc153fcbd648a252

C:\Users\Admin\AppData\Local\Temp\44a6cc19-e0f5-43de-ab94-27fcf6b158ce.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

memory/3060-454-0x000007FEF4FF0000-0x000007FEF59DC000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/2772-457-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

memory/2772-456-0x0000000000CD0000-0x0000000000E44000-memory.dmp

memory/2772-458-0x000000001B200000-0x000000001B280000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\7e4df2ab-8bf5-45c6-bc64-70a316738c9f.vbs

MD5 a2b415141d3359980f4a942d6c755628
SHA1 59d4216ba6014878a7fa9956d963833938cbcc9b
SHA256 c0422a74a3f737635bc88c70906c8b399bdc7aafbd2d23ca832477e6ec99caf1
SHA512 ef251b6d8c2c3b7287041d807f6026ceb4d7737006ded34902af32149c7c5063a576ad7a802281005b4183eee1d20d65b5ed8de09dacc8ccd8399667c7781e48

C:\Users\Admin\AppData\Local\Temp\cd8fafa1-116b-44e6-b251-03b5cf8c4e1f.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

memory/2772-469-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/756-471-0x000007FEF4FF0000-0x000007FEF59DC000-memory.dmp

memory/756-472-0x000000001B290000-0x000000001B310000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\6853fd4b-c6e9-4dfc-8fb5-b8c7b2ba354a.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

C:\Users\Admin\AppData\Local\Temp\1ac396a1-d612-4806-a7ad-882060e1b2ce.vbs

MD5 b1898bf9705e84c41db9b57f1439e0dc
SHA1 c6e0a26101ce374c73e27a2c9378173976b722e4
SHA256 a8030ba5aed9004fe8cfe8c28ec56c7f726db4ce47f940f9bb46293d1612ee97
SHA512 ec6313cde1d272678697dbed60ea00bf2a6f1c634ea5d0a2e3c6543cabc4fb82d9d221fcfe602ad531effccea9a869dba5662cfdb4feed9e052ac9ffd9f64880

memory/756-483-0x000007FEF4FF0000-0x000007FEF59DC000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/2700-485-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

memory/2700-486-0x00000000003D0000-0x0000000000544000-memory.dmp

memory/2700-487-0x000000001B040000-0x000000001B0C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\1418d262-1176-4024-bbf5-68ecc03efcb7.vbs

MD5 c05e10178fd90dfc6135420347a69fc7
SHA1 0abb50c06d650d49e4d5e92f79163d1a663e4eec
SHA256 15e9303b3fcd8fb662395e137fdd8ca694af5b1a234cc03e395b89b54ccfabd4
SHA512 380827ec82f73a147aa2f62db5430e9b387cd603c13af6bdc8443fa79d65fbaba3130bfe41ed3fb57f86d2a824a908f4f8ba428f19978b0df5e71631c3e29eee

C:\Users\Admin\AppData\Local\Temp\0ddf36c2-b52f-402f-881f-5035291a4892.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

memory/2700-498-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/2020-500-0x00000000012C0000-0x0000000001434000-memory.dmp

memory/2020-501-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

memory/2020-502-0x000000001B100000-0x000000001B180000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\644ff593-25fd-4bf8-8a5a-f5ef59cff939.vbs

MD5 e21f64fac4d1f1dc0e937f08734ccd10
SHA1 542e662e7f0c8b0f5c4d1baa7100b2f499d3c630
SHA256 b02c2aa1bdd3c7f0c04167b9d3fee901b127548eb3f38cc30dbf5833087d7a6f
SHA512 c12a959791d79103fcf39b35b25bd906f25b3360f5cf8fa598226e01d676b487744f93897feaf7bc131054e7b26d7e1fcc04d4e78609699a3f40ee460111c66a

C:\Users\Admin\AppData\Local\Temp\401ce307-ad5b-4219-9419-4b1015079f92.vbs

MD5 777592f9e36573cf88e125eb8716b4a2
SHA1 3562b2221fbe61973b57fd926e44364191989a46
SHA256 cb19bd6b0bfcf59abf351db206d346f18d9f5da83f2cf188fa0376e46dad387b
SHA512 f49fe21007e4343e3e253bd5fad50d0be40c87ba80b63a546a35af1eed4d6807c43bb7c28a29cafd52202743089c3c29831ec4ab343c02849e368ec5fb3390c0

memory/2020-513-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/1144-515-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

memory/1144-516-0x000000001B180000-0x000000001B200000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a2a06d7b074d0ddb6637338abe03d68c089f6ac.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/1144-525-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

memory/2984-528-0x00000000000B0000-0x0000000000224000-memory.dmp

memory/2984-536-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

memory/1696-538-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

memory/1696-537-0x0000000001340000-0x00000000014B4000-memory.dmp

memory/1696-539-0x00000000012A0000-0x0000000001320000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-18 05:47

Reported

2023-11-18 05:49

Platform

win10v2004-20231020-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe"

Signatures

DcRat

rat infostealer dcrat

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings C:\Runtimemonitornet\portbrowserdriver.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWinstaller.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A
Token: SeDebugPrivilege N/A C:\Runtimemonitornet\portbrowserdriver.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3748 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 3748 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 3748 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
PID 3748 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat
PID 3748 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat
PID 3748 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat
PID 2936 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWinstaller.exe
PID 2936 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWinstaller.exe
PID 2444 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat C:\Windows\SysWOW64\WScript.exe
PID 2444 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat C:\Windows\SysWOW64\WScript.exe
PID 2444 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat C:\Windows\SysWOW64\WScript.exe
PID 4552 wrote to memory of 3460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4552 wrote to memory of 3460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4552 wrote to memory of 3460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 3460 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 3920 wrote to memory of 652 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3920 wrote to memory of 652 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3920 wrote to memory of 4076 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3920 wrote to memory of 4076 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3460 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3460 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3460 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 652 wrote to memory of 3716 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 652 wrote to memory of 3716 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 3716 wrote to memory of 2976 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3716 wrote to memory of 2976 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3716 wrote to memory of 3368 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3716 wrote to memory of 3368 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2976 wrote to memory of 1948 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2976 wrote to memory of 1948 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 1948 wrote to memory of 5064 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 1948 wrote to memory of 5064 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 1948 wrote to memory of 5052 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 1948 wrote to memory of 5052 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 5064 wrote to memory of 3264 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 5064 wrote to memory of 3264 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 3264 wrote to memory of 4976 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3264 wrote to memory of 4976 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3264 wrote to memory of 3080 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3264 wrote to memory of 3080 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 4976 wrote to memory of 3848 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 4976 wrote to memory of 3848 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 3848 wrote to memory of 2020 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3848 wrote to memory of 2020 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3848 wrote to memory of 4876 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3848 wrote to memory of 4876 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2020 wrote to memory of 2912 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2020 wrote to memory of 2912 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2912 wrote to memory of 3664 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2912 wrote to memory of 3664 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2912 wrote to memory of 1000 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2912 wrote to memory of 1000 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 3664 wrote to memory of 2456 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 3664 wrote to memory of 2456 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2456 wrote to memory of 4864 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2456 wrote to memory of 4864 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2456 wrote to memory of 3056 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2456 wrote to memory of 3056 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 4864 wrote to memory of 2428 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 4864 wrote to memory of 2428 N/A C:\Windows\System32\WScript.exe C:\Runtimemonitornet\portbrowserdriver.exe
PID 2428 wrote to memory of 1648 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2428 wrote to memory of 1648 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe
PID 2428 wrote to memory of 244 N/A C:\Runtimemonitornet\portbrowserdriver.exe C:\Windows\System32\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe

"C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe"

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

"C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe"

C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

"C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat"

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWinstaller.exe

"C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWinstaller.exe" Sel=0&Extension=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc&Name=Hone&Referer=hone.gg&Browser=microsoftedge -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc -AllowWindowsInsider --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --auto-close --silent-setup --app-name="Hone" -exepath C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Runtimemonitornet\CYRXQuRYufl9oKefmNyIPlQ7hY.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Runtimemonitornet\Xr0neB4HusMZHl.bat" "

C:\Runtimemonitornet\portbrowserdriver.exe

"C:\Runtimemonitornet\portbrowserdriver.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e0036b3-e45e-4e17-91b4-73e0608fe983.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ca44bec-42c7-44ce-9fd4-c55d6ba73482.vbs"

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3460106a-d9af-4c13-b1c7-79c7d2f4ab0b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd5c3ba6-abec-40d5-b7b2-ee726adfeb41.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcdf8b42-6e48-49a8-8297-f1f04d3406b9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78df77b6-4dd8-469d-9016-45121598c7b5.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe16ab8e-f3b6-4204-bcad-12cdaa1b5883.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75c8dcf2-dc2b-4341-8a48-c01dc69d8e37.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbd518ec-8cd8-40e3-a7c2-ce6a2b9b8883.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77fec87e-f28c-4d75-9529-c058db28d632.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02e23dda-73cc-474c-9487-80a676f75129.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c89744a5-e334-4b2d-8bc3-a588987348bf.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9db58b24-e497-43fe-8edb-5b16cea8cb53.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5baecdaf-7deb-48da-8abe-bb3f281db8a5.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ddc29db-fff4-4bb2-b677-cbac280a7277.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37b92c4c-7701-42ef-8499-b156fd46ec1a.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8ac16e2-babb-46e5-a32a-913114ba23a3.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3b9bfcb-f22d-49f7-9611-adfacdcba414.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6d7df7a-70d7-4c2c-9be8-72b0774c90b1.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba941854-a47b-44ed-8337-c71bcc5912d3.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b8d37eb-4a68-4510-8e49-bf983feefba2.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e0e10b1-f2a3-4a8f-b011-d82b949c15c3.vbs"

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Runtimemonitornet\portbrowserdriver.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\782433d0-b4a2-4af3-883b-2e50f2efc67a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\005f7cb5-dc43-4dd1-9cb1-f6da7c77b50e.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 112.208.253.8.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 analyticsnew.overwolf.com udp
DE 172.217.23.206:80 www.google-analytics.com tcp
US 18.65.39.88:80 analyticsnew.overwolf.com tcp
US 8.8.8.8:53 206.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 88.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 cdn.mxpnl.com udp
US 130.211.5.208:443 cdn.mxpnl.com tcp
US 8.8.8.8:53 208.5.211.130.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 078374cm.nyashnyash.top udp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 8.8.8.8:53 121.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp
US 188.114.96.0:80 078374cm.nyashnyash.top tcp

Files

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

MD5 16f8c13e8690e478a74743b896b83198
SHA1 96c6f52d49bb4786203185308d067249653d7b4f
SHA256 5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687
SHA512 61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

MD5 16f8c13e8690e478a74743b896b83198
SHA1 96c6f52d49bb4786203185308d067249653d7b4f
SHA256 5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687
SHA512 61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

MD5 c1804f2b71c50f2c16dd52fb0035546e
SHA1 899b844a27275b81d99fc658aa34f49a9ad7e6b7
SHA256 25072743dadf6a8053ab2f45ecbf37c0e18c6a404665a46baf1896220ceeb67a
SHA512 29082d88915b8430c1c5fe32366fe58536ebdffc40bc101de2e2b9cfd0e5b894092aec4a2b3afd17938e2f189271118d5447572f0d8ca99a72a2d98594321416

memory/3748-14-0x0000000000400000-0x00000000007C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

MD5 16f8c13e8690e478a74743b896b83198
SHA1 96c6f52d49bb4786203185308d067249653d7b4f
SHA256 5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687
SHA512 61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\System.dll

MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\uac.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\uac.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\UserInfo.dll

MD5 9301577ff4d229347fe33259b43ef3b2
SHA1 5e39eb4f99920005a4b2303c8089d77f589c133d
SHA256 090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
SHA512 77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

MD5 c1804f2b71c50f2c16dd52fb0035546e
SHA1 899b844a27275b81d99fc658aa34f49a9ad7e6b7
SHA256 25072743dadf6a8053ab2f45ecbf37c0e18c6a404665a46baf1896220ceeb67a
SHA512 29082d88915b8430c1c5fe32366fe58536ebdffc40bc101de2e2b9cfd0e5b894092aec4a2b3afd17938e2f189271118d5447572f0d8ca99a72a2d98594321416

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\utils.dll

MD5 aad3f2ecc74ddf65e84dcb62cf6a77cd
SHA1 1e153e0f4d7258cae75847dba32d0321864cf089
SHA256 1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8
SHA512 8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWInstaller.exe

MD5 6107a3d125a6867a4e6e411c1b78440a
SHA1 491aea922d4babee86edeafd2d9f914179780c9a
SHA256 f70f8a5011baf8a7f62c9161f5e8b5f71906fb9c87b983248ebb6d40ccd87b02
SHA512 f84fa1f7040166b49c787d3f2e55e1db102a9f66024ec6546dcac0d3b1f6df6aff2f927df3fd8a94c72e94e4b022f85f4c2337c5e725f363c3163ddd2112d12a

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWinstaller.exe.config

MD5 82d22e4e19e27e306317513b9bfa70ff
SHA1 ff3c7dd06b7fff9c12b1beaf0ca32517710ac161
SHA256 272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827
SHA512 b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWinstaller.exe

MD5 6107a3d125a6867a4e6e411c1b78440a
SHA1 491aea922d4babee86edeafd2d9f914179780c9a
SHA256 f70f8a5011baf8a7f62c9161f5e8b5f71906fb9c87b983248ebb6d40ccd87b02
SHA512 f84fa1f7040166b49c787d3f2e55e1db102a9f66024ec6546dcac0d3b1f6df6aff2f927df3fd8a94c72e94e4b022f85f4c2337c5e725f363c3163ddd2112d12a

memory/2056-151-0x000001AA97F70000-0x000001AA97FC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OverWolf.Client.CommonUtils.dll

MD5 95c1a39be054c68568bb1ce7ddfb4504
SHA1 28dea40e47a2bec5c4ee6fe88008200270b80c45
SHA256 65d2077fbbf02eb0412836975e1fc31f825e5ea4042a5a41a564f8dab045a591
SHA512 7fd55ae85d61b752b49c9a2c0297398ff4c353d2dbcee86153537ce8da3df3ecf4a5c5707527ace65576c5ef334976932792ed4c78869d08364a5229a6a63a73

memory/2056-156-0x000001AAB2530000-0x000001AAB25C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OverWolf.Client.CommonUtils.dll

MD5 95c1a39be054c68568bb1ce7ddfb4504
SHA1 28dea40e47a2bec5c4ee6fe88008200270b80c45
SHA256 65d2077fbbf02eb0412836975e1fc31f825e5ea4042a5a41a564f8dab045a591
SHA512 7fd55ae85d61b752b49c9a2c0297398ff4c353d2dbcee86153537ce8da3df3ecf4a5c5707527ace65576c5ef334976932792ed4c78869d08364a5229a6a63a73

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OverWolf.Client.CommonUtils.dll

MD5 95c1a39be054c68568bb1ce7ddfb4504
SHA1 28dea40e47a2bec5c4ee6fe88008200270b80c45
SHA256 65d2077fbbf02eb0412836975e1fc31f825e5ea4042a5a41a564f8dab045a591
SHA512 7fd55ae85d61b752b49c9a2c0297398ff4c353d2dbcee86153537ce8da3df3ecf4a5c5707527ace65576c5ef334976932792ed4c78869d08364a5229a6a63a73

memory/2056-153-0x00007FFEB39A0000-0x00007FFEB4461000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\CommandLine.dll

MD5 aa4c7e669dfc9c9285a8e779967f9a50
SHA1 fd712e38610cefa9bb2c359c6d1d16b2baf4fb71
SHA256 80294ac18fb7a5db75c389d1bd8c5aeda3074890bc77faab6e253731ba00d8f3
SHA512 f339dd14914beb62c33a15379c5cd186c71b3d927895bc40e52ae60137f3afdef371db04f170f1e9a68fb20cb19552ac472f59c773b9b28b731419b6cbd12fc5

memory/2056-158-0x000001AA98390000-0x000001AA983A4000-memory.dmp

C:\Runtimemonitornet\CYRXQuRYufl9oKefmNyIPlQ7hY.vbe

MD5 7a23d255d6096654045e124588467fa3
SHA1 fc48f5ec448a8cfa325d78687e3f77d34acbbdf6
SHA256 a2764a313331d16396cae1ae82678b5ec9b59f3da9e263156c9fab19c861453c
SHA512 4243cd89fa69179abadc8b6f0ba795097dfb970845f787ed59ae6a22078236deba6dba954edc8a289854f535b15913aab523d390717ca913b7166d5f6d18946b

memory/2056-160-0x000001AAB2B00000-0x000001AAB3028000-memory.dmp

memory/2056-161-0x000001AA983E0000-0x000001AA983F0000-memory.dmp

memory/2056-163-0x000001AA99D20000-0x000001AA99D66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\log4net.dll

MD5 f15c8a9e2876568b3910189b2d493706
SHA1 32634db97e7c1705286cb1ac5ce20bc4e0ec17af
SHA256 ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309
SHA512 805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWInstaller.exe

MD5 6107a3d125a6867a4e6e411c1b78440a
SHA1 491aea922d4babee86edeafd2d9f914179780c9a
SHA256 f70f8a5011baf8a7f62c9161f5e8b5f71906fb9c87b983248ebb6d40ccd87b02
SHA512 f84fa1f7040166b49c787d3f2e55e1db102a9f66024ec6546dcac0d3b1f6df6aff2f927df3fd8a94c72e94e4b022f85f4c2337c5e725f363c3163ddd2112d12a

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\OWInstaller.exe

MD5 6107a3d125a6867a4e6e411c1b78440a
SHA1 491aea922d4babee86edeafd2d9f914179780c9a
SHA256 f70f8a5011baf8a7f62c9161f5e8b5f71906fb9c87b983248ebb6d40ccd87b02
SHA512 f84fa1f7040166b49c787d3f2e55e1db102a9f66024ec6546dcac0d3b1f6df6aff2f927df3fd8a94c72e94e4b022f85f4c2337c5e725f363c3163ddd2112d12a

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\SharpRaven.dll

MD5 66ee601c0e4cf3b76419638d8395ec1f
SHA1 e0c8ba84b40731cbb5e1b57e275d2e292a90f7e5
SHA256 853154abcf404fff813cdbedf1ff183c298628bc77f52a9e350b06b3d6479ad4
SHA512 da3b5b88fa79430ddb6a60ad3fe94f24d0b7d12d794dbf1d9a9410932d9f1f308aacbde6a4c532ce9d2f9d3ef3be7e61dbd8531d471f06070d9454e3f77552c4

memory/2056-167-0x000001AA99D70000-0x000001AA99D88000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\Newtonsoft.Json.dll

MD5 98cbb64f074dc600b23a2ee1a0f46448
SHA1 c5e5ec666eeb51ec15d69d27685fe50148893e34
SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
SHA512 eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

memory/2056-178-0x000001AAB3030000-0x000001AAB30E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\manifest.json

MD5 526a62540280743fc0696e17c072b26f
SHA1 8a70dc1b4bc973ca4bcb84bfccba154324110fdd
SHA256 a1324546dd6467eb1e5892879f175f82a69a1eaa7cbbcadfa73a9f9012b72ae8
SHA512 b957741bf2335a54150a66b65100a99205f86264294d4765e60e4a1152387a543138b50875a02038da3f0a73089c4a00d7d7eb4955480d2ba7522a563ea63d76

C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

MD5 10dfafcc709f0f393a2bc60ce8d6fa2c
SHA1 6adc7e61701474832f9fb8b5e616664eb27b3a02
SHA256 5ceab7cb6575a16362b2d05ced5c12304b87c3a899104ad8083d934433fc12bc
SHA512 df8e23db7e1553576bfc27f0e8eb7522dea50dcb487136629010c6cd6737d5e473440d84fed9d333ece12b05a3ac592753a9e45662538151dd3d6db1c4330f89

C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

MD5 10dfafcc709f0f393a2bc60ce8d6fa2c
SHA1 6adc7e61701474832f9fb8b5e616664eb27b3a02
SHA256 5ceab7cb6575a16362b2d05ced5c12304b87c3a899104ad8083d934433fc12bc
SHA512 df8e23db7e1553576bfc27f0e8eb7522dea50dcb487136629010c6cd6737d5e473440d84fed9d333ece12b05a3ac592753a9e45662538151dd3d6db1c4330f89

memory/2056-196-0x000001AAB24C0000-0x000001AAB24E2000-memory.dmp

memory/2056-199-0x000001AA983E0000-0x000001AA983F0000-memory.dmp

memory/2056-200-0x000001AA983E0000-0x000001AA983F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\images\icon.ico

MD5 9a03fbfd56d8e501797359aac3d72ed1
SHA1 b31e87a87486c00f9266559707e2cae4831f9d44
SHA256 81c69b545c347e1708603fb912511d8eddf755cb27f37fdc6a6fd959c6cfb94e
SHA512 29eb96fe4bdded257f3330672b1f9f2086c28e1e863a093a6fb750b6e59210b47b5ed481e3828442f38c5c6d63ef37709716af1e3913afdf37bf8e574f976fb4

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\index.html

MD5 e9cf3fc4a324553c091ec478f8b01d22
SHA1 e7d230e0ec316c93e9bc8e150b1d61f51da68b67
SHA256 0b175eaa4cf0eb54bc1acbb5a77c51767f996dc49dcf3c13a66e5bd0c4b5580f
SHA512 851c9a35111ab5c94ba0e9117c66382f0fd1034050cb12b51bd3f96abb4ef8d8f73a0c2c7303abeba00b8dea19a787f65763300c857feece1629757760149d8b

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\libs\jquery-1.10.2.min.js

MD5 44e3f0db3e4ab6fedc5758c05cf27591
SHA1 2d408aa1d35661019c95adcc60b78c0727ed25b4
SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
SHA512 4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\libs\cmp.bundle.js

MD5 7364950940fee1134c989c64c5cd93a2
SHA1 8a3e94e9bcac0e29143a86e29615233ca3c1a56d
SHA256 b9ec65e242a1209ecff20b538940c151b1066a727d49fb0b5238da7fa4c5a302
SHA512 da6cabf660efaf6a46d6a73245b8cdb3918144dc7857600bd13ac8c42f1ee9ddd8b0de04dd746876a4851f15e73e4345465195b1b1abd08769fbcc2ca3ebbc6a

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\utils\commands.js

MD5 bfbe09f587c3457a7856775e56a4b043
SHA1 e33a70de9405c1f775b51d253812c5e9b57476be
SHA256 97ebe7b0880c38c707ee4f9b4a7a1e0cdc99dae8f16a4b4a4e6996f26dded675
SHA512 5820882e6185b6d4d10c41d862cd97382607e22de14abb6db6f79bd23bdebd5b52659b736ebfe09f91b387fd20e0b06440dbd573f4d64498a01a1b3f24b001b3

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\utils\analytics.js

MD5 f288498a7ad1ef51bcd3f3272a1809f7
SHA1 0a7bc52a557ae5cacb5ae7bddebefe0c1aec1ccf
SHA256 c76e5be6cf6513f988e69977a0fedea42fbc700a2e4ef7d136fdf72534ee8519
SHA512 7b2195ce7b6ff8f414ce43ee8cdbfc0660560b6802a2a6271b6a8eefd19d02810c200a51ea1e43269c18f70e5b749e7a515a6db7b8b8ffa7aeeca0a1cd32f057

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\utils\utils.js

MD5 a0952ebeab701c05c75710c33d725e7e
SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\utils\strings-loader.js

MD5 9c94eb933d8a43dd3825e67a7e30c980
SHA1 7ec7b16af6f399219209ba5967d377040486a11b
SHA256 96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf
SHA512 a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\block_inputs.js

MD5 b5b52c92b90f4283a761cb8a40860c75
SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\libs\mixpanel.js

MD5 344e4265b3d4e1fecfd81c561293edab
SHA1 51dbcac23b839e64362d11763bbe64538ad80bb8
SHA256 88872b5b01a8d1dfee124333aba630ceb8535390130833dd2a312c461ac52217
SHA512 dcda17cb89861c4cd0be4b7cd93b58283cd1acc3c7a4a2176add3ea6403079c8567bcf88d878aa2e91e96c43b15a7ce668299c3d015c6dc4db5b15cddbe4ea7d

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\welcome\welcome-controller.js

MD5 6127f0a4ee214776271ea6fce1fb58e9
SHA1 378cd32ccf043889de731fce6d96b6c21632a165
SHA256 aa42af897b154c05a5a5bdf5c9420e698bc943cf1a6fcd830aae7c5b8317f654
SHA512 f2b35ced730fb95b64dd72be81345788d1fb66d38f26f2ddeb205cbecfc767703a12c455d2bb8ba1dbada1a409e123aaf020a822321b8ad80947e67c53e83a9e

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js

MD5 01878b1f0f27ba2af34f89c648f3e16f
SHA1 b45e04411d06052772b4645d1feb7a594b722067
SHA256 4c96454e5b0493676af666aa5716ba12209aa72fb30e8dbde8e85ab000a4350a
SHA512 5a7860c8df74ad9dd2eea3bd0927dbfa1fff1de7b9a093a6d727ecc2abb7139d721cbf76c55a7ade24ade5e08e6547321a62e3a1440eb202b7a8569305dfa782

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\app.js

MD5 721c1af4b3d7019a97a62332061e3bce
SHA1 fbfc5abd340af76face22c1fafee2dc48a5cb3ed
SHA256 75afcf8bfc7a4ac876bd2c12243f479c744535578e6422a33493db5a51656b91
SHA512 7c0afb7469b678bed138e8d1111ad7ed88a0ac9270ffe2a66661786d4f6d0cd32fc38360f58cc976c6a60ab0914f305e4f762aa1bd871ee86acf5d226a65ecaf

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\main\main-controller.js

MD5 15b665a5c915004e1aa7e9e11a710f7e
SHA1 7821924e42bb19d60c572ff80bbaaa04d7aaeefb
SHA256 84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653
SHA512 dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\main\template.js

MD5 a118c7724c208f12083240cafccfd10b
SHA1 f89c676a215b869626737862a08c9eb07d440211
SHA256 63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc
SHA512 9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\finish-with-recommended-app\template.js

MD5 d1cb34b57cef7e28b9286454b197b712
SHA1 f3a964b319bab82d4eda07e126bbfd6dec35c349
SHA256 b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42
SHA512 3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\finish\finish-controller.js

MD5 cbdfd75bb47bda0ae536b3d45958b615
SHA1 9a69d440e1d8ba1976b2880964f7041c46e8bdf9
SHA256 b4221b80fbbc4ef93b3a1f668d8a3445353db9f3e1ec77c9b6520a7312ac46f9
SHA512 e78272fcd6af8656cd054c91b97508603792dcc75c4f7a123880671ff6ed126e03cd19ec13d005f655e8281a1e90f6b190be650ddf07522fa613a940148dd475

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\finish\template.js

MD5 f092de7ea66d8e920b345f38537fa35d
SHA1 82d107a409f18878307ae0cefe24074db64937c4
SHA256 b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f
SHA512 14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\progress\progress-1-controller.js

MD5 4bc723bda9cc718301f2533ca3196768
SHA1 7f78b74746762fd5007ea3fbce45349bb0ef7901
SHA256 164bbdea64ca671a04b91747191227a89992a34159f1578a2cbf0e16398af1ec
SHA512 920f898d1592ae8d713410ac3fb43e9d490d567f2bb70b8f8d2958a0899fb8bf6a0a735db63a8eb3e1bf2cb02be70354a0f7b92d12584b1ecbde2d5ec19f9a53

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\progress\template.js

MD5 92b145e6649ba0add3dee9a69d3fa91e
SHA1 4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d
SHA256 a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab
SHA512 747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\privacy\privacy-controller.js

MD5 72aac0b210f16da255c03c34aac0085f
SHA1 29c8520309a209185f0e7b864fa240aaf8a0c441
SHA256 bdfa1535aecb73ea1de7c9443c5fcaea621cdd7b7f904e91df9bfff28c7f0939
SHA512 6c549011d3607a26697eaac6761650e9d47e126e2b96c8d563df539f1e9651b62ed7fec6de515dabf889fb354d0830ea4b5598f658788bf97420b7058d88a7a9

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\privacy\template.js

MD5 cf8d2c26520d7c84e560dfa79e31dcd3
SHA1 716f2ec17480d5cc9c145bc147833fbfc39d36f0
SHA256 95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8
SHA512 d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\settings\settings-controller.js

MD5 6c97ca3f9c8186b95dab738f8ad6e2ce
SHA1 f4f8f5d02251338d7d4e29e0f0a90e2e8a77d619
SHA256 5111245d806f02dfa4f4814638eb79ff6a55d6a028c46f2001d55b512e58ad2f
SHA512 e0055727e530f294b0b5878b3f4fb2ff8f63dfce03beb0d25483bc6ebe93c43f4bcd0a9f7ba7e71455d40d0503f0db3bc9d4844656409a11078bdb4b92dbdd0e

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\settings\template.js

MD5 aee08bbe8994d59ce5b0fd4611968394
SHA1 3533ee4e288625aefdf5b2cd2a17494e340fa097
SHA256 91bdc29c6bee6de168cec29912e46d8bfb53a2a7c3d5082e3933eff8db887ecf
SHA512 13462812b482f5bad79260ca1ae9f11db38d32c9ca01204f5b1fb5c512e11b963d070fc2c5ab88d40e0069144d9a96eec86990e4d05b3032085607dca3bc9b51

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\welcome\template.js

MD5 17f54fca6723b983875d940d931e0afb
SHA1 01774cd5cea36bd74c80a708d6f77567e8091024
SHA256 42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb
SHA512 401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\cri\cri-controller.js

MD5 d222c95a2ef0b75ad6c96a3abe20fdc5
SHA1 641c39f92a169f0ca435ed12d2a4d276eb415642
SHA256 aafb56625ec30b24035baafff7bc20215e8ec7e4be4ea58a90aa5b46bdd14a6e
SHA512 e9e66abf6d95fc15a6ffe46cf85c3c9d3b80f3884ca4c8cbb5d2b024fa1dcc46a5e2f39041a4a120a8b8b881d07b3d70b18b552332180aa08c4a67577ea6242b

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\cri\template.js

MD5 76c1ef0cb437db144c2bed53a5a8a5d7
SHA1 aaab8fff649f8e46d1e9510018118ee9abe01498
SHA256 505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e
SHA512 822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\windows\modal\modal-controller.js

MD5 995aa365976d4166ec6de5fe212b0255
SHA1 0d0e8c6aabfc8c967d5af224f66045314c0564b1
SHA256 cff5f7519eb05899df67ae1d79c9318ea344b068d95b565ae8dafacb70a1c52b
SHA512 71a51e34e92e2c478397e70ade9b33e39f4fb9a6da14f04a27997dfd9149978f4d90f0cb6d35e9ede116a2f6ed7f3c6f291383ef84d10994050893c1741f3de6

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\utils\modal-events-delegate.js

MD5 117e4fdbdb0ecf211c8bd909efd337d1
SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\models\notifications.js

MD5 85afdf9897bb1236eff3afa40d15ece6
SHA1 4362bdd139458eaf4a2dcb34294b43e2d53f4a26
SHA256 9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32
SHA512 4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\app\js\utils\cookies.js

MD5 6c60e675f8c8c68c0174b644d3a63a2a
SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

memory/2056-236-0x000001B2B5F90000-0x000001B2B6736000-memory.dmp

memory/2056-237-0x00007FFEB39A0000-0x00007FFEB4461000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\utils.dll

MD5 aad3f2ecc74ddf65e84dcb62cf6a77cd
SHA1 1e153e0f4d7258cae75847dba32d0321864cf089
SHA256 1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8
SHA512 8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

C:\Users\Admin\AppData\Local\Temp\nsd8DCA.tmp\uac.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

C:\Runtimemonitornet\Xr0neB4HusMZHl.bat

MD5 8e3e659843bd305ae3a47604863d7a6f
SHA1 5d54189572d9d7e25459be0f4c65cd5f71fb1245
SHA256 2558798b22ce74da0bbbc3c15cf866117bb995d310dabd9cf2b31cfb5208c3c5
SHA512 52ed9fe42f01618ecf46ce5929e8fc08b1fd2779b8a2a796feab2ce3fc7b211ec41f515fc39abc5554ba3958b61af935153e55f247413167302cf8cffa10602c

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

memory/3920-347-0x0000000000B30000-0x0000000000CA4000-memory.dmp

memory/3920-348-0x00007FFEB3AE0000-0x00007FFEB45A1000-memory.dmp

memory/3920-349-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

memory/3920-350-0x0000000002EB0000-0x0000000002ECC000-memory.dmp

memory/3920-351-0x000000001B870000-0x000000001B8C0000-memory.dmp

memory/3920-352-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

memory/3920-353-0x0000000002EE0000-0x0000000002EF6000-memory.dmp

memory/3920-354-0x0000000002F00000-0x0000000002F0C000-memory.dmp

memory/3920-355-0x0000000002F20000-0x0000000002F2A000-memory.dmp

memory/3920-356-0x0000000002F30000-0x0000000002F3C000-memory.dmp

memory/3920-357-0x000000001B820000-0x000000001B82A000-memory.dmp

memory/3920-358-0x000000001B830000-0x000000001B83E000-memory.dmp

memory/3920-359-0x000000001B840000-0x000000001B848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5ca44bec-42c7-44ce-9fd4-c55d6ba73482.vbs

MD5 6f05aadf11036dd2d65690c31a191b5a
SHA1 6467dc659769df124905d813264b1c701841ab9b
SHA256 7caf9adb31f7f3eb8389b55f7e0f6f2290f08d2ec862dc2f3a663a4af66f55bc
SHA512 ce8fd0a2e5ca165aa02db0679fce097b3ba62591eee47cff88d980b1ea6d963789d327adfbec4c1c1ecf31fde9c7cdfaf7527943c865e3d470be201c7250a63e

C:\Users\Admin\AppData\Local\Temp\9e0036b3-e45e-4e17-91b4-73e0608fe983.vbs

MD5 5fc408768fc56b1d0477a60551e9cc63
SHA1 8b5f2fe7c9d3fa7b7508f61c70f5a0b68856b2e3
SHA256 512bc7fbbf2704d20710788ba7c83fbd1e9b4bfaf25b17b79523188b0f921272
SHA512 cb5568d360ad0d05bf33231436d48bb8b22f9da62f6e726e7bdba4c8bbfaf21868efc5be92a6f95dcbef1bd0388e7c682025c3c20cf641eeeda8d06679a0b57b

memory/3920-370-0x00007FFEB3AE0000-0x00007FFEB45A1000-memory.dmp

C:\Runtimemonitornet\portbrowserdriver.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\portbrowserdriver.exe.log

MD5 3690a1c3b695227a38625dcf27bd6dac
SHA1 c2ed91e98b120681182904fa2c7cd504e5c4b2f5
SHA256 2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73
SHA512 15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

memory/3716-373-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/3716-374-0x000000001BE00000-0x000000001BE10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0218a42a04d3eb77303ac38414d2585ed661cfdb.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\0218a42a04d3eb77303ac38414d2585ed661cfdb.exe

MD5 bf33ffbb2565a4a0b60c09a4271d927d
SHA1 3bf2db7fe39d7942706013138db1ba0062d1f51c
SHA256 ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f
SHA512 f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

C:\Users\Admin\AppData\Local\Temp\cd5c3ba6-abec-40d5-b7b2-ee726adfeb41.vbs

MD5 6f05aadf11036dd2d65690c31a191b5a
SHA1 6467dc659769df124905d813264b1c701841ab9b
SHA256 7caf9adb31f7f3eb8389b55f7e0f6f2290f08d2ec862dc2f3a663a4af66f55bc
SHA512 ce8fd0a2e5ca165aa02db0679fce097b3ba62591eee47cff88d980b1ea6d963789d327adfbec4c1c1ecf31fde9c7cdfaf7527943c865e3d470be201c7250a63e

C:\Users\Admin\AppData\Local\Temp\3460106a-d9af-4c13-b1c7-79c7d2f4ab0b.vbs

MD5 0b3b9e375c12ed617abb44603aee14d1
SHA1 2c0a78b8e4b140bcaed1451492308fa3f8e0132a
SHA256 a85e6fbd5bf5a059eddba2f21824863ab7ec15983631866f0459cd281ef065f4
SHA512 d004af6957bb4580bf88ba6d4107b22b05dde0859b868275a56762100b31a7b2112fe2b2891e6f07987d27224fb0d4ffe5646376314c35726e19df789d758a7d

C:\Users\Admin\AppData\Local\Temp\cd5c3ba6-abec-40d5-b7b2-ee726adfeb41.vbs

MD5 6f05aadf11036dd2d65690c31a191b5a
SHA1 6467dc659769df124905d813264b1c701841ab9b
SHA256 7caf9adb31f7f3eb8389b55f7e0f6f2290f08d2ec862dc2f3a663a4af66f55bc
SHA512 ce8fd0a2e5ca165aa02db0679fce097b3ba62591eee47cff88d980b1ea6d963789d327adfbec4c1c1ecf31fde9c7cdfaf7527943c865e3d470be201c7250a63e

memory/3716-385-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/1948-386-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/1948-387-0x000000001B050000-0x000000001B060000-memory.dmp

memory/1948-395-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/3264-396-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/3264-404-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/3848-406-0x000000001AE80000-0x000000001AE90000-memory.dmp

memory/3848-405-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/3848-414-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/2912-415-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/2912-423-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/2456-424-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/2456-432-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/2428-433-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/2428-441-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/968-442-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/968-450-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/4736-451-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/4736-459-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/4132-460-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/4132-461-0x0000000002C70000-0x0000000002C80000-memory.dmp

memory/4132-469-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/3764-470-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp

memory/3764-478-0x00007FFEB3B40000-0x00007FFEB4601000-memory.dmp