Malware Analysis Report

2025-08-05 16:44

Sample ID 240204-yw247abghl
Target 900a6e944d982527203b917504e4ff4a
SHA256 e3270e04f01141b5f80eabe760f7ecf0145a5a48f8d36d0ed2d49ca409783593
Tags
upx spyware stealer adware discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e3270e04f01141b5f80eabe760f7ecf0145a5a48f8d36d0ed2d49ca409783593

Threat Level: Shows suspicious behavior

The file 900a6e944d982527203b917504e4ff4a was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx spyware stealer adware discovery

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

UPX packed file

ACProtect 1.3x - 1.4x DLL software

Installs/modifies Browser Helper Object

Checks installed software on the system

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Unsigned PE

NSIS installer

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies system certificate store

Suspicious behavior: GetForegroundWindowSpam

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-04 20:09

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231215-en

Max time kernel

141s

Max time network

149s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4992 wrote to memory of 1096 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4992 wrote to memory of 1096 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4992 wrote to memory of 1096 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1096 -ip 1096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231215-en

Max time kernel

93s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mt.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4960 wrote to memory of 3968 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4960 wrote to memory of 3968 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4960 wrote to memory of 3968 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mt.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mt.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231222-en

Max time kernel

125s

Max time network

149s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1060 wrote to memory of 4652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1060 wrote to memory of 4652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1060 wrote to memory of 4652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231222-en

Max time kernel

86s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe

"C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 gstatic.uptodown.net udp
US 104.21.42.141:80 gstatic.uptodown.net tcp
US 8.8.8.8:53 www.uptodown.com udp
GB 104.84.77.178:80 www.uptodown.com tcp
GB 104.84.77.178:443 www.uptodown.com tcp
US 8.8.8.8:53 141.42.21.104.in-addr.arpa udp
US 8.8.8.8:53 178.77.84.104.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsq5593.tmp\LangDLL.dll

MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

C:\Users\Admin\AppData\Local\Temp\nsq5593.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

memory/2496-29-0x0000000003270000-0x0000000003282000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsq5593.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

memory/2496-24-0x0000000003270000-0x0000000003282000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsq5593.tmp\nsRandom.dll

MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

memory/2496-46-0x0000000003270000-0x0000000003282000-memory.dmp

memory/2496-47-0x0000000003270000-0x0000000003282000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231129-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 236

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231222-en

Max time kernel

144s

Max time network

147s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Processes.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 944 wrote to memory of 1568 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 944 wrote to memory of 1568 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 944 wrote to memory of 1568 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Processes.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Processes.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1568 -ip 1568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chrmPref.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chrmPref.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chrmPref.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 224

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231215-en

Max time kernel

135s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe

"C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsqE1D5.tmp\nsisos.dll

MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

C:\Users\Admin\AppData\Local\Temp\nsqE1D5.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

C:\Users\Admin\AppData\Local\Temp\nsqE1D5.tmp\mt.dll

MD5 aac69f856c4540edd4ef7ce6c8571639
SHA1 2860f55ea9774d631219e66604051e90a43258b7
SHA256 6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
SHA512 ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd

C:\Users\Admin\AppData\Local\Temp\nsqE1D5.tmp\Time.dll

MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

C:\Users\Admin\AppData\Local\Temp\nscE488.tmp

MD5 3b00ec69364632b3ee6285867731c508
SHA1 7445e35dc921e53e253f373fddcfea9267379a08
SHA256 585e361e5393e92450c8d4727a24224688f7b45ab9f10f18abb590b2c386af3f
SHA512 22f2bfe100ddd6f0aac0ae04c016f10341b2af05f3f87126283de866a4698f85c677ec687691a782d82aa805b8536866008488161fe40b86c25829f1bbacb081

C:\Users\Admin\AppData\Local\Temp\nsxE4B8.tmp

MD5 65b66b63e83451761e34e2899588e2b2
SHA1 d57a3a64b2b4f2cbf7e90e4a4295d40e6f54c8d0
SHA256 0094b7d196207c602163f3344c47cbbcb0db702bba40465c783321de3e3d6e4e
SHA512 4c4bb74bad8f0b2361e83c0a24c65dc93aaf132ccf565f5c3d44a8bbd1a05b9b02ecc24aac9cdc7e4a180d6577bd09bbc2b0b4e7b0987c4e23a979492be16587

C:\Users\Admin\AppData\Local\Temp\nshE4F7.tmp

MD5 002b3c430e01f8f2231c6b987668459d
SHA1 00cc2d23ff6a840912b0cd6ca93ef503f8a706cc
SHA256 d4d7f1368a2375e1072a71719e9ddf63213e100705ae239a403c92b0b97dfdd2
SHA512 60b465c9293be81990682d6e9b22543d8558c20405e5f8b93577fdd0bd2cea85c175e9e9199dca91a04cdeea954b2fadfa6a97058e875ffbc9abbaa9d01e9e09

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\urxy0c8h.Admin\user.js

MD5 a1a1b03ba8c9672a4b841522f50c60ff
SHA1 78de6ed98e94d1ef1a3f584df5580888750e0395
SHA256 b150944f661a3cefa223235b76ddc413aaea157208896d55d3cfa0ae6ab9aa46
SHA512 ee4cc259e9b002d9471c9033a104169c6a9db0e354da7b0aefacb94c35dc1625c3451d7faf65b5a8999a87e57ea16829c7fd1015def089374f009b05a54e5769

C:\Users\Admin\AppData\Local\Temp\nssE586.tmp

MD5 3713ade89570c6617c133b60be665fdc
SHA1 50a4ab62d04293c270551b71dfc590bbefa4804d
SHA256 850d433577dd156c2802560938fbe1eb89b2109f353641a44d6ccd702e1232f8
SHA512 9e4e47d81842967b58d99ca8c98b8046b8c8895b27ff5f3dcb184d818c00358068cf3ffaaf0a3997237c05c68ef94e725e7164ccf583ba010682c8973596fcf2

C:\Users\Admin\AppData\Local\Temp\nscE613.tmp

MD5 2c46f5193eef5ef3ddd2c39efe531f92
SHA1 a207dc890f9150866f9a639ab5df3339fa826031
SHA256 ab4030f2ed1f88e1b3c3159109d3e96c860c677634c689ed9453c11bd9cb7964
SHA512 695f380dcfd18733e03a72be8d22bbc64804c6658aba17729f4feaf60b0923d8bb4b8d7031bdd642e2f9f51f18d6e66248d5e7dc5b99d6f736f319685e7a2373

C:\Users\Admin\AppData\Local\Temp\nsnE653.tmp

MD5 07d2a0f7586b8f7127e50080a5993c80
SHA1 6f1770aaa3c855325b2a31a0a90e99bacff5bf42
SHA256 2a5a10b09408b96c58e26f1fac1eb2b93408a9cc07104ae123553bad392c8dff
SHA512 567808a6352ab4bda27f9d47bad9f0e13e3cbd812497a7897f30cfcb77b0134e739e20e9ca37a1a0fb8f3e1b888f54a3ddd7c71c96376978febdcc0e8651915c

C:\Users\Admin\AppData\Local\Temp\nsiE6D2.tmp

MD5 6323fb1c8943d27cb16146cd9f3b0222
SHA1 b076e2999156ecdcb5f39f5d57058876d5c4158e
SHA256 c0938c1397a43469492a858fbaaca2713ff23a265b395d784ff289b5060d1df2
SHA512 4f33cfd3b4d5b6582f313180204fef8c7aac617be6ee845d9dcdc2acdb067825047bb43a068a5476a4ad463f802d871a338f22a27d00b61210ea69ef1ebcda20

C:\Users\Admin\AppData\Local\Temp\nsdE702.tmp

MD5 bfbac1f7338d16e5a84d2b95aefd230e
SHA1 55da54e4e01890be7e9c6b8c96d071e5f7086029
SHA256 678f7b961ba2b8a3bad60e3b0ddcb6365785b5faa75a8f76dd22ab1cdbc2c186
SHA512 874466ebbc03bb33d9b63ef2afe78ed8ec06bd1e4717552c09bb6f1b65a2841fc7b8164d055cdcba6f4ec5cda071242789300f0c804dff5cabf1541783b31202

C:\Users\Admin\AppData\Local\Temp\nstE761.tmp

MD5 c026206b7720da67b708afb8dba35297
SHA1 d714c75f853dbd7ed354a5c99a9bf614219e8ed7
SHA256 31f3bbfd0ede40a97561d5a8f23fbc11c81ddc30da27d6d3cccd51efeb2b19bb
SHA512 5a876a588f9423c8a77151239f15a6ae98f1b3e3940a4fbdebdc22359428b4cbfd1e91ee4daac9f9fc3e73ee29edb6a03e74e42483b903c9d59f4030a07dd5cf

C:\Users\Admin\AppData\Local\Temp\nsdE7A0.tmp

MD5 e9aefb9c1dd4c64b406bd25f8f22123a
SHA1 027c0e407a6438bd03f6736da5cdcdabbe9879a7
SHA256 9ebc7cf2802c38745826387880b446d19c923df07b088aad78ae2f1ab1afaefb
SHA512 90ac9b7bdc5f691f4d32db37e56a4f51ebb88af309890e4d3878a0f0f3e351eaa832db548631e380b115e91a77153631beda3fa29680a39933945977cc050370

C:\Users\Admin\AppData\Local\Temp\nsoE919.tmp

MD5 5862516fa7ade335b492bec88166dcf0
SHA1 eda8724856d94de4434b9d6d1fa1cc93079ae282
SHA256 7bfecc5b797816e6a86500bafba8005cace8f50a76c8821a7535b96013099a9c
SHA512 6999f41ca50fca448c2b48f62bf016effa2b667dce3da6d14770230ca06f20d69468f625d40bd99cc75427d7476d92a683800127515530b402477e4b47ba0627

C:\Users\Admin\AppData\Local\Temp\nsoE91A.tmp

MD5 a7f1418f154c02a6c5e9e02fd9f42e43
SHA1 64ec79a39de54d70318bf66e3150f83a7e60d4a8
SHA256 deeb972b9058d244d09375236617356025a572389dd7974a0aa01199dc5b5b3e
SHA512 d32c96c42d820dc09d8e3642c05abf82f9ff4adb776420793650b429d2ab52586a51625062d2f32e1204a045a19108307fc30083bbbe49988c6e0d33d43b5996

C:\Users\Admin\AppData\Local\Temp\nstE93A.tmp

MD5 d2732df2e279609a1e25073887ebfa70
SHA1 fdc35dea6107cdaff711fb5e32d64479f4cd1170
SHA256 d37e75ee71061cd7f9f32387b7877da305af24e387340ed4e98d583b67739870
SHA512 f6e01a029b724d2baa60c37a3a9311ab6aab71c4f21ed755655fb2548c4ac9896c6275b1b19432fcf4e18580748248e3fb7a83ca1fa553e59fe9e13125c0817a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\user.js

MD5 c1e7403d8838f507d7939517fdf4a356
SHA1 074292b0c4e6a3749e3a4a671f47a4400f6647b5
SHA256 d1546aa018ba376b0452945d10b545378cc79cfca159e7be62b3c9d6b3616144
SHA512 9db12a414a7c821da464a89e6c00ff2f2970ebeb26f3fd9bc228823a16a0a9a677256b551558f06a294f215b614fc283f1736086862ced3f831395aa030db477

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\user.js

MD5 40858b6a908fb4c9958797bbf89206e3
SHA1 4fb64657828dc054893cfcdd5e9d9aef8109cb79
SHA256 12bb68115c8f82ed2fda1d2cc14ded972b2a62fc328a75ebb3f6292b30dccc58
SHA512 62ad9c76296a46f6817cd51efe58f4c71606559c1b51724836efee07159478a54aa0370ff846b63209dd7e722680d6f29859b9453eacbf772f85fb6b6876f999

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\user.js

MD5 d33a0a453d37d67387c82de2d4eea72a
SHA1 ac02a4a0781266141b5bba51bba3043f9ad1e742
SHA256 1ecff6334ce3dcd92c244aa16423e4e186182bb8fae0fe7f7d872a93648cb369
SHA512 685ab3bf3a50b7b3a624562b1a9a3d28cb63666b6c86291b9bf74902aff9a1fc782e8f0d2ee6602e3f159a1494269c58190fcdebfbe6da3e9960ed54a220d1e4

C:\Users\Admin\AppData\Local\Temp\nsuE9DD.tmp

MD5 731ccfbea378a107c153802688fd1deb
SHA1 046fe26082b9215a13991c65271f62a04abae461
SHA256 088434099d1c3adb89166f9c003f581c75cebab54275ee27391cc18f205f5f51
SHA512 14bcd34bedf53ea4392bf82bb0ae5d1a125eb05320788a310347d2e8f4f165ea3980895ac8ea7777b47290d30fcbe45a6829eb416b55c5f0960f33a0f67fdaba

C:\Users\Admin\AppData\Local\Temp\nsoEA0C.tmp

MD5 74ffbad749ea748b92285187eefbc2f7
SHA1 7c4ef4f56dd45eb45e1efa8bb6b35cac33975eb5
SHA256 15317e83cc20048de9d524ca745ed4ccf5d146e84cd71cafcada2e9c47aa59a1
SHA512 1fc80850baf5b0de35595f3b26a89a23958da5207270927e8bd9fc7ebbe6f4ebdbf32a9c14e8cabbc306a5125dea58869d7c33e627183c092a247f52318f3bfd

C:\Users\Admin\AppData\Local\Temp\nspEA5D.tmp

MD5 d0290fde5c30bebebd49a9d6d57e51a6
SHA1 abc8344eb1ac6aadcdd738d1f5b91412e224f8ea
SHA256 bc892e247e62a5521658859aa33c4da536a467d0089af5374727922ac6dd3e97
SHA512 b2d021a3c8b3743faf4a37b9503f95ba27aeeb5b7437069c838176b007f22f41a3a58b63505f608a1fd27b20da6f76c021eb62fffab33d529afbb47a90ea5c5a

Analysis: behavioral11

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

118s

Max time network

120s

Command Line

C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 224

Signatures

Processes

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 224

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231129-en

Max time kernel

119s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd155090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe

"C:\Users\Admin\AppData\Local\Temp\900a6e944d982527203b917504e4ff4a.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.uptodown.net udp
US 104.21.42.141:80 gstatic.uptodown.net tcp
US 8.8.8.8:53 www.uptodown.com udp
GB 104.84.77.178:80 www.uptodown.com tcp
GB 104.84.77.178:443 www.uptodown.com tcp
US 8.8.8.8:53 www.microsoft.com udp

Files

\Users\Admin\AppData\Local\Temp\nsoC61.tmp\LangDLL.dll

MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

\Users\Admin\AppData\Local\Temp\nsoC61.tmp\nsRandom.dll

MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

memory/2660-20-0x0000000002A40000-0x0000000002A52000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsoC61.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

\Users\Admin\AppData\Local\Temp\nsoC61.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

memory/2660-68-0x0000000002A40000-0x0000000002A52000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231215-en

Max time kernel

148s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2464 wrote to memory of 2496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2464 wrote to memory of 2496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2464 wrote to memory of 2496 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2496 -ip 2496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:12

Platform

win10v2004-20231215-en

Max time kernel

138s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Time.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4540 wrote to memory of 1436 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4540 wrote to memory of 1436 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4540 wrote to memory of 1436 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Time.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Time.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1436 -ip 1436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 3.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231222-en

Max time kernel

93s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1416 wrote to memory of 1008 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1416 wrote to memory of 1008 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1416 wrote to memory of 1008 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1008 -ip 1008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 17.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 28.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

118s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ = "Funmoods Helper Object" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\NoExplorer = "1" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\uninstall.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\bh\funmoods.dll C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} = "Funmoods Toolbar" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\AppName = "funmoodssrv.exe" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\AppPath = "C:\\Program Files (x86)\\Funmoods\\funmoods\\1.5.11.16" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\ C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ = "Ixtrnlmain" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ = "IesrvXtrnl" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.dskBnd\CLSID\ = "{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\VersionIndependentProgID\ = "funmoods.dskBnd" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\ProgID\ = "funmoodsApp.appCore.1" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0\win32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\escortEng.DLL C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr\CLSID\ = "{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\TypeLib\ = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\f\CurVer C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr\ = "CescrtHlpr Object" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoodsApp.appCore.1\CLSID\ = "{A9DB719C-7156-415E-B49D-BAD039DE4F13}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\ = "IRegmapDisp" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\escortEng.DLL\AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ = "IesrvXtrnl" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr\CurVer C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\f C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data\afltId = "orgnl" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data\vrsnTs = "1.5.11.1620:09:14" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\escortApp.DLL C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Funmoods\\funmoods\\1.5.11.16" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ = "IxpEmphszr" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.dskBnd C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.dskBnd\CurVer\ = "funmoods.dskBnd.1" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.funmoodsESrvc.1\CLSID C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoodsApp.appCore.1\ = "appCore Object" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr.1\CLSID\ = "{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\HELPDIR C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoodsApp.appCore\ = "appCore Object" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\ = "IIEWndFct" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\Programmable C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3044 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
PID 3044 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
PID 3044 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
PID 3044 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
PID 3044 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
PID 3044 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
PID 3044 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
PID 3044 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
PID 1968 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
PID 1968 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
PID 1968 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
PID 1968 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe

"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe"

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe

"C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe"

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe

C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe

"C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe" /RegServer

Network

Country Destination Domain Proto
US 8.8.8.8:53 fmcdn1.funmoods.com udp
US 8.8.8.8:53 reports.montiera.com udp
US 69.16.230.228:80 reports.montiera.com tcp
US 8.8.8.8:53 r.funmoods.com udp

Files

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\UserInfo.dll

MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\nsisos.dll

MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\mt.dll

MD5 aac69f856c4540edd4ef7ce6c8571639
SHA1 2860f55ea9774d631219e66604051e90a43258b7
SHA256 6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
SHA512 ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\Time.dll

MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\Processes.dll

MD5 cc0bd4f5a79107633084471dbd4af796
SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3

memory/3044-79-0x0000000001C40000-0x0000000001C52000-memory.dmp

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\InetLoad.dll

MD5 994669c5737b25c26642c94180e92fa2
SHA1 d8a1836914a446b0e06881ce1be8631554adafde
SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\ExtractDLLEx.dll

MD5 ba4063f437abb349aa9120e9c320c467
SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a

\Users\Admin\AppData\Local\Temp\nso94E1.tmp\chrmPref.dll

MD5 6845d147b88de1f005d9c6ebb6596574
SHA1 64523302e2b1e2ee7a31580d2acac852db3c7e45
SHA256 c9ccc486c3353bad0d2819a42203c0db7ba98b4826b6a2b8d4deee832e4d3d8e
SHA512 cd4caa6669b5f90ead60579a2e5b01a9cd2d17fd2919651cecda6327acb32e2eb3b9953412c085d50dee89779d2f60df658236fb4c3cc54bed4ae66929590606

\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe

MD5 ddcada8c66d56df6e4ef2bbedf2bb865
SHA1 059a7f8bb8ed2e99d5153d26ecf986e91c24df19
SHA256 abcde03656f4c6f51d4d4c788ece555581b8c7b52bfe1c18ef70678cb3a2e872
SHA512 63a3ca5d733cef71cc4ff61d6b5b3dd74613d57bac2b5d41efffbbf64ab6031bde66c0cd7058bf50c047e64e4ee0ef87dff3c7864a18c118521f5711ab69cc91

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe

MD5 fe768a6b82ed2a59c58254eae67b8cf9
SHA1 3dad9bf5011fb73b9be2fe6c601bb6281a3ceaf6
SHA256 3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570
SHA512 3d8caadc61ea127bd0e3d01f35274a2ebfa34a0ac12b0932988300d011347f74a09c2bf3c85e58bfbe5200288c6e6f100b4f08916d23e56d7b52a70130aad14b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.Admin\user.js

MD5 2bbed7c9521174d68eb82751901184d3
SHA1 5adc5a58175f2cf899695e3c162b31f1dfa04524
SHA256 0eebe6ecb1c7f74a5175dd6aef7ea4a605741a54104f26b08f29ed0b763ae7db
SHA512 0feec3cc87c72b66b5dd53ee42e812b4a392ce7a26c47d31a06554e777271c7075bb4870a1435fde647a4fa7c1418d1eef8f7bbaf2d133fb43a2b7a7631bf471

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.Admin\user.js

MD5 932c6f52cea9c3e199ea1751f6cbc37d
SHA1 71444fcc1f4afb3e5fa5b8e9f68ddeef82e01447
SHA256 3fda0ddaf979b3de6563ba9a38f8f4afaa9bce920ac609a4af2db35349d1b629
SHA512 8a7566c383d004e97ff88603e8afcd0eee2f1d3dadbaf37a68ed58ad150133df37b2a9c9c7898aad024ad2cc87ea1b0d75d747747f064887c78f400ef560e387

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.Admin\user.js

MD5 d1f4c32ccc6c644b5f490c03103c3efa
SHA1 14638126e768c3da80babb0541e0abaa49bc9b78
SHA256 c5461dd1d139709cf13e8ac07508f8691361dbf33bc868b037aea22d6be070f1
SHA512 0335f21d4444761525ea19e6650fc69c07c1430e7b1c76b389b5afafd587bff9f086072f57b20b25758565baf6de1661ce06a15d80e623be670f8c7dd88aeae1

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsd9D33.tmp

MD5 14a1b9d98baa44194f60f2b1b2a97c01
SHA1 a1a10f492b7fadc4e1bc3edf5ffa9394d63d07d7
SHA256 39fc0de7a02a9e8b47607141e6efb5757ae8febb34b362c93f9cb545031f9a69
SHA512 05d8d1c93406e8b94f035dcc10d02055be764da2fa477fb25e23d6cd62f261c4e6fb213129f05e3d8e7b77acffb4db5051694dddecaabed2db72d490fea18699

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.Admin\user.js

MD5 219653f2147ad3f1c8b32a84675474c7
SHA1 c7615a673d266b472a32beb198838cfbb95ef2b4
SHA256 74636a83b50812b1167917c4c1d7853fe0453c2111bc44cb950cf86fa7700868
SHA512 6ea50449e8ef1cb1f82f7ea25f870332aeb29fb272a015e3b319ceee64724117be20ea80dd3116ce2652fa200970e9aed3c6f9b23a80646c3057458e373a8d43

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nso9DC1.tmp

MD5 42699c520396bf135ce46ff24785a472
SHA1 787352fd479d37c0d409eeedcecf2611b03fb58f
SHA256 7190175daf417f5f519443feedb6d7f6f4a6f9d52e205e2f9e51fd7fa3ac7113
SHA512 336389ab2349b257e1400e253f4dab36c31662a26ac1dff136916593f999b7c21a29a32a40dff051cea012235eeda605f677231775371c89eb83f9037bb09492

C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\uninstall.exe

MD5 673e6109fbc2405238429562ae058f37
SHA1 293a96724fc0e772706f108895db321b58051524
SHA256 4dae85611b9fd18f44c36f330762ca7dae3842604999d6a5edd3d416b4ab0841
SHA512 0d1db02c84d2a7502af966886889a63467fdc310c25076cd1629064f9dc5bda63248ea2cb34757f9e93e341cd89833979c8bdfffab2d09c722c3a20cd244f4c0

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nso9F4B.tmp

MD5 432ffa64b519add5cebf722958be62c9
SHA1 655909cd7fdeeb81efb51de2e0e613da9eae83a2
SHA256 4ef8097e7215c3144b1d9eb2e9fda27c6f53c304c43a2bda59f956cbe8241365
SHA512 b6382f24f335c27205d5981b06fa67c4d951aba061d1e6b98f527888521cb0b5e0a0291395231fec177224c5af6d6d249c75dccbe8cdda90b835ca30fafaa84e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\user.js

MD5 1e0e1714641ec776e8399fe47f9926a8
SHA1 f100b3147f3115920447cca8c00305b5c502baba
SHA256 37008bee4f413c3711fce51a31e7dcff05bca6467d89497dee68c1f3250e7e75
SHA512 16b1b1710397f528c0de315f9e69cf69705b558508ed242d26640a68ebe933b567a6aa6758c1985193ca9dfdd5fd52b9fa6a0d824b89e1988ddf4ef68290d95e

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nstA00D.tmp

MD5 c445c75772101e88c912c42d77f39510
SHA1 c71b1b06f984904fe0560480635098185073e4b0
SHA256 acea6055aae0ce476b97e2668fc90df179fb95cd869af7855236497bce7dc06f
SHA512 e493aaeb911acfd780277c5dca0a1ea11d256ee56f0d77d432f043b9dd524fe50bda856a4044090e4c8263ae8d9df6fdbdc0d8d8966ce16f494f89357ad8e18c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\user.js

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsjA0BD.tmp

MD5 1cb47dbe7c8f97a07c7d370dc8680138
SHA1 456bcbf3c9c26cf80cb55e4a5380de6eb79115d6
SHA256 970d3162f6c3762100bf16f2ab3544b3ac8f27049c7ef01b26aff1bd0d1a708a
SHA512 aadfbb074e6a5afc7e2f55d34bfcd30c699ab5401e03e24dda03d3606a50fa9e819657c0d869e7e7ec97f229ae33206a8354586771a0cf37fe1a93e0c3546245

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsdA0EC.tmp

MD5 035a53f846402e01b53491829de43fe1
SHA1 a1056866e59777b954acdf4c30b7640211809141
SHA256 990f571b6dcd33941c95b5d9d47d0385f028f8c5e75c20e9cc085e25aed33b9f
SHA512 a95aa9ea5f7affc36338cae31cd9195ac421744adc011d341eb8a3c6a29474e3450ffdbb12af7513132eee5f990a3140870ccde47e682a59a165c0d1e656cd3f

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsoA12C.tmp

MD5 0e725fabd8d0e1de18a6c1d265ed3cdb
SHA1 28c28efc55f3212ad39f2c237cb4b0fe2bb2a2ad
SHA256 95193bd46a3d376f71e0b746180a16f45b674cec4522e72940a4a3bf822425f4
SHA512 d64d73af852f5d372d004dfb5bc57a5c0157c66d4c19b4e063e3cdbee67e203adfef366d1d6158b05f852d669077f3c92d63cc9b0650cacbbda7c70878e21ab6

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nstA19A.tmp

MD5 73c591734b6b94b95e732a462c5d9cfb
SHA1 a9880f728b4613dbe443ad8e02d266e309a8f5c4
SHA256 e2bc63b9b507b1f2cbdecdaf33039bfce5604ecdf27f39a2a1a13936687527a6
SHA512 535a2d86fa6f89ba418321bb9912bd5edebac29d80b28c51a21ffbd893068a7904c8ec740fd23c5b079d6fb207e2ac93b44b687f27520b508be82acb0f895c11

memory/3044-1584-0x0000000002380000-0x0000000002392000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nso94E1.tmp\NSISdl.dll

MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Analysis: behavioral12

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231222-en

Max time kernel

93s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 432 wrote to memory of 2584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 432 wrote to memory of 2584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 432 wrote to memory of 2584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2584 -ip 2584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 632

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 19.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231222-en

Max time kernel

92s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chrmPref.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 3652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1988 wrote to memory of 3652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1988 wrote to memory of 3652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chrmPref.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chrmPref.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3652 -ip 3652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 604

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231129-en

Max time kernel

118s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mt.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mt.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mt.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231215-en

Max time kernel

135s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ = "Funmoods Helper Object" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\NoExplorer = "1" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\uninstall.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\bh\funmoods.dll C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\Policy = "3" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\AppName = "funmoodssrv.exe" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\AppPath = "C:\\Program Files (x86)\\Funmoods\\funmoods\\1.5.11.16" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar\ C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} = "Funmoods Toolbar" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\Programmable C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr\CLSID C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\ = "funmoodsCmn 1.0 Type Library" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ = "IEvntCntr" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\InprocServer32\ThreadingModel = "apartment" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoodsApp.appCore\CLSID C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\TypeLib C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoodsApp.appCore.1\CLSID\ = "{A9DB719C-7156-415E-B49D-BAD039DE4F13}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data\hrdId = "949b232500000000000072ac86130fb1" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\LocalServer32\ThreadingModel = "apartment" C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr.1\CLSID C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\InprocServer32\ = "C:\\Program Files (x86)\\Funmoods\\funmoods\\1.5.11.16\\funmoodsApp.dll" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\ = "escortIEPane Object" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ = "IappCore" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\TypeLib\ = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\Programmable C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.funmoodsESrvc.1\ = "escrtSrvc Object" C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\InprocServer32\ThreadingModel = "apartment" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\ = "escrtAx Object" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\InprocServer32\ThreadingModel = "apartment" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\FLAGS C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\0\win32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\FLAGS C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ = "Ixtrnlmain" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0\win32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Funmoods\\funmoods\\1.5.11.16" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\ = "IwebAtrbts" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\VersionIndependentProgID\ = "f" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\0 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\ = "escortApp 1.0 Type Library" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoodsApp.appCore.1 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\TypeLib\ = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\Programmable C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\TypeLib C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9} C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3820 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
PID 3820 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
PID 3820 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
PID 3820 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
PID 3820 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
PID 3820 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
PID 4936 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
PID 4936 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
PID 4936 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe

"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe"

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe

"C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe"

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe

C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe

"C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe" /RegServer

Network

Country Destination Domain Proto
US 8.8.8.8:53 fmcdn1.funmoods.com udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 reports.montiera.com udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 69.16.230.228:80 reports.montiera.com tcp
US 8.8.8.8:53 fmcdn1.funmoods.com udp
US 8.8.8.8:53 r.funmoods.com udp
US 8.8.8.8:53 228.230.16.69.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 28.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\UserInfo.dll

MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\nsisos.dll

MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\mt.dll

MD5 aac69f856c4540edd4ef7ce6c8571639
SHA1 2860f55ea9774d631219e66604051e90a43258b7
SHA256 6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
SHA512 ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\Time.dll

MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\Processes.dll

MD5 cc0bd4f5a79107633084471dbd4af796
SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3

memory/3820-84-0x0000000002320000-0x0000000002332000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\InetLoad.dll

MD5 994669c5737b25c26642c94180e92fa2
SHA1 d8a1836914a446b0e06881ce1be8631554adafde
SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\ExtractDLLEx.dll

MD5 ba4063f437abb349aa9120e9c320c467
SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\chrmPref.dll

MD5 6845d147b88de1f005d9c6ebb6596574
SHA1 64523302e2b1e2ee7a31580d2acac852db3c7e45
SHA256 c9ccc486c3353bad0d2819a42203c0db7ba98b4826b6a2b8d4deee832e4d3d8e
SHA512 cd4caa6669b5f90ead60579a2e5b01a9cd2d17fd2919651cecda6327acb32e2eb3b9953412c085d50dee89779d2f60df658236fb4c3cc54bed4ae66929590606

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe

MD5 ddcada8c66d56df6e4ef2bbedf2bb865
SHA1 059a7f8bb8ed2e99d5153d26ecf986e91c24df19
SHA256 abcde03656f4c6f51d4d4c788ece555581b8c7b52bfe1c18ef70678cb3a2e872
SHA512 63a3ca5d733cef71cc4ff61d6b5b3dd74613d57bac2b5d41efffbbf64ab6031bde66c0cd7058bf50c047e64e4ee0ef87dff3c7864a18c118521f5711ab69cc91

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe

MD5 fe768a6b82ed2a59c58254eae67b8cf9
SHA1 3dad9bf5011fb73b9be2fe6c601bb6281a3ceaf6
SHA256 3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570
SHA512 3d8caadc61ea127bd0e3d01f35274a2ebfa34a0ac12b0932988300d011347f74a09c2bf3c85e58bfbe5200288c6e6f100b4f08916d23e56d7b52a70130aad14b

C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll

MD5 7f8be790b6614f46adeafd59761abbeb
SHA1 a1be7d513d40b1a0af1aa1fd73c2c2b6173ac700
SHA256 b1fa4dacf9656e31588eebeca1f831c72a33d9affca07ede0d5f5d113ec14aaf
SHA512 4d17c74368543092a8e7604208689bc6a5fc5bcc46c60cfb9255622d031a4265adaa13d7c0b5f410ababed802f29cb89c2dd7d7b1adc1af33fbb5f55e4a8a5ca

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\urxy0c8h.Admin\user.js

MD5 0d7889a328bf4c6b506dd87507ae693e
SHA1 21928a20080bb3bdef6457f0ffa1def8f35a14a0
SHA256 1164c9ded36dbae9752329f8833729cb6b9ee0177abb8d00d1efeede0baf8ff4
SHA512 2342d33faee44e84698e543d85798cd724123d7291e46d7df5f2bbf497353b2d8b7f8dabab515602177d4ff7892c19f1ebae099698e1dd046bb1da90b8b60dce

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\urxy0c8h.Admin\user.js

MD5 0366c8f147ad25488eca0fad6e224e5d
SHA1 b19b1c58fdcb8a2aaa3574c15305cf03f7fefd1e
SHA256 6d4182e4afb4570d3cc5b29df4ada8fc8f3c9ef11eb0ef0782ae8c81dc3e28b0
SHA512 4438bfe4a74468a672b1f9670fddf2765328a89f149637f8425cb9be15c72143cb467fd19114393b2f21f31e04a7fd47bd921200d7e7f0a31983f6b21e6b6c5f

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsaED44.tmp

MD5 22e8d4d960e1c3a9524ab5bed0c0acf7
SHA1 917278127b7b7fa5df0f8b464c7e87092825e936
SHA256 74d0f2b2493cbc2efaeb492f599be076919cd65c4567eabbd744770ed5d83a04
SHA512 35db8466020da74baddce8baf5c045ecc56da706757ef8d4fbd1c3d7ab2e21e52bd01993c42a67bb6abfa0d9668b946ac0e4f6d06010ed1c6a7c8d234e5832af

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsvED74.tmp

MD5 3e8545d99f0647ef6f1789e54d3be675
SHA1 58bda2972ef52650a3109dd506e3e82f3ae9992e
SHA256 af13b8c5d302dbbf68f9ad618ebff1eae1e3a79b58865b9df2532cf5a22f25b8
SHA512 1b1d0ee9fa38b4547b64ab813ff23cbfe04970547fdf657430c83e9fcb22e76c4692d21adb84ecd363737db0626b6fa594ad728b6f65c42728186c22bf0eb1df

C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll

MD5 12be59f427297e54fef41f9bb32d4233
SHA1 0088967a4ed52f491976136c95d43e0e1b06cc31
SHA256 e4b3df5ead761fe83da367d5e2ae1d416d0f89a572480deecc20c4b4295f17eb
SHA512 0f8f3826e8a9205771863c042a8386315784927e260ca8617c44f83b5f3f3a501500d6d39ae732da11c0621dbd6c8c6d75ac7af660a46bb70acac9c12991d2db

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsvEDC3.tmp

MD5 e23d232ebe5451e87cca88f2d2584fc1
SHA1 14430f5cb9aa97bb22e19d28e034988011cdb50f
SHA256 774ba7f7049c4d150f227f0db49fdae93f952b33d80b25b4ac6b17620262d0e9
SHA512 47252311aa3de3692056208ecd32c3c3832afa5102a7204fc2b1d6769fe8ef241bb83dcb1f943cbfa9aee03708b0c4b4fe8290f2b80ee11373896356c1d45539

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsqEDF3.tmp

MD5 288f6fa060b4d064a08ba6fd6e14ef29
SHA1 f18e2085db5382cab97ede1738afc0a60fe9d27a
SHA256 aad346cb69884d9065f2775fb89abe36a69d821079dbe5af8a1cae26c273491e
SHA512 ab795bb0cb98b8d4fc149a1d002dcf9f7ff837be5195376562825e7bee31a09c928f3b29fdc346fcd8543167a04ea3ba51534580efaa7405df81d63be8c398f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\urxy0c8h.Admin\user.js

MD5 2c4b198c7bd76eb9356603732da7a525
SHA1 f4947481f5f217d5367274e74ed2760ad52e0383
SHA256 033c09aa04e90217198553738096f822447f10ec3bdabc1fe595320d58e86377
SHA512 3d71829cea3edae316fd7588ac3b1049fa67da64162eba09fde5f46d555e1bca6aaea39cbdb40cf174303ab9f15356b8645963d1dd0a689e27b9bc1fc2f1a365

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nslEE72.tmp

MD5 debb6dfb017805cc2a3ea3167097297f
SHA1 49a9af7dc99c500e33a99da67b3188328e2da8fb
SHA256 dd8f1b2a6dc392d31bd71b6e34ea507c7199e60002b68e84dfaa43c8af8104b6
SHA512 e0bf9ccb0c4aa6e70d9a802d8e9fcf2ee5134beab4e0147d25d9f47bd12230507e291b18459d40f8a043bf807beada9c17e3d99b24d8602480454c6ea384cade

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsbEED1.tmp

MD5 867bfaff6228a0e784a8ff2f6c4501dd
SHA1 754a8681fcae66d103afd6ae440fe71b0a626db7
SHA256 fa43b0b03405dd9ed1f754f011d93b6569a408f5daa0c5da8b5a4ef5aa7bdf64
SHA512 d55a89f41d9ced0861f4d92ccd2fa953ca1e015dd5042e48d8e81e708136ac3d512bd96c78e9e62cafd957873454f7c54509d573c0fbcd3109c826f5bdf9ad57

C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll

MD5 d5e0f923b3ee640efd6a58ec0c70cbdc
SHA1 74f62a9acdb9f9dd0580d69450c062ba8870deea
SHA256 3d1b55bbb46e5788ca3e8ce68e515f52bdf63c0f53ceaad7236964eedf97f281
SHA512 471eca5adb43ba82cfed4fdb395471414301e3eeb602ba4fa6cccb9721869847a06bd8096d7eb15cbdcab908d6dfc47d48d293e1f77b881271f6d7dd4f54f3f0

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsbEF20.tmp

MD5 a478fa2a48ad769a630f530ad0180ce9
SHA1 d2341e903d85415a89aaa6889097cc719e80fdfe
SHA256 31e867ba2b1bf08abde5f1a9955a15bdd17b95ab6d89fcb277a2216102d0bdd9
SHA512 e6ea4fa30df681b1257d9f2e1808345bb4b6bdd9fe46889c080ea9287f8b4cf08771648381dbc95e134f3e0cc41ef535217b4861e224fb429d7177c7d3c9fdd6

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nslEF5F.tmp

MD5 8e4a8ae8d1685ef8432164f44de085a0
SHA1 67ca6e555ec2db110e58fa299018c9c0282eb03b
SHA256 1a8a4efdb3453f3c411e8e7a44a0019281189dc6633bf2a38c17bc3d32881b04
SHA512 e6c4ff9c934b55d2a0e38e1ee1c9c44dc760b1010a9e458f2e2050efd15339d27f0032d07dfffe5b5d7c459f9f1ebe14a0aa14619ee0ae87d299a2817e668b53

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nswEF9F.tmp

MD5 f2d5ce5512f47b4068eec50b5f5ff306
SHA1 19520cf5e1f28ad095e1e5744cfdf8148a9aed3a
SHA256 2e2941450839237a903f69783596be896046707cad29750912a9acc7cbe1248c
SHA512 4b3dc45d1d02ed47177c331d2bc6dc6e7e1f795020886c7dc6a4afb5244fc0b23f0b7c28394bffaa256ca6b3cc2142f69f7591c2100eabf8c73ac7bfcb3563bc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\user.js

MD5 e5caa0ea752d61f8e44b019661646caf
SHA1 919f1666d8b48d56a4ae465199ec7d620856821c
SHA256 8f819412d78725a161add5d8288fe0dc8aa6f0d39ba2069939c849923669f2b8
SHA512 e23313dc32c74a4dfdaa1c222754eff994ab880134626b053fef542ba793ced9829e548686a4c3dda3ab6dd3310fd2ec1df0e9dba09274e0e8202319227f26fc

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nscF0FD.tmp

MD5 9b4a5195c87278076102b192dce1335c
SHA1 396f92135a8f8ce3ceae53330be49d51b05cff5f
SHA256 21f5283d3c29d3ba097a002ade521b35acc8abd9c67dce067420fb0ad0b57356
SHA512 9e15e06844333f22887493ea11411fe18d732b463bdfbb47467114586e177802a5c2ae70b02460650f3788fb2206fb4769eedb042f8af03c46ac1747de79e794

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsrF10D.tmp

MD5 cdb8503e0461e0b4c41597f6bee9d3a5
SHA1 626a986c953139d0da7951c66b8a3f7f1ac509c5
SHA256 c9619e7fdf67f6744dfc720b35269b930e29bbcfd579eb6add514b79f27b75a6
SHA512 7698e4f98a182338259376c504f531dc0ecd92ff11894ca9625815a5944d2aa1887da966ef09d308b0fc0215e877abf4be82f6c1bafe47d242aa745fb31805b0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\user.js

MD5 ea166eba73d65f219f718211b1265a98
SHA1 a7856cc9964bf39422840536806ed875e375e71f
SHA256 ab6d6f655be2e0706bf289470a1ef9a45ddb5dfc6954219a271f529046b84a6a
SHA512 bb1c82b706ead2a3e58f8673e159d10b57fecbbf5b2cc97b938a340d0e8417210ee79f9c527c6cb414dbeed41d14fed3a4e52b23bac8d6eea3dc7b320b351cfa

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsrF15E.tmp

MD5 9e53031cc200596ef493325c9ec2ed75
SHA1 b2de84058d807658c6428e6d4f392ae6a2d359fa
SHA256 3c404c2a7ad233ac63c56ca678bb02ff0cae5ff9f11801c5101bd245debb9236
SHA512 fb282d8e751dec7a532190774f2e2cdc08bb90876998ee20bc80b3bca4b2727f2053ce87e7ffc46c1a3e9b55b3ca8d74ce150e7c08d69a20dc54b8517b652169

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsxF17F.tmp

MD5 721e63ac6f5e51a7582a89a7a62333c7
SHA1 5f3796dcd347c85f7113d63c158b2a6452654965
SHA256 793444ddf933d192904c82e18d5e910256d4a6fb4008416e7a92ca5b77abe875
SHA512 1fce75fcca3b1dee440e4f946a51d1f0871c5bf1c43b8c923ada25187b0f919815062e3a000ff9083870e335c53b980e387dc28cd93a43031a242b318138c0ee

C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsmF1DF.tmp

MD5 407ef79b85332da7f36c7dd73f5c4b2f
SHA1 bc9ff9b12e68207adaaecbe033170698e47f4853
SHA256 666a6b46830b6cfcd8ba6ca7982914de5852698c5fb302038320b4668bf0a557
SHA512 ec70c5a5f2957afdc3f40d671e03299d6ae0b2232f7244bbbab2280b92c57d64ff4338dc0c77e5d2efd9242450fc6bd6abf0a94752683ca9f1c7f637f2c22eda

memory/3820-1600-0x0000000003B50000-0x0000000003B62000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nstCEDA.tmp\NSISdl.dll

MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Analysis: behavioral5

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1

Signatures

Processes

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 224

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231129-en

Max time kernel

117s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1404 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1404 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1404 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1404 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1404 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1404 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1404 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:12

Platform

win10v2004-20231215-en

Max time kernel

140s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3876 wrote to memory of 3396 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3876 wrote to memory of 3396 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3876 wrote to memory of 3396 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 42.113.50.184.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Time.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Time.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Time.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 228

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

122s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 228

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231129-en

Max time kernel

122s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 224

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe

"C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nsj95AC.tmp\nsisos.dll

MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

\Users\Admin\AppData\Local\Temp\nsj95AC.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

\Users\Admin\AppData\Local\Temp\nsj95AC.tmp\mt.dll

MD5 aac69f856c4540edd4ef7ce6c8571639
SHA1 2860f55ea9774d631219e66604051e90a43258b7
SHA256 6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
SHA512 ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd

\Users\Admin\AppData\Local\Temp\nsj95AC.tmp\Time.dll

MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

C:\Users\Admin\AppData\Local\Temp\nsj9699.tmp

MD5 d738690ce32cfe499f16941d0fbfdc93
SHA1 0a71594d356f0212f30c09029d54230aa40ec3fd
SHA256 d1fc804b6af67de02675fc08f651869f41e470612e8dcfdb6cce48113f283c9b
SHA512 15e03b91f82312a0e735c0ed52daa6cca4d62a2e283871312d24ae8b28e2febffaaaeb6c1da755b34c925462dadb36152808bcfd1bd43a7c6aad32a94366eb75

C:\Users\Admin\AppData\Local\Temp\nst96D8.tmp

MD5 0ba10262185601bf8e9890cef3e29a46
SHA1 cb4a2fbf89b65a8c3039fdfb873758ab6dc9a54a
SHA256 1d1f76dc2c543c8603e07e380459d488931a7231b2093888720d4cc195469160
SHA512 0d64de2bedd313b35ccf207ddcda5f0cee127a0fe6cda75fcf8c8ded435922aee02a14edb34df8bb65431e8c89de955ec94a33b75663fbb54fe9bb72acc0c7aa

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.Admin\user.js

MD5 b66b138f62539437be00686f6be6a6f2
SHA1 19ac7aa4641cdc99e50ef5285081917d23a6b77a
SHA256 a8c06088417a4e88b3dfeee4408f70ca4bda6f698fc12551a655c7afadc5cd66
SHA512 01fd007741a20ecca11544db63b88ccc9ce20a4e3c415d1aa360215f46c8ea3aa2b32a2a13e8ce0f1ef61204d3037ea0d57b99fc8ef190ee5e974d338a220ceb

C:\Users\Admin\AppData\Local\Temp\nsj9788.tmp

MD5 ff7eafe60fd3d23ef0afd7df6c47f3b8
SHA1 66e62c8c1a1ce8f0747b1759b5726395e2e8562e
SHA256 30da2d1a8943c29aa3057174926b5089eefdd70493791e2b0988d75d29c67ac0
SHA512 a8d2983972b0c02bea97fd48e59ae4fe557446b0b66ef8ba010b92fb4b51313da58d86791be1777075029c34d6291355b950bfc25458b4fe66f87c4442cde2a0

C:\Users\Admin\AppData\Local\Temp\nsd9805.tmp

MD5 ca2ab995fc98ffabca74381df2379a0a
SHA1 64e1c4c5b3b4e36702b43540bc35421971382a1d
SHA256 3a9e787227cf97835ad102c7c078552ffa96a3d4a77477596ec5426f061451cd
SHA512 325636417ac43ad58c565567f6c085ae563569fe49a93513911a890760ec654ab5792ec3122a8db4b5d75c5edf87f762c60f6c1964fe276f137082ec7f014075

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.Admin\user.js

MD5 64faeb182f8c5f4092ea1d0cdb199cf6
SHA1 406724b8b79f43e4e0e71159f8216ffb203a02b9
SHA256 a6706f396ca5577f9a4c3b3c1c820252a725616de5b166f4f92af085f4a2b1a9
SHA512 8ff86f9ffbc1f6aea48a7e1d0f85e6c81fdff036b3d264a8fa4f4306ad0be8ec21edc1a29da7b57f7733bdd9cc03318eaf06ae9ae836658840cebafb893a62e5

C:\Users\Admin\AppData\Local\Temp\nso9845.tmp

MD5 46accc4705ffd228ab6340c7e338c0c6
SHA1 b97a780a902da3498672712de592f7f0c98acba0
SHA256 b32e04b973c73a20dfd853f22c52125f92f34ea8682e46a7a44adb8533a2f93d
SHA512 3a33411c1fc071b87652952d75faddba825d74a4bfb446e941515deeab0d20fd1c6d0e25e7701fc73ea3a5b784431aa3bc875c69b764736c7d8ae792c1bc5568

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.Admin\user.js

MD5 8f4d4817bcfd8a89d5e9fa49c44e93e9
SHA1 547983c75b91df3a7e779a1ddbd048e969cec26f
SHA256 9e7f9bc6406ac61af0c046ed44cd24a9ac9f77a37a415cb079254994fb53e009
SHA512 f92a39a005e7aedd9950e3adee700dd5c0402ebd09cadb2e476c649854abbf989b9a40d70f749166615843574fac558ea15899b44452856df13777cdf99bd508

C:\Users\Admin\AppData\Local\Temp\nsy99C1.tmp

MD5 8e1d7f380f34d70472428fe4b8b1b5f0
SHA1 548cb0af05967496ed3166991dbacfb6156908d2
SHA256 8deb3dfd6f4cf850d87a4099acb502a41328aeb0a620d16dfa8f5a2ccc275dd7
SHA512 9554395fd9af2266c91238b93d81fdba13aeb2b2f5d38955bfab8fad812e452357ca482b35de2033741482e85810d4148a1395b2ab003c7d8730b062ea315d3d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\user.js

MD5 893988094d341055aa2a7768da62bfdf
SHA1 c543e1b43169b52c32a16c82f39a5bde82ebffe2
SHA256 df40898017df130e2f7e189adb18e72b232932c87adf8d640ee32c62ad81189a
SHA512 8547ef22c9b79c42fbbfdbf1160d79a43b604fc8d5237e6d384d8b5713362554a6d2cd8332c8a5de42b6e3d1fcdabedc06cf2877b187bcebee88a66257e03add

C:\Users\Admin\AppData\Local\Temp\nso99D2.tmp

MD5 33508f396e76f103ec390e9525ab5cea
SHA1 369033d917963b28af65b92dc34fd0a4953925a2
SHA256 77ba70efd243f1bc2559ddcbb79f7663293436d9c783ddc0a08bae112f21b781
SHA512 b6dad2f29f515c2ab87ed5b58a2639d5e25694156b45860a8bb9a602d48e7d41ab893659c14c0b3afd2d2dd71057dde5a2c563d5bbaf2ccf8d99267e5b39a938

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\user.js

MD5 158cfda5f5e2b46ac7f257be55238920
SHA1 edcae23657c4811dbc952eb5ba81dbd7460e5084
SHA256 6f3aaba88e63a433a247a47c66ef4b06410eb32824049c019e4f7f12c71a2514
SHA512 955b03c8e029646181249f5a93400f36a035957981b0c7a4ef99377c2be37849cf194bed580bbe611095df81300b0925c3177cb843e08149b80ed1ecfd319cc4

C:\Users\Admin\AppData\Local\Temp\nsd9A34.tmp

MD5 4f4e02cd97ab1e133de6df4fbfa7180d
SHA1 bcbaa15c165fa7d8fd3a1d77596fdc20998398b2
SHA256 b7fe92eb3ace7e91c326e93e8117327458763be7ad0aeed2f373278b3d505d98
SHA512 4375d226a2536f07c6f21729c96540c10965cdda17a94a5947fadf2a48117815469f91d8749b0ce66c532840b20db42d64349647e14d949454b6cf61ff07aadb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\user.js

MD5 2339a21915dd2b630eb93c903da89ac4
SHA1 51c7e5592f70cf59db049a16d6d769dbf4fb4239
SHA256 5aae938755cb9e99cd99521a04842b285060e7e405e26fc41194d3ff06daf3d7
SHA512 0b82cc56447449ca1f12ce3fed73600734b01868b27307107aa869dd0cb505d1fa6c5cfb466703fa8ec93501bf636570af66626ce0aea6ec7033d11dc829adfb

Analysis: behavioral6

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231222-en

Max time kernel

144s

Max time network

146s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4032 wrote to memory of 5280 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4032 wrote to memory of 5280 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4032 wrote to memory of 5280 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5280 -ip 5280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 130.109.69.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231215-en

Max time kernel

136s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 216 wrote to memory of 312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 216 wrote to memory of 312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 312 -ip 312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 624

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:12

Platform

win7-20231215-en

Max time kernel

122s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 228

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:12

Platform

win7-20231215-en

Max time kernel

122s

Max time network

147s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 228

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 228

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win10v2004-20231215-en

Max time kernel

141s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 532 wrote to memory of 552 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 532 wrote to memory of 552 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 532 wrote to memory of 552 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 552 -ip 552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 188.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-02-04 20:08

Reported

2024-02-04 20:11

Platform

win7-20231215-en

Max time kernel

120s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Processes.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Processes.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Processes.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 228

Network

N/A

Files

N/A