Malware Analysis Report

2025-08-11 06:03

Sample ID 240222-xj1vxsed45
Target Setup.zip
SHA256 24b791d3cb9b44a4ca9f3ca192aef0ed44afbe0a7ae34ee194ce5c558d43620f
Tags
discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

24b791d3cb9b44a4ca9f3ca192aef0ed44afbe0a7ae34ee194ce5c558d43620f

Threat Level: Shows suspicious behavior

The file Setup.zip was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies system certificate store

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-22 18:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

142s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3712 wrote to memory of 3692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3712 wrote to memory of 3692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3712 wrote to memory of 3692 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3692 -ip 3692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 152.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

147s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 152.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

147s

Max time network

156s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\fa.ps1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\fa.ps1

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rcjkgrwc.1zr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/544-9-0x000001D369280000-0x000001D3692A2000-memory.dmp

memory/544-10-0x00007FF8EFC00000-0x00007FF8F06C1000-memory.dmp

memory/544-11-0x000001D3692B0000-0x000001D3692C0000-memory.dmp

memory/544-12-0x000001D3692B0000-0x000001D3692C0000-memory.dmp

memory/544-13-0x000001D3692B0000-0x000001D3692C0000-memory.dmp

memory/544-16-0x00007FF8EFC00000-0x00007FF8F06C1000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

121s

Max time network

136s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2948 wrote to memory of 2204 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2948 wrote to memory of 2204 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2948 wrote to memory of 2204 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2948 -s 84

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

121s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 1936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

145s

Max time network

155s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9a7c46f8,0x7ffa9a7c4708,0x7ffa9a7c4718

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 232 wrote to memory of 1688 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1688 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 1028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 232 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9a7c46f8,0x7ffa9a7c4708,0x7ffa9a7c4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 193.178.17.96.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 854f73d7b3f85bf181d2f2002afd17db
SHA1 53e5e04c78d1b81b5e6c400ce226e6be25e0dea8
SHA256 54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4
SHA512 de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

\??\pipe\LOCAL\crashpad_232_OBFWFKSBQYXGWXLV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a65ab4f620efd5ba6c5e3cba8713e711
SHA1 f79ff4397a980106300bb447ab9cd764af47db08
SHA256 3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76
SHA512 90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 be2965f82011db749e1fd1d03e8d94dd
SHA1 63510eec944ca5538d986dcb4f7ff5650eec81cc
SHA256 1435d73605c15b9c7236ed3b749e67b621e60616be7ed3a563b89efec05ffb2c
SHA512 d1650af5cfbc70e858ef387fe3f586b28f55d2dbeec9d8ef5508bb34363d2d5427d74beadc2f5493ff891d689642165937378207f7c8f1e750043e77d1d138cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 90572df81483a8c27d49190ac106bada
SHA1 706e0006e71959af9c9237d2677ff58b9e10c77b
SHA256 009c2fbfc9ac4509c31d72f947b914a8f63fb12d2b11060e5969e3a5e3c13c63
SHA512 1f04acd1e54c03f816b9c3eb17c87d4b9e6420ed73db1e8a2305a2503b239aac96d0b44be17ae6b0eb9bd33c0f0fda14d3edf99ede4e5069d59e93ed63860bb7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b310568d4ae053a0c70ac18b52d4a761
SHA1 6e0cd278a5dfadd7327319b78f295d779ad019cc
SHA256 ef409c218694d63b1a0f81f08479652223aa0d3b1a659e9aa685b4f62ea3d709
SHA512 7a9d763472bfa8135a3e0cd7f4d97a300a0fa379bdad6cc57f56a91f4355017b3581e82504cd00a0cc53450137468e42c06f80d4fccb243928fe5b7be7d72e84

Analysis: behavioral21

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

126s

Max time network

165s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:57

Platform

win7-20240221-en

Max time kernel

14s

Max time network

19s

Command Line

"C:\Windows\explorer.exe"

Signatures

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2596 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 2580 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2580 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2580 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2580 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2580 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2580 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2580 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2580 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2580 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2580 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2580 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2580 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2580 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2580 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Launcher.exe" | %SYSTEMROOT%\System32\find.exe "Launcher.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Launcher.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "Launcher.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nst9158.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nst9158.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nst9158.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nst9158.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nst9158.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Analysis: behavioral8

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

137s

Max time network

163s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 1392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2736 wrote to memory of 1392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2736 wrote to memory of 1392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1392 -ip 1392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 19.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 201.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

145s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 19.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240215-en

Max time kernel

118s

Max time network

126s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\fa.ps1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\fa.ps1

Network

N/A

Files

memory/2344-4-0x000000001B710000-0x000000001B9F2000-memory.dmp

memory/2344-5-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

memory/2344-6-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

memory/2344-7-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/2344-10-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/2344-9-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/2344-8-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

memory/2344-11-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/2344-12-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/2344-13-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

138s

Max time network

163s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

15s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe"

Signatures

Checks installed software on the system

discovery

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1344 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 1344 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 1344 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2492 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2492 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2492 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2492 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2492 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe
PID 4408 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Launcher.exe" | %SYSTEMROOT%\System32\find.exe "Launcher.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Launcher.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "Launcher.exe"

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

"C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe"

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

"C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1716,i,16457118764530493401,14130297212336304977,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

"C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Launcher\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2396 --field-trial-handle=1716,i,16457118764530493401,14130297212336304977,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

"C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --mojo-platform-channel-handle=2088 --field-trial-handle=1716,i,16457118764530493401,14130297212336304977,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

"C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1716,i,16457118764530493401,14130297212336304977,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 swapinclick.com udp
FR 195.35.49.154:443 swapinclick.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.184:80 apps.identrust.com tcp
US 8.8.8.8:53 154.49.35.195.in-addr.arpa udp
US 8.8.8.8:53 184.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Programs\Launcher\chrome_100_percent.pak

MD5 d31f3439e2a3f7bee4ddd26f46a2b83f
SHA1 c5a26f86eb119ae364c5bf707bebed7e871fc214
SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
SHA512 aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\chrome_200_percent.pak

MD5 5604b67e3f03ab2741f910a250c91137
SHA1 a4bb15ac7914c22575f1051a29c448f215fe027f
SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
SHA512 5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\d3dcompiler_47.dll

MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\ffmpeg.dll

MD5 e3ab6f226a9189a456d53dd700f5d503
SHA1 0d3f467e9f36a404eb10b318c758edaf02305e26
SHA256 16070fc0fc3ae0d3d5872e5bd2194d883a1d91cf021e1fcb708c785a348c1a80
SHA512 b1d5b362489b5d26037c035c8b1e9bac24a4555b64371b41f8549ab70d5d591589ba154e163ec84d4b4b4435903db32f7ffe0f720f5e6d01b7656ed03f6757d0

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\icudtl.dat

MD5 b7d003192ea485d5207478aaef3d4e19
SHA1 04309f33dc30e135f3e07906ccf6294f9dafe62f
SHA256 870d4b10378f520d427ad280967557e7be2550e35108d1c8688a43ad21ca62d9
SHA512 979513baf715b0fa52a2d48c932b4e16217b15e4059cd86cd9b3b964f4bfe25d95e6e6cd494d0c4cbd4c7854e579f7e4de670c767a43ce826dfd057d68015715

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\Launcher.exe

MD5 48cd1f209643acd6fdbd8cf8a2512989
SHA1 4d1c4e7a4a705b841a361aabdb77decc4d3bebeb
SHA256 19538137b8d1139d5b481cfd91fa612ef2397cbde07221d811be25fee70908e1
SHA512 1688b8946d52904f9c3f97836d1453deaa7e2437eef6452c382d56bdd90f961ae50fbdf2925769658178360c29eaa6192d04d865197b265d732d0ab4cd5f045c

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\v8_context_snapshot.bin

MD5 031ea03da08fe1247280cfe781658791
SHA1 e91db50ad16b5a5fbbaf4118672d60b347ea6161
SHA256 c16dcec41919a6d2850214f2275824be8a97d8c5e694e2ec8dd7d16ab2d5015c
SHA512 b3d6f282761f8ab8760728ecb108f64741f6f3cd2a143813042ff63a3b6604fcfe7c1feabafb65f9f67906217edb5851f44605a34f7a50ed2058c25ce5efb30a

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\snapshot_blob.bin

MD5 b82ff216a0babf602940759b9a3af870
SHA1 07e8a22dcf8d7be04a6ddbcab3098e040494bb0e
SHA256 943b27009d41801c5a649caf680e32d4dd25de002787a4ccd86b0925b3aac3a5
SHA512 da157570afbab7be135f7749df7f4518df1452ea24f98d8f5189430e732ad06ed438afc701cb70451bbc7137b5f35a0c5957df92ecb40d47d54c1071ea79fba1

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\resources.pak

MD5 a5fb562888b2442c157b48a8b979770e
SHA1 1bbe8a61a7cf8b0e01e7cab4ea18ed9b8465e044
SHA256 2c40ea2f7da4fbfa6a07eac59a71b3ee56cb5aa3b1f086af28f54e8746815700
SHA512 5d19e26abcd75225859b0efef542c8c398042e7df6d810bf5401c96481768718669111a64c07e0cc09958522bc88c9e0389355962e05438c71f1ca5e7397aa02

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\LICENSES.chromium.html

MD5 021b0a504fdee49b99e5cf0b5034b98b
SHA1 0cadc10d4fa115b042ff737954c106dbeb4bca32
SHA256 58a90eb01699cf4eecab3663f570f2cc17e2820f49b8ee269d11064e83b8b9af
SHA512 b1f3946c4782ce7433be95864db5816d3dc2fb7e581bff993084aea36593154de3868d92550f3cec221d73b5fd959be62ee91705fe18d813fcc875b496f47e89

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\libGLESv2.dll

MD5 f51ae6b1ec654e5c90a8059311b8eb55
SHA1 f677a46eeb22bf285a6da709f8ac7b48c4b00275
SHA256 9351e005eecd4a373976cb6587f7ce8412d81a0ec691c5d56ddb47617b195a4d
SHA512 afbf9abab7870e3958d04975ea4ea8ad081e07295e170ac259b2ee3eb64d0be83311998421cc9d0d28f30ca11356d7ce3afaf35c9fcdd6fa55fe4ac2790c74a7

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\libEGL.dll

MD5 637eeb39ddbeb3ff518ff1988604505f
SHA1 8b3d9a0d542718fb906f8fafb2583d7bb53176ef
SHA256 3c51a8e53ef7473e9a335673e909dc9c67bf962997e6e2a319c3bd70fd52b4ed
SHA512 3257f9c96665f1bc8bb39acd0d98015b7d5e32f3cf3f84e795df4d19f6bd3bcc14a4e89759cc0de83289b79cd290fd5f4b176c3e9a4cb2eca3acfba0c9e232df

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\vk_swiftshader.dll

MD5 b649acfeffe68ea74b12a6b325c1ea19
SHA1 e042f96eacb55ebfa6a069b9c6ef115157a59f9c
SHA256 5c74dcbb48d1f4133d48d61f6e1d64f9a07c9b9788ab13dddf7c13283539d5ab
SHA512 92e12bc996dbf4534df13e0cf6e44a03ae0b453f1e018ef5e21e44e695967ab67b8b1bca93197ec4925b0e4e9ab11cc17f58d233d7f9865d0f236cce24e751c8

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\vulkan-1.dll

MD5 c286e1191c5b91130b6d16e23cbd44f3
SHA1 8231664efdf30b07ff0dbc6b6f4e4d46ec574de0
SHA256 8d4b92d08f42bfe9d30362b9cf671fd6ae3166ade44f94de17dfc531393b66cd
SHA512 5cd07f2edec7bbe8684ea291a9d1dd3709f6a25c55fda3d92938eaf9c3b047ec481e3e7f3fc64973f6833422ab5880f1318a15afa666e2dd207763c7d3822bbd

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\af.pak

MD5 198092a7a82efced4d59715bd3e41703
SHA1 ac3cdfba133330fce825816b2f9579ac240dc176
SHA256 d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba
SHA512 590dcc02bc3411fa585321a09f2033ca1839dd67b083622be412d60683c2c086aac81a27bc56029101f6158515cc6ae4def39d3f246b7499b30d02690904af0d

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\bg.pak

MD5 9dc95c3b9b47cc9fe5a34b2aab2d4d01
SHA1 bc19494d160e4af6abd0a10c5adbc8114d50a714
SHA256 fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e
SHA512 a05a506a13ac4566ecbfe7961ace091295967ea4e72a2865e647b5fa9adac9f7cf5e80b53fae0e3917dfb0b9a3f469189cd595cc4ae9239d3a849f5cedd60e46

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ar.pak

MD5 b2a23f285858db5e3e53d6a5d5291623
SHA1 674adfeb57075f86f40ff4b14916c3af29695813
SHA256 7ab39416b60ee342ff2874aaa7b9b95b290828807b1395192cdbd29ee1be15e8
SHA512 92c9b31f82f62b15eed3edaf437412cb630e8deb2226ad162d7cb4c252d8cb7f0453b3121a846ffcb1547570e2eadb04cfd3877ab120496a7fefb47a6d96cba0

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\am.pak

MD5 a2a17bdd83467a027505bc817d1ac028
SHA1 cc1266a22606a1055db9653b82e90c9d1f551d44
SHA256 f92b0299185d963337e96df1016e1cf5ca335e22ff86568c1a6507c3fea29094
SHA512 193c5db0a30a3c8ef5e8c821cafb9d0b5671b7e7821748c7b432e927bd4638ecf5bfc1d99721ce89fb3df4f6f23b5e55d753430e8ef2bedd1e1633e613321028

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ca.pak

MD5 0312c87b6436e733a037bfb3084f7550
SHA1 e3f30b8f3bfc8ddbf4b8f85f845733ed5ac8c632
SHA256 b6c895fbca90c36ae2cfefefda989922162a2cc259603fbca066f0cfbf43c4ff
SHA512 24b7780211b9dcaf7cbe3915851c7b873562e0cff022c29ca1b4e159b9da152b517305f81dd33712a0224fc3b77e594405e432fe5eecf29b7a4f83f441d6905e

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\bn.pak

MD5 fac2c752c57175a4b1f4630e3667123e
SHA1 a2dbcf1dd7b3cac499b9f782c7393ab438039584
SHA256 71f99a67bb310fab8068eeed7ce24ea7624a66051ba4e719d051cc7e67e78001
SHA512 4820704bd92dfb60736da5b84c8bc9135fca484c678585ec9d26dcb90632e382f354d03b539599f4816feb027dd285ff06ed8a520bede56d7a1c590d942e4250

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\cs.pak

MD5 ff919631102a3a9ec635b3080b63e305
SHA1 e43b117ad5b2d5b373321ab0ae63dd4bc1352a89
SHA256 1b8c3add009028eb567b0094759daff29b7861e11d5a9d864071012200e9735a
SHA512 21833774413cc71ba9c0c592504ae6288e3c8ac4e5d1d62768f4b3eca09e90009abec5e8fadcb4e7d63b99a522ae48fd608aad432eb4165ec7021c8888ad7df1

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\en-GB.pak

MD5 502260e74b65b96cd93f5e7bf0391157
SHA1 b66d72b02ff46b89ee8245c4dd9c5b319fc2abf7
SHA256 463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b
SHA512 0f0f9aac8e6b28c1e116377ab8ee0ffadbf0802a4026e57aedb42d21c38fbf70159be9e0314799c1de1f7638fbbd25d289dff7cd2c9eb7c82e1b62b6c4e87690

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\el.pak

MD5 8025eb8756d4bf3126d83c9078935520
SHA1 78895218a90680fe223af0b003c195da84902e1f
SHA256 e42aeaea80dabe82657983a462e4cd3ec74f71d4f08a689f5825f55fc02f3141
SHA512 f99f47e54583b60857a31648b985216713725496d8653ca04eb1d6634f2b7f7a1f9f70b8a7938529bfc6c8665360da5e6bfb6b68c314c011fef4a9817010c42b

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\de.pak

MD5 8569900305a5661573f7766b93909f16
SHA1 3529376f54e32c17447b065d08c77314c4db2ec8
SHA256 068ba3e34e7f253fad7dc526b1078aaa969bea044d48171925534598aa8becb3
SHA512 d544febbe20a9bc5cf31f79f7ef74c1a742cccc99136e9828187c9a643bd0317c7cc48706346ee1a3c9eda8984be9c8606e9dfa7a6ce2cff49db2d785c2aa1c3

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\da.pak

MD5 4bccba46add5ebaf6efd4ade3c42aed9
SHA1 e48dcc2de930bbf0ea8ee7b735ead321dadb5be8
SHA256 2497368658a988e4eb3f64cd17423ea04e7555b104d43c8996c0ecbbfed5f74d
SHA512 e2059e2a7f80353981eef6982a7da006fa3753aeba9aca5279eef71aa2fa4b7adbf9cbb17c85b8060359f9e871b1a5c665226f8d3b8a6fe49f908fd44e1b46bd

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\en-US.pak

MD5 3f6f4b2c2f24e3893882cdaa1ccfe1a3
SHA1 b021cca30e774e0b91ee21b5beb030fea646098f
SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
SHA512 bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\es-419.pak

MD5 02452424bb0cf6ab832808d04883f147
SHA1 a8e97ee52f3d97c1a4c678f7578808416e9fac65
SHA256 1b23cda69927c77764bda121ee398ffefcf5edcb5866432aa3526c378553c9b5
SHA512 9e750b26ab40b5f1c075acbdeb15a57cda9e6bd8049488cfaf368b5cbe8cd9b6e5dc96130e4137370c90bb0777b97515ea2be0787e255cff750fb7e188e22ab2

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\es.pak

MD5 4ca91891b2d4670d02931f0ca84e4744
SHA1 85f6559b09c80af2575e3b7626842c10081e188e
SHA256 85fff1ca6bd2527073de03fa77dd013db2557a57cce1fd370caa2b185abb9336
SHA512 83eae7ab2f03598c657786bff6171803b6bbe2128d1a5b8a01d9a13337113632279712dd8ffcd3b707fa6052a936d92a57cb67d848c77ee291e75700e29f2bf8

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\fr.pak

MD5 a7c88eda9e12b6dbd432c544767acbe2
SHA1 81f1abe537870f7888431e820b636b17b5213835
SHA256 a4d0e5a39241a6326143afa4c8ec881d6edb0382c66425411881946f98e053e0
SHA512 88ca203256aaaaa26afd4a0aacb6fba2eb41618d09df6fc6aaa80ab8d699b30e73c373fa75098b1ec4912c042341dd1c79ee3d04f98b4bd59a44481d350a7988

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\gu.pak

MD5 3268b8d9b4d4db87ec627b09f1c55a6d
SHA1 683ba367e40abb2fefd4548805e845fc1b452855
SHA256 dee5ef4f4b36fc5fe0f3b5e10c7cc3a7edc14bf948317b31a3287a95bfe0afa4
SHA512 59cff62843d35f790092f42b611e9bcd80d948c0ef27a770b2d7af859997f40c320d67df3c5a9420d28d5c8f1678df4677e01cb99b729664d198b3b95b5fbd20

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\et.pak

MD5 74eda453b23793ced4480ea7a595fe44
SHA1 76964af9c8024bd84fa1d89f60784e7ee6569350
SHA256 e2d38131a5ef4b0e8438f45e8c74c56bcf666760d4682120c8071c9220230555
SHA512 e9928cfac01f10b040c74e63242ffa1f7f616d8598f49f0aa7ddad063e18666cf5649cc65d00b3526526af8a7b46ee3b3655da22adf46aa44c0c6a1c2ac4dc7b

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\it.pak

MD5 6629c344b6e5ee8fb476522627b34221
SHA1 28335e3c96a68a560c68756860394a0a86c21870
SHA256 e76c3f15529fa7cc088dc32903c6885f4cfa170a1e0144710b05965f3210c31c
SHA512 78ca2ebf40d6cc3eb7035cca78364be63b8eb69e27caf2cae57e3489b39a9e443409e800fd95e1b646d37655c37ee8a9ae1ab344b506cf65f8603a6a3ad892ed

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\id.pak

MD5 881ff04e220aa8c6ed9d0d76bfa07cb8
SHA1 cacf3620d1bf85648329902216e6cdc6f588a5ba
SHA256 9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22
SHA512 9134102928aa80c49bbf2b862e8079b2ee23636ce63412a4c3813f234d623ff563f5ca1ac407ddb77cecf1224896ed59ae979dcf63435d35a4f13de9c22755d5

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\hu.pak

MD5 d6904e7d1b6750d43a6478877c42618d
SHA1 919f090a6a3aa1112916f5bb0d5b73a62be43c1e
SHA256 3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f
SHA512 d600fedb5ef1b2eb49a0122536c642b350ce67bb7a9da205890d9d13a195ac17c14607b4489715fd34506ec0ea4c80f245e09cf048aef52dcc8094f3138b2fad

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\hr.pak

MD5 7dbd4a9de6e30de028c97a7d39f8038a
SHA1 18d68f37b3c5eea3a2fe42c4ab1694a439a189c0
SHA256 e1c793e08e062043cc65271718d9b21d5742729dfa2e076ab012e8a008d06c04
SHA512 a18c43257d26380ec14ae0259cf192257fee0c6895b82240c3b41c5d6e8bd6f8023cb39dc2da0701bbcf05e8eb2cd13c84af971c28c94099a6d0ea02ce745ddd

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\hi.pak

MD5 9b5d94450fb03c34759653deb0551441
SHA1 b9134fbc75304ca73b156e77425505ed6dc6d629
SHA256 5e8f2593dbea5a57c3a974558a3fc91b6087329a1e7b11622a6eac120a973718
SHA512 caed9535d487833bdde51e82b76d3b8d2e6ea18ec0b4b7a98552be9266ff0728bb1133d8f9cbd169345aa08b0073f04d649baa71bb487483951cfa1a92080d63

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\he.pak

MD5 6376d0a5f4273b76b1f4aabade194e0c
SHA1 337ba39f09454c0779ab64872b9fa11f866d6adc
SHA256 875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45
SHA512 00347f16b5abbaf47fb08663d5efde26ab7de0c7a2fa42e6b5f03c41a83cecbd8e78cc3aef41d5f08658cf346e0ade732774485e8a10008a43fa41ffaf73b2be

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\fil.pak

MD5 0b7d25d70a2d94a032b7ff7faea45a75
SHA1 d9d473b2ea936ffea4f751d8716cb03407a95785
SHA256 a737a14f84b10b2e3c9ad4d147b430fd30c5ac0e125d5aaaf1ea19b0507de5af
SHA512 e4dbef6fae4cb56c3cd7bd5dbb239b5136eb2534a17cacbf628f5e5d77bfca924580ad4e4d0ec580ffaf94d6e1fafad58e9c5f472c3a3ff782702ea5eae2aea3

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\fi.pak

MD5 fa7dbd2ee35587ff31fde3c7107e4603
SHA1 baaa093dcb7eccf77ce599c8ff09df203e434b60
SHA256 5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c
SHA512 587f6d0e216d1688227345a8a75b94848ee710ec633fe6805db66bb0e8cad1b8d24a1e6a7e234061516770d881571166c78d8fa1c40e6335f3dcb1339fbffc14

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\fa.pak

MD5 99de8cfda36ab9ab3342889fb6da393d
SHA1 6bdd3d627d4b6702f43725039089562af58898c0
SHA256 b93145f30e25122015373a248d6ea22a539c7d0d58c8aa853ac35cc80dc06bfe
SHA512 aa20793f9ece5823cb9e74a4a3ff97d7a1860a593f427fb5eacb0390569a48122589610fe5a02577577f3a30f981c5e3da97cf73bdfe158a6bb845586c5b19d6

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\kn.pak

MD5 a1b9ed3b257affd8ff86e121bf620d5e
SHA1 d36c5a5019775c56107f4333815c2cb637794b62
SHA256 783b5445da60631e6743c3fb50a7aa1e9699c9fbbbc84dedd00019debf7e1c9f
SHA512 34787057043fa2c468ce90de814581f39275225bb61eca9d8dec955d7241cfb547c73ce40d385eeb0b164c84e3ebcdbe8216fdca7ea53cad4d9012f7cba2ae87

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ko.pak

MD5 3db3f1e281d4de46e2e79464d03e5ff5
SHA1 bf261bc549365fc68ec9151fa5e415b517fa47e2
SHA256 3156d625afa09b1fc2d13e8c40dc46fafd59f58f486c11cd87e23ab5f97b025d
SHA512 92d1c95ca48e3896e9a9a1d4da090294aaea4e4545281c895bdfa43161203a10ae126d59df0c1a669812d049597ce522352524c729b48711f4b7f8cf0d8b9c3b

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\pl.pak

MD5 bbeb9340590e58be86857ec2e43bcb27
SHA1 7377158dc29fc85207bfd2ea2d202da38355a71a
SHA256 94d60594be9ba1a57d2ffb917484715e9452327ae9d6eae3c7842d3d44f8dc13
SHA512 048b083a6ec3d67ce567077a61bd6b8df60c9de4336da86d117c3aa420ff17068f785c1051b18f1416f16b60aca8fd12d3430fffb7a7d8b41ff234cdc5148201

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ru.pak

MD5 dfde3a28394ef8891e4be9615f7ad387
SHA1 ab67526a9c936f828770f78df7f3b6be57864b90
SHA256 f7218cdbb944785b5ea9844e1212dfbe03561146a9e45e124361366287ec3df3
SHA512 e116e6ab43cb0c301fa6b98f4c395f59af7b9a03fd34e71cae183b2665234dc4759137ee8b60fb3491b71616df2f49344836833fe3d1f45b0d6f1ff2a382d846

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ro.pak

MD5 380e466d7be396be60fd1c7876247ba4
SHA1 e5d43d52efeb717d8e17fa7672bf85f38909f28c
SHA256 10ddb31b866049fc03c570cce9af6fe242a0870ca15ebce984b931b7338476be
SHA512 af31cc28aa1fdefa111d4b8262fcb53b45e27c0879f94f7711edd3f46acbd1049ee7ee8af3a5450c6d46b989efc5240d779248138cc9318d70b1b84d40cf7fef

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\pt-PT.pak

MD5 ba7517dace82b9885d00f24bcfe7c64e
SHA1 2c0784c9aa9d297d74d0684d54b8f00e673ae56d
SHA256 253820e85a2f9f262508606db252cab9beabc02bf90d0c399e4996de3934ce68
SHA512 c27c59cd210ec86a1bd018cf73ef51a6b67aa2222d4a3d511089209efcc639985f91958fb99964b620b03370d2efaabe20f6cdaf264c60c220ca9f69e12b5ec6

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\pt-BR.pak

MD5 75b6a75450c5512feeae2fca75c24512
SHA1 efb43edb55fc260c9490780b92d35e1e91a1b21e
SHA256 262bbba31ebd789620fb536abe836e8ae1abdf24212987ce79e618eed260b0c6
SHA512 97ec967e3f1b8f7c89707ec3940ebee2994c595d8403af1ea0b0bcddcd7de698823dc358afee5b66fb8b00d88bdab7906907a423be90fa0d1c014596af864f10

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\nl.pak

MD5 9fdf47fef5b549497005ef8efd2a2c59
SHA1 3449de72bfc2be537f4b007c81e5bc5de6ff3d0a
SHA256 65a9c1efcdd451504e2e9b44b0c8fafd2c3c1445d760fd6c435305e2f8534f59
SHA512 3e77178dcd9e8894847039a997c87d5d04eef8a1ace1846132fde229285da08ffc8d3ba697226130bd07ab122a868cc53693981a21f8211c839ccdaba77207cd

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\nb.pak

MD5 bbae0915edec081b04bb903b689bc40b
SHA1 6a0fc635ce1c431e512b8b3b8448176aa4025556
SHA256 d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8
SHA512 573a9fe43213829a6a4b39e67be25bc330b417750ea6d66e26163de7a80c29f6f5deeb841d9ff8303595943a81fc01ab668aab02a5cac4eda078ed06120138b4

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ms.pak

MD5 6de7b004a86967a3433545b3b38bf89d
SHA1 113bd5b28dda669b27c798e0b46fd680f3a04956
SHA256 ead5a37549b98d55839ffcf0dc8f8201d37d71968ec9138fdea79d7c9b79549d
SHA512 239c4acd2c0b6c08fb92fd95b89a302ddefc01ea843950a0247b7310c2b024383ae98286c2d4b83b99833452c41b386e047b2ef33610ef122fcf2f439ef43726

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\mr.pak

MD5 8ed14c5281fdbb4f940b4d9c0d18de87
SHA1 0c6f07073d3de823213289ecdf4283eb1ebe67db
SHA256 a7833e123bba5e834db98a783d469d22f5e39d94e29a859fcd9b41d13bfd0f38
SHA512 3bdfab3a2239e1616e17ca05691e126a6dcaf368c2fa04380de74e74b8aa4b63fba4af61de9f842c9e6a5fb706460d5ac0c7437ba5b7286541f3136d410b6ac0

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ml.pak

MD5 f6a8b1c952805cf62d3b4d779e29839f
SHA1 3734a45171344d7d47dbb99c5dabde6e31239b2f
SHA256 0a8d67420ea9afd1cf3788f190627c013403f7be09717e299cf0a06f6c621045
SHA512 dcfdde680af34e05aa77b1700fb244f69eafdb64898d783e7851194c0e61f9a6ec74cddef2cec551ca4f0235889a1c4c9507577eb22fc94ec2a64940573918c1

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\lv.pak

MD5 494c43d8150108aaa7444cd36af3956b
SHA1 633b33faff1c73825e1cceecca0400186de57124
SHA256 99cb750eb1991f2304593348a827d33b37608541d66f4ad8ae4ee168851c8cf1
SHA512 f439138ba5d33ff2847aa535c50b7bccbf8a50758eac6c2865b271e5945f9e5d5d13b4befc81c4aa41d8a94af8a4db4dcaed100ca5a6c386b3653d37338b1ccf

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\lt.pak

MD5 7b6bf901352885c0699db71239b7cf24
SHA1 9e3ec5f327c0d0e54a449332061e60a8c79243cf
SHA256 9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350
SHA512 79ebef723fb4c17581eb869b4b4e1a364a3d28df0e168e7e1a3583e0c1ec5b9716dd270925c0545b8247421a64b03705f10910fe3416900de9258840c470d580

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ja.pak

MD5 c294012268f9e611fdc2904be57e45d8
SHA1 9ba4bd190ced7ffe053fa74071fc5836bdebea53
SHA256 21cd7ae581f6d0c19e90ac7df03d7dd5305b882776a1f091573f824bd28514da
SHA512 d16653f30617e52a040c5e033896a71055fee9992e54ffca5029601bb62a41b9685a68655b9c8bf7a7ba54a914836a0f7a49cccacae0eda180a6b68c0471a268

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\th.pak

MD5 c4cc8d1c9b0ffc0e31a9d217a2bdec43
SHA1 f3661f892341a6907b4d8b3f18b5b27dd655abdc
SHA256 7dff29f8558c8e274990b94d36297d6fcf0f856215e5e4e130117d7f297391c7
SHA512 ef29d4f4ef26a9f83b416a660ea6ca2aa6a00b6c5d09cf5d9b5ab93a732dd839b87036186f046af7d25f74714720b53a1ff0dcb2fb3ebebf69d0ba59219a7e1e

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\te.pak

MD5 36c016fae026202f9fc620f949a99703
SHA1 15b60158eed4c330a47f8a379ef8f5f73b19ec40
SHA256 44b0ce2f50493b279a4ef3592759cda82196ef7552be2a859761052b71895c81
SHA512 c745b888ff1519add4aa6e82d011efa08070f3816f12569cacba152bca2a17a1a2fa035ccd51a0f924ee5898bb5cabe31e9f75c31f08a1f68a54472303e96a8e

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ta.pak

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\sw.pak

MD5 a7b844a5763869c2dd8f569fd7f8864d
SHA1 e0ea69e2cc4d1beb5fdde4c21d59fa72eefab43c
SHA256 056bb950f311aabdad6480d9f8243dfe2d0cb451e00b58b03abb8e426da336be
SHA512 cb9442f4cd4f105674c47561905be9b2fc2e666ca4382e8c642e4af5c7ab3be3e7efa6d27fc90b105a77854b3076c39e8d0201ecbbe25637b5395165ccd85ecb

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\sv.pak

MD5 940a9ae69467a0512174d48dc42106cd
SHA1 3eb42ee6554fa84ac5a335fce83c0c15673d5493
SHA256 b7c1fbb19acdd725e2bdfd39df43b4c2b84f63e2e46babbbddc60b56ac678862
SHA512 627381123c1373911b80119b267b3f4dcf20c6460122e9b0be0d3b799b389b3fed198ca728d02e5510a64b5df965332a9e50a19325122625fe14da8e1d8fdef2

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\sr.pak

MD5 bcc51360f2242eea124aae8fb6768e5b
SHA1 eac0cba232c7e6ff6ae1b6beb9f786d67a297ec2
SHA256 206f0e0a0c6aead66135d79638062fe447f684c329750191a11188fe79426d25
SHA512 223fe2389e3ed8c40f7546d11459efa999ecdd2f7d7bda2b3d72ca2c51f00a6f15a02c803c56ec009fc6894fcbcd9010f89019f8248d72ca157e0dc29cb53782

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\sl.pak

MD5 c1a01e40088d44495844618c19dd2b15
SHA1 5f41f7508a123b5d23bf71c55a5ede03d168aef6
SHA256 8d78b2d8c2019bd838227278811591e2763a4466326129cfc993fdab475fbdf0
SHA512 8dc63e2c6e94ae30e8fb702d595eb032b82431409227e59f445fa5c7664e9ff7df9e2a426ab06a6ab8afc9915b30180f87551f8ca4c8503d2a331386f70eedc8

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\sk.pak

MD5 089cf40312e78d89971f2d884a142c50
SHA1 eb8cf476618ddf3ba6b4ac65ebb4530362dfa73e
SHA256 c1779142f740fa2cea9e66373ceebe8670aec4a2381a9307ba3b840021fae3a4
SHA512 c199de45e87e170f2d94cf1bfab4dbb0dc98018d91a475f0923895fd732163895a9b11b4bc4c8fbb7af5d106319c3bf6471e6ace2f7bfc5a9cee3fc22b02a5e4

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\ur.pak

MD5 6733dba4f3f0afeffc40bd87300b9d6e
SHA1 610aab026d25f2cec6c636fbaee922c099d26ef2
SHA256 d0c8ae8f4f60f04d4eee8cc639ee3b52ad073f5c9ee6fb84c774eb855fd51e9c
SHA512 40c1cb7be3709bb6ef01a4e66bfd85e20641020a800292a2a14f4cf188242aa0b8d42cabd0f323acd3d2f257243c7dc04b346a39475343c761af7a1833c3366a

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\uk.pak

MD5 0d9b7f3ce815f7bcfd63ee3492350d52
SHA1 6138b5dc296cf406b2314b8b797f9f96de2b40fb
SHA256 b86358579a9cec015c996c6ae862ddcb8cb558f30eedd0d0b9ef3cb18c3cc130
SHA512 17d874849e5eb17bff2ac98c8191f9f38a07a66eccc502122c0ed2bdd6af94eb17db1b0a2477a75c1fd4f3ed00c76b1818eac5bc4093d92eca0d0a5323718cc0

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\tr.pak

MD5 0662e2b67524444e843d0104adab0b7e
SHA1 ec39112f57e28010295398c24c6a17e60a88fd47
SHA256 e8f86dc87dbf11935863efb3a5af8213a97123889019e98a7ef313b488088790
SHA512 6529083d04e777be3cdaa14f06bb6b3a3d26006ed9d067f7a1bdfcf669856cc6340bf0caf90bbceb75666062fac1bc02ca2d2cff94c6ca5627ccaece6f973a65

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\zh-TW.pak

MD5 032c4f24764d531d0de876f1e9d51dc9
SHA1 6662a5e3466c1ca415e219634cd67863ff830b32
SHA256 a0a715a3ef1ead036f0f03d02a8252fbdbd52ce6f8cc5b9298fc1c4494d4e508
SHA512 3cf212a638cfe9d08e625f7f70d453263e44721be9550c2aebfb67462666a8d67b87cd2ed613cc12c7d1fc7d1c1368c7d198a6669fa3a10c2c2bf61966c46aff

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\zh-CN.pak

MD5 37b051269289e0eaafd411d374663135
SHA1 fa94bc7fe89475f1d5e1c9a2d88161cc992a638b
SHA256 4ff334da089d2ffb9c6173de7c918b74c9326ed7bd76317b2696d57861871488
SHA512 357350ec552765df460cd66ae59ebcc771df72431baa380247750627ee974f1859bfa423461a2197d4e608063d021faa7fc94bd30c6fe2b1a0cf9b9f7e64ea73

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\locales\vi.pak

MD5 5b8fc875f0b57ac7793e19e0ac6f4899
SHA1 b8ec064365fc29a70bc3a8d3df0ef222ed244fa8
SHA256 ff3cdd834569cf9f957a444ab8a51ebe673bd26d7c907a907aedfeed248d4890
SHA512 f3a9ad912823aaae0d089cf53151cfba0b6fbc2cebf826b1b7c70fec03bf3f967e440558fef94c990c87349b82c36379bf645b828ab6b69eb9f396165dd6178d

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\resources\app.asar

MD5 a05f4c6fb585ff2656756ec39385b1ef
SHA1 c24ebf45598cbb56203de60fa1cd7ecefcaf9524
SHA256 4e59277ad0a064099f87203ced1eced1db9aeb224aa793f24270ee103f7e72a1
SHA512 2fdf453b54bfa6a68ce17e74c1b9f0ff0a5652b5053e032242cbfacf63b31f0f6245d492a428d482e567e58ce6ad30ae6c9dae0f09c1cbade980d01e58f293e6

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nsq3C7D.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

MD5 3a2f35e40b6770ed9e437573c6697043
SHA1 552f9ef5e19cd83cc773ffc93104d7f4817a9992
SHA256 965627a623c19e98aa0cad2a67db96d13163d5d7b121a11665fcf8e192d88830
SHA512 cb0068eb409fd7056a07197d2179fbbc5e17845611c8b0601f7f0e39f55d3b323d1ada1764fb34dc88bdd7e1272975de6d1f0cc090f9d7609b72d210e08f4a2f

C:\Users\Admin\AppData\Local\Programs\Launcher\icudtl.dat

MD5 574369357f8dbde7bed0df552c3c6322
SHA1 5077a788fde4f81a1e4335ab10c1e4cae8315a15
SHA256 ee0f22d2374d33586c2a308724dbb07abedad41eb50b60c7f776bbb4e701f8f3
SHA512 8d5a96e8f362c508c5a03fe2bd3449f936bee7238737058d7f816311846b3b898133cbe69d37d938884c83c92ff4868b46e1948e4636aca2229c06a21c0f19a6

C:\Users\Admin\AppData\Local\Programs\Launcher\resources\app.asar

MD5 507b9182e685e178b1e87ae66a066055
SHA1 cbe4ff4e09844b1472e98a4d3343ba28325022bd
SHA256 bafe2186da822bdebedac7c486d1f56083a509e45d15439ed6df7f493a00afb9
SHA512 a3a6204a414fe56bb90767ce70c6a70700c13024056914e82b3f641d1d319ae49276ac74cbd6d812a15b949a48122d13aff22cb0c7d711c890c08234cb895054

C:\Users\Admin\AppData\Local\Programs\Launcher\resources.pak

MD5 a4304aec537c5330560a88825d497eb8
SHA1 0c391e819b0af8062c840770b9455c41e1eb3914
SHA256 4b4b3353a5138824eac22b3875373a5dd18a3f6ccb298dc70db7f8d1a53a13ba
SHA512 bc32880c52cb163f3e39b3f64e41bd4023b770b33e3919d27a46964c93da864753b973b84334ebc133121307d38d38b4e9d2256a2be65ebab77aa6cd741b18ec

memory/532-738-0x00007FFAE57F0000-0x00007FFAE57F1000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

MD5 c23b084c198533c18a01b1e4e9cd16cf
SHA1 17bbbaf595bbd5a8e2211c7d7489590a4cf1a408
SHA256 3c7372154dd1da2ae26402af07a994f9e4246f5dd6431199bef74dbb41d9f501
SHA512 f0b58aa25a904651650631316b192408f22f62a804856d39b0cb56f3c496db0ab9769898092107f7690d8bff54a579ec110824ccc98714c880116bb6b56c78a0

C:\Users\Admin\AppData\Local\Programs\Launcher\ffmpeg.dll

MD5 341d0ac1a9135b0a1c2318a3814ffa57
SHA1 1ba1586175f770d729d7d5059c6a1fedc224c3cc
SHA256 8370a8edab44fd6128bb1966bcc141866e96e192f4c88954827c60451c1358dd
SHA512 365bab39a806846639c0b37e6e9cb97a7d6984759c7437ef7b29e22c7afa86112e47721712865a35c7028427541652007853021766eb9670f879f5911cc18bb7

C:\Users\Admin\AppData\Local\Programs\Launcher\libGLESv2.dll

MD5 0b050dbda45e06e56bac7989ec657377
SHA1 18ab181a659a330520c4b2e632ba070571421f0a
SHA256 49ed084e87891bf72bb3a60e71409f1019f63a88ab4d297e508806bd2fb587d0
SHA512 a1910fea1176e53ceecd255ab57d1d45bef7569c36c8d1bf2116f4facf1ba86dbe9dcb4d48b36e373cbc31503e4beb7463629b87b4ed68b9a04c05b50d53f11d

C:\Users\Admin\AppData\Local\Programs\Launcher\ffmpeg.dll

MD5 bcd7b5c5ccae98342d91456937b62900
SHA1 2934918549a94d1fdfeacfa4ce6afc87fd04ef90
SHA256 24f74a496125094390aa7f6f0a9434e963d3c82c1ec349a58d05d71e75d442a6
SHA512 2f8da2fb8545ad4ea67bc426b44c33a3074708b0067df0ce5f273167f120ee1e1e991e4afb6ab27dc93ad896408b20e61c2bcf754cef297c32d686a3ff6a4182

C:\Users\Admin\AppData\Local\Programs\Launcher\ffmpeg.dll

MD5 ef59ed9db93752c7148f547a9b020721
SHA1 c9a6a411b6442fc017cc7481dcafb6f52bfe630b
SHA256 ce5cc66c0650f5d8fdf1a0e664d421b2076a43cf5f282a86541a392f58d8b9d2
SHA512 b7992b16d15f37df8b4415f089f0fc2cfefd84238ae734f12032be60a8d340b54f8df1ba0bd7332b0007055318c51a6bddf220f7bc5ca4f9c48b69834a6a7e79

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

MD5 169cb85db3e057d6adf12668bfd0ec5f
SHA1 033b9e980d730e8f4a0115883149b4f61f0f0372
SHA256 a1c389cc797f0e9173e057ac116bc51c9724b4d43a59fc6a5024e4b0862ddb49
SHA512 8c4f3bd7a5cb90c9e06ae4fb77e70b884e737c9b23370e4903e7e72bc1687c50b1cb884c1d9c2f504d63ba1f86f872ebf981319c8964ec66e8c93a5fee63c902

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

MD5 8c1c05d0b064e365dcf7b25cca3d5617
SHA1 c098485587f6d6cff1f913ba27351b9ab7beb4bb
SHA256 20b0772232ca042c46523d7feeff788fbc40c840b1620d648b16eef771f9e1a2
SHA512 0bdd086ef81faa9a3ab13ebecde9f67ddff59812346495d310f688a901f845077be9bb9ad5b732882bfa75a18d54d4a329e0536f0fd79ae86934ac592ae5743f

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Programs\Launcher\vk_swiftshader.dll

MD5 2dab0cdffdc1f00bad12909c1867ccdd
SHA1 fb8eaddf0c5ae1ab1e54a4716744d6978a800bd1
SHA256 c9d187d1b6ba402912f27e4387e7027e3b845e5d910b2d196d3e989ba310ef68
SHA512 463a7e0b38189b6c8f3d1c01d1dee803609f85fa645bd56adc07892ada442539517573b12c78c87d0c559450f8a66cbe5b2553ff60965181661f9740c0f0b6d3

C:\Users\Admin\AppData\Local\Programs\Launcher\vk_swiftshader.dll

MD5 0eec138c16bb9fa57c983900d112d814
SHA1 54bc6ab5db356c6cb5c5b2b57e6b3027646b76b0
SHA256 6b85f6e51c647564cbb6ea86518e750628a0b58dc5aaebf0b136341ed37e399b
SHA512 3c8775097f1be8e10b259472eebc8d59d4ceda1556850e35c0ff72f74a83d0f4c6ef60e5d6fa60304fc1a510b86e51b23bf0e08068fca4db336fbad1c757c23b

C:\Users\Admin\AppData\Local\Programs\Launcher\libglesv2.dll

MD5 50e029bb709731ce99806a7be806b002
SHA1 91cc66debf2ee39fe78c80a1a67d1560c7ee7bc2
SHA256 60a5283b730574938dd2877d4d826b936f36b79e2be389aca417901155e78d8d
SHA512 6ede6a4600e17f384026c185540809086dcd1770ee75d9b63f69a16a4f77d7ee9c3143c28e12884d42b1112c8704abddbe5f5126bfcb3ab96527c5f1f0c3e672

C:\Users\Admin\AppData\Local\Programs\Launcher\d3dcompiler_47.dll

MD5 9c8f198744e760bba25abd98b85a3711
SHA1 41e2bf54fcba3deb92951e80665cb20b08dbb9db
SHA256 7b19f38be8de0df1a41306cc69760194892a67199bd1d1cd9acc816b69ec28a9
SHA512 7108e3c240f0185031c8a7056e3acd5a45d4b04ea86369ddd8a59e25b8e8ec97e2f2371b7681cf4bb2d04a85cd8e7c13feb1e7fc7290509fd2a18f035e4d1226

C:\Users\Admin\AppData\Local\Programs\Launcher\D3DCompiler_47.dll

MD5 eed68e3366bd75a42e91eae7d9f3d54f
SHA1 d5d3ca7020e3280295b1d31028085dd9562585df
SHA256 6f957794690b149cf7c913685f5d35f492c76243848faa9d943011a7b14dca58
SHA512 16ce7fe15f89e4a993a231a87d43e4ef1771686c5a1b8a5b7c770881941b62604c1e82cca18124da33fa2d3de404723cf2ba7fa4865fba0a73d6ac53353f18eb

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

MD5 bcc6594f2c5a5c3f8420d13ee21774e2
SHA1 9e86872b0f128f62145f5688704c2c41f6e61055
SHA256 6174310618269e7ea073d023921733d42677e9d336a8da9f09445130a3c72b64
SHA512 206c2f3089dcb3cf3946d18e4df37dfa6e8e251d3c1a567b233364d17847e646257e07ca74274a5201b1ca2a40a1c6dd53a7597539a6d0fe11d2c6c18b57755b

memory/532-819-0x000001F2746B0000-0x000001F2747DA000-memory.dmp

memory/532-821-0x000001F2746B0000-0x000001F2747DA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Launcher\Network\Network Persistent State

MD5 c71742f547e884e407e0db6ea48cd205
SHA1 8a1543bc3dfebe87c3a570ac9d0ccd1ad7839dd0
SHA256 41b340fafd809ad87db175a82196d70493e2456f8cd111f2ea98820e38505334
SHA512 87d325508e01b777786fb60500cb1fc564082e8e691c45b500d7dcd9c2071791d825014a38c0604d71aa51bd7f5ec1234457d34b93edda4901748584ca2d71f8

C:\Users\Admin\AppData\Roaming\Launcher\Network\Network Persistent State~RFe58918d.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Programs\Launcher\ffmpeg.dll

MD5 88e0c3b254ae239442ca452aa0357e48
SHA1 94507cd72b2bbc380098f1a356336fcfa310b5df
SHA256 a8822ed1cbb74301ef1f801407abf694637467efded1b523fcef97176ff5afc4
SHA512 e7ae821602211e6bf93e166cd9da234ce26cbaf20c27a64f9232625f0f918d60a1ae74d571d4c322a9f4f6051d951b9248b111c8dfabd815c36ea54c43a007f4

C:\Users\Admin\AppData\Local\Programs\Launcher\Launcher.exe

MD5 aea73146244c7bbf3aae008fc8f3def5
SHA1 7fdb83f2cf69fec84f64eee78874490f6f76f813
SHA256 2115ddd3e2813be531fe736e232912e1fc885c2bb26c0b4c7ae3deefc30ffdb6
SHA512 c2a6b807a164cb7ef67e3b719e1f6f036ab2f447224cf3117206340464b884d4c7e1216e6932a9e329748d463f2a826f9150a7796cc46082a80b31c9d60953d8

memory/3068-842-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-843-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-844-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-848-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-849-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-851-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-850-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-852-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-853-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

memory/3068-854-0x000002B6224A0000-0x000002B6224A1000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

144s

Max time network

155s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\hi.ps1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\hi.ps1

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4c4 0x4f8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

memory/3692-10-0x00007FF936720000-0x00007FF9371E1000-memory.dmp

memory/3692-9-0x0000020933540000-0x0000020933562000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tyb52i3c.2ux.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3692-11-0x0000020932A10000-0x0000020932A20000-memory.dmp

memory/3692-12-0x0000020932A10000-0x0000020932A20000-memory.dmp

memory/3692-13-0x0000020932A10000-0x0000020932A20000-memory.dmp

memory/3692-16-0x00007FF936720000-0x00007FF9371E1000-memory.dmp

Analysis: behavioral30

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

118s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2080 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2080 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2080 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2080 -s 92

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240215-en

Max time kernel

117s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 220

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

120s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 224

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240220-en

Max time kernel

136s

Max time network

136s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f508fdc065da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000d64b8a63607a7b0cf82f10ab8853d13c7730d3b4858d6f7982ae437d55f50c9d000000000e800000000200002000000084af7b9ee082910a30c7136bf0cd60baf23727153982abba981b5338ace7bed690000000bb30d9402d4896d323e7bcd64bbef3c4c4a0331bb0a87256dfd5045a0b139855f679627bb99ed0fd612c5f15b0a35eaaa307886682e68c4c9d393987f4eb25c269b22afe274f8103f42ff64292179ba406ccfcd0cc831d03eb4e303f0d0cdbde4b3d88f226223c7de04c49892ed6cb14363b6411aca417732a28f81e978cdec44172827f8b6eb1d785498010ccb27270400000005c0dd6a7bf760fa3976d75ee526a13b03a3eb8893ce34df253fe6351d848f44a2a8e0505b6de119d3d7778be8c33d26b6bb4a1bf7ecf69c0c5811c3c4ce81047 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414790087" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000db73629d0747550cca2095d7d2c908b43012838da68d3e2073d202a28269e948000000000e8000000002000020000000ad2ecb0a417892ba458d81b7ffc3f33cf30e568267f51d152249f73499c37f2a20000000adc56f5df44dae8f56926fbe696cdf50f382d088b950677ae13066e4deec1b8140000000726b9a1562280b615b6da9e7e78fb425de7a4622c76368e2203c9a9d1b2dd5a7ce08ebf568272f2ee7ee3c3681a8ffad9a188d69fe491ed26d2feb84a60dfa05 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28542E21-D1B4-11EE-BB01-66D147C423DC} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab4BA3.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar4C71.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c0f1927cf163d160c26f72805ac1adc8
SHA1 0b1b0bb949375eabb89c0fe14d1d9f16a43df419
SHA256 f91503ca887158865d3afdefbece8ea093f470fa3f3d1f2d87bd417cd4032ab4
SHA512 2cbc2c9ddf686334f5d1114ccd21ff03ae6782aa695dc069ebe91a822b5dfbef1824103ae7244bcfcccdec7a2168b1c51ef1406e6e319158785723967198ece5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f3343d361cb41b739a0ea6908367fed1
SHA1 c979dd4ef55f710469b07c3822ed8142b44ba891
SHA256 ae3ea0adf5355b00d4427e9d8bfeb20a72180ec04e5b807e706754840e302cfc
SHA512 c21e852c33720ca785a6b0605154987e4bef02a1d634383e530b81ebb7a948e464ea455fe142d17b29d32f32b777308352f630cc09230b5e50015655669f73f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a455aa09e1a9605be1d59a37fc30172e
SHA1 d300a008dce139eaabf8815dd30da00f6b6fc263
SHA256 8496952501a1fb09d6439ec5525a3273298d059c038c8fa7309ac2fde67e2b47
SHA512 4203a4d63b8842bb3cfa99d7ec45cd6896ec90ab7011f282283ea83702e6f93cfe08d86c5c7758a3783f6b4c925d10fb746a611d0d305d3e752d856403c63ff4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca97b4c2bf7dd12c4782c72afb73a21d
SHA1 79032344a6587875be84279fd1679ee0a6a37cb6
SHA256 86cb3ba107520e000a1b872329ce4a2b84f0e31719f805e57534b4be770e396a
SHA512 e02485d89a5fbcaaaaca9079e5e39d02414836493ec8de91fe78a20b8c1399b099c7cf75b27c44ada8273c9cb88eb085a66b29ed2a2c27edd772510e723c02fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3563d99762de9bedd97fdbe91b2a116b
SHA1 ee6f06256b253ad5265600d84bfbce636f3e7b12
SHA256 a0cf6eaa1148164a4002b125c742fd894aa78b63e1376e11e4bcbf8c48fa91d6
SHA512 29aa2f40f0cc2de5bfed8d5a08ce0a4d6d6a58b7c9820e07efe5a66b92b0a4ec3bd4728b6de7629d7ee9ec58d2693f9e9ae233ef0245525de72e0b46c1ecb9a2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec45102dfed852a3c7681a9761fa808a
SHA1 22b3bb24f456443ebdd9525408ff98bb9df0bdcd
SHA256 4cdbdb21eff1586405b2b6efecef7ef1ae0a41cd59c32b59b60eb97955eaee05
SHA512 8b216d564d12cdb5679bfd582a2672ec1717a18dc7fbab3adfa9478b25cab796f59a9af0d139b03e2253d9d80e74ba041c9993ac4da520d946b467f7ec344a5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b442a5f58607916efb2b58beabe5906
SHA1 4b3f4b9deedbf5d80378a36fe76b3eff860bb940
SHA256 741bacacac58b12f4922220bdd32c52da0045898b3b2ca78a06f4baadd920756
SHA512 06cf10f708ffc8c628449fdae1410b1f8c42bb9a3a8be1074a380a59b898d288bdf7903a1251caa347616e425fb5ef8afc0795eb43306ba890d494b2177c5c53

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78d6374de6f4cbd87db8743e773612a5
SHA1 a35b8e2551fc863b716f2f1571550bb47ce62621
SHA256 fb0539dda1b17b461998519f6ef0c3fe7985913f5ae2445f42c09905301f8a9a
SHA512 e962a1a1ea68f44f84db732d19bdb573343eadc0cec79d9e4c5ce631297e44d53c39bc5df8c92bfad1c9213cf1e0269c10eead0cc6cb560a3402ea85b2b30c91

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 acd5e29e1432c997167c0e7fd2d20cea
SHA1 8aa77015cdde8b1a7c9a82affa1b2b0377344742
SHA256 f91c2d2d653dfe406aca23f8a038610b5e3544e14f021f8ee2eb1b019d7761ce
SHA512 717bc6ff6d8786d66d24dc9d3428fc204fd8af2c3af153b34b937ec5641a85e41cec7912a914d0ce9ea19ed475f4490aad85540def9aaec47107b6a8afc3392c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 05640183c8bbea141c5fa1dbc93870de
SHA1 c3b74bea16fdf4ab28412e84e48288dffc1d62bf
SHA256 e94ad2f3fc7986318464bcf4b7a4df8e2a1326b4d88eaf40e495d47e9e588e7a
SHA512 e612017651c9b8ba874f016b67ca6cbe2f7ab53647e2150d440ed3124dd6c70da8b92404e1dd83dcd39d2990f915f5b464b28b7e5022dd92ba7be6bdd8cd6b49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2bfbedcb08ba657796b2c80edac5c12
SHA1 dfbf6680e65724d9274b955599a7be0fcecb945e
SHA256 bbc3712ff25c39601475abc6ee2ae116128280b8d526b04db59f7480f9148b6d
SHA512 04dbd20989cac83606f2ae57c0f57cf4af6b9a217ebfe987919f5542d1fd9afc622c3ff08cc2be617f9864e93ff067ebf69513eeeac79548845a642e35280ab1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8f1c0964b47986f73477137631c246b1
SHA1 5a5d2977688fa6d2656669e459360553f32fbde9
SHA256 0e9e0f75b68a1350c982a69ca68f43da05775412a22c9da105e30441e3dcc005
SHA512 ec5d4c0e07d4eb8018614edaa7ee26bc70876f2b66472cd76f413adbe69d65ca0832b3b9ff0a654cab8063b9f9fc48e3c7e151f2713eaeda2a3a231590c994e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93a3aae3de6508f56967013ec4c72afb
SHA1 eaef26c6a1fa43f8b15fc343aa04822dba92ffff
SHA256 f62a3589a8904ea9f57af10fad1f3773ebc1fdf7161db7f34c240ea9f2291d6f
SHA512 8ac7cf3f65647c54a484761a7211c509c93257192180b63e1f3b46a5812d8a570c627a442bc7cf42578e7c329811c43bca1fceccd193405dd67fe32b32b3f497

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 00f2a4c438fb050e9196b4800f443111
SHA1 c7da5e3a7fcc65468cb98fdb36ebe5281a91a4ac
SHA256 7fb6421e557e477d93147a84eb181e860394a6c966506132d8714e279ac35d0b
SHA512 f11effa67889a0e0d5b530fafb8c0aefa78e1ce6d21c54c7bf3e3aa1184e7c9a9d074a3709251cf3ab2c65453dca258d935308edd4ee0f53207b1c5f80e05716

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 70377b2869d32dbc7f7468eac34b6cbb
SHA1 a8b22be7dc2a685a46e3211f0b6940473528b696
SHA256 10b2976007c2daf2a4f2eff83f0e83e2d3ca31f5e1b6a865d83fbf1945d2f4e0
SHA512 bf8839ce5f8a0dc9fa32ba77fdd9f0b577b855492a4204df5f8800c2cd9fadae0ee1d67f329c9caee5e00f3d021de1cfb35745964d4985bfe8c13472af13f061

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d1af088e8dd33b1ad2ef7218b375bef
SHA1 d913b7fc5139d218be9060acb3152186432c51e8
SHA256 f23853855c7a05d3b025f02f7e08edf7ee94e7e29655d27807025490e08011ce
SHA512 22a7daedf7557c38028739c6ed47c6a14d3ff64dc39eba0b8a473fef2cbc9915e8cce81987d66d4c3fe39cf074b792f71c3d55246b26f86e2a2b4ca979361f9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 241aed1952036f1a4672452057a0e7e6
SHA1 6d13c8c1c539237f7cd4831ffdb4eae541371eb0
SHA256 8fc3baf771b4a920db6643a449cb9c413432661ccd7b4c78836b467a01302c75
SHA512 781e770f0fd383a0387bf3a71000da55e28b0bf6033bfd3f15935d1af61570e8d2ccb1013a9a32be4719dcb13b3f6c4dfc73534713763c456f1532c983c091fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e4c33952c72c63199389314c90f8a25a
SHA1 f54c0b0e9f878aee34560abc7df91a6b8d4f8671
SHA256 e5aaf438be488bc91cb7a5782e138a0c30926a4f4f41761443313f2042069e21
SHA512 0e047bf6ba58f681a1c2f5c6315939e07c0112f5dde27494a5dad5ca7da33026ab894491f1522acfc91a277bbd1abed465d72959b20794f5884123d387200ea7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eea661ed2e333c64bd2eb6fb29631027
SHA1 d02a48d65ac74e7611868aaedf6131aa856264ba
SHA256 931f15f98cce2ea8fa8947a0d1fd2f23ed15f3150aaf844bd266e8fda6a92050
SHA512 80dee15a53d946ff6bd55a256a22dd62f017c4f0d529db71138d33636ecb3bba3e100a8f833265902f176c1978ed27d9fc23216b8797d4791dc8a2f57430aa61

Analysis: behavioral13

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

7s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 2828 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=984 --field-trial-handle=1092,i,1788158163437963443,6669828850419296866,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1512 --field-trial-handle=1092,i,1788158163437963443,6669828850419296866,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --mojo-platform-channel-handle=1248 --field-trial-handle=1092,i,1788158163437963443,6669828850419296866,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1508 --field-trial-handle=1092,i,1788158163437963443,6669828850419296866,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.gvt1.com udp
GB 216.58.212.238:443 redirector.gvt1.com tcp
US 8.8.8.8:53 r4---sn-1gi7znek.gvt1.com udp
CH 74.125.108.201:443 r4---sn-1gi7znek.gvt1.com udp
CH 74.125.108.201:443 r4---sn-1gi7znek.gvt1.com tcp
US 8.8.8.8:53 swapinclick.com udp
FR 195.35.49.154:443 swapinclick.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.184:80 apps.identrust.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google udp
US 8.8.8.8:443 dns.google udp
US 8.8.8.8:443 dns.google tcp

Files

memory/2632-1-0x0000000000060000-0x0000000000061000-memory.dmp

C:\Users\Admin\AppData\Roaming\Launcher\Local Storage\leveldb\CURRENT~RFf76aa43.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/2632-36-0x0000000077670000-0x0000000077671000-memory.dmp

memory/2828-56-0x0000000002560000-0x0000000002561000-memory.dmp

C:\Users\Admin\AppData\Roaming\Launcher\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Roaming\Launcher\DawnCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Roaming\Launcher\DawnCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Roaming\Launcher\DawnCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Temp\CabB897.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarC00A.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d56c95e2082ae944d69b078a71c73ae
SHA1 a59802c89557ba9a31574e5caeb50a9ce8513d46
SHA256 b3d19fffcbe78c2ea8042e6cfc7335bec84f9713ff38ee6e867d650b7153abd7
SHA512 5fa72202513d98c596670c90df1cb235bd9e0e5a64513e5a5e3bc5257770c2522fed8ccce8cb2bc815c263cc85d49d4b71f8dcef83d06ba2d1df9aaee30d0e50

Analysis: behavioral14

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

152s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5024 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1612,i,17469481753974594601,7079724724039943215,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --mojo-platform-channel-handle=1976 --field-trial-handle=1612,i,17469481753974594601,7079724724039943215,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2412 --field-trial-handle=1612,i,17469481753974594601,7079724724039943215,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2676 --field-trial-handle=1612,i,17469481753974594601,7079724724039943215,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 swapinclick.com udp
FR 195.35.49.154:443 swapinclick.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 154.49.35.195.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp

Files

memory/5036-6-0x00007FFDAB1F0000-0x00007FFDAB1F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\Launcher\Network\Network Persistent State

MD5 39ab0912d0ba476f65236d99ab7d0b53
SHA1 0e30543901e29d86a7e9f0b122b4ee986f230056
SHA256 383542abb562734109773769f5b9b8b14801f0cdb5528cb3364207a852ddcf6d
SHA512 c09fc3d3625146721531867d06aa4091d8476f23543b3606368cd851d8fa69c2c15a91a122908278d272f5b1c983256eb4c0c9c59dacf23921a60d8be4bb7f63

C:\Users\Admin\AppData\Roaming\Launcher\Network\Network Persistent State~RFe5922ff.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

memory/8-77-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-78-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-79-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-83-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-84-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-85-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-86-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-87-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-88-0x0000021925E90000-0x0000021925E91000-memory.dmp

memory/8-89-0x0000021925E90000-0x0000021925E91000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

117s

Max time network

130s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

144s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

120s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 224

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

92s

Max time network

114s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3960 wrote to memory of 1584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3960 wrote to memory of 1584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3960 wrote to memory of 1584 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1584 -ip 1584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 96.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 224

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

92s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4196 wrote to memory of 4592 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4196 wrote to memory of 4592 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4196 wrote to memory of 4592 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

122s

Max time network

137s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240220-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1884 wrote to memory of 1664 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1884 wrote to memory of 1664 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1884 wrote to memory of 1664 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1884 -s 88

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

122s

Max time network

128s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\hi.ps1

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\hi.ps1

Network

N/A

Files

memory/1276-4-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

memory/1276-5-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

memory/1276-7-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/1276-6-0x0000000002860000-0x0000000002868000-memory.dmp

memory/1276-9-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/1276-8-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

memory/1276-10-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/1276-11-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/1276-12-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/1276-13-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win7-20240221-en

Max time kernel

119s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

133s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 188.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-02-22 18:53

Reported

2024-02-22 18:59

Platform

win10v2004-20240221-en

Max time kernel

139s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

N/A