Analysis Overview
Threat Level: Known bad
The file https://github.com/expl0int/EulenCH3ats/tree/main was found to be: Known bad.
Malicious Activity Summary
Lumma Stealer
Executes dropped EXE
Program crash
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Checks SCSI registry key(s)
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-02-22 19:18
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-22 19:18
Reported
2024-02-22 19:23
Platform
win10v2004-20240221-en
Max time kernel
301s
Max time network
295s
Command Line
Signatures
Lumma Stealer
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe | N/A |
Program crash
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 | C:\Windows\system32\taskmgr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\system32\taskmgr.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName | C:\Windows\system32\taskmgr.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133531031056740817" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/expl0int/EulenCH3ats/tree/main
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffff0fe9758,0x7ffff0fe9768,0x7ffff0fe9778
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap17653:94:7zEvent14581
C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap10744:94:7zEvent9969
C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\EulenCH3ats-main\" -spe -an -ai#7zMap30431:94:7zEvent7029
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3776 -ip 3776
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 1152
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 748 -ip 748
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 748 -ip 748
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 636
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 1068
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=744 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:2
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3912 -ip 3912
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3912 -ip 3912
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 1096
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 1088
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4936 -ip 4936
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4936 -ip 4936
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1092
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1132
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2076 -ip 2076
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2076 -ip 2076
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1160
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1096
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3192 -ip 3192
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3192 -ip 3192
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1100
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2968 -ip 2968
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1196 -ip 1196
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1196 -ip 1196
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1068
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 716
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2968 -ip 2968
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 628
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
"C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4552 -ip 4552
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1112
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4352 -ip 4352
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4352 -ip 4352
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 1176
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 620
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| DE | 140.82.121.3:443 | github.com | tcp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.githubassets.com | udp |
| US | 8.8.8.8:53 | avatars.githubusercontent.com | udp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | github-cloud.s3.amazonaws.com | udp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | user-images.githubusercontent.com | udp |
| US | 8.8.8.8:53 | private-user-images.githubusercontent.com | udp |
| US | 185.199.108.133:443 | private-user-images.githubusercontent.com | tcp |
| US | 185.199.108.133:443 | private-user-images.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 202.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.121.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 191.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.110.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| GB | 216.58.212.234:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| US | 140.82.112.22:443 | collector.github.com | tcp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 140.82.112.22:443 | collector.github.com | tcp |
| US | 185.199.110.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| US | 8.8.8.8:53 | 234.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.112.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| DE | 140.82.121.6:443 | api.github.com | tcp |
| GB | 216.58.212.234:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | 6.121.82.140.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | codeload.github.com | udp |
| DE | 140.82.121.9:443 | codeload.github.com | tcp |
| US | 8.8.8.8:53 | 9.121.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.71.91.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | sideindexfollowragelrew.pw | udp |
| US | 8.8.8.8:53 | gemcreedarticulateod.shop | udp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 8.8.8.8:53 | secretionsuitcasenioise.shop | udp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 8.8.8.8:53 | claimconcessionrebe.shop | udp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 8.8.8.8:53 | liabilityarrangemenyit.shop | udp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 8.8.8.8:53 | 171.80.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.16.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.58.21.104.in-addr.arpa | udp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 8.8.8.8:53 | 52.182.67.172.in-addr.arpa | udp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| DE | 140.82.121.6:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | sideindexfollowragelrew.pw | udp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 8.8.8.8:53 | 137.71.105.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | sideindexfollowragelrew.pw | udp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 8.8.8.8:53 | sideindexfollowragelrew.pw | udp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 8.8.8.8:53 | sideindexfollowragelrew.pw | udp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 8.8.8.8:53 | sideindexfollowragelrew.pw | udp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 104.21.80.171:443 | gemcreedarticulateod.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
| US | 104.21.16.152:443 | secretionsuitcasenioise.shop | tcp |
| US | 104.21.58.31:443 | claimconcessionrebe.shop | tcp |
| US | 172.67.182.52:443 | liabilityarrangemenyit.shop | tcp |
Files
\??\pipe\crashpad_2512_IYAFMHMWAKAOQCTP
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 8e0a3d48bbe9b38c9affd7e46140d9e6 |
| SHA1 | 6cf2a637a61f21f4afb209c64caa94c3cda5f344 |
| SHA256 | 2e59ff55b5336d6f7e9a3b066acd40d737f0d45861527e1bb6a42736a1703864 |
| SHA512 | b2aae26bb81c1138593cf36253404674b140afcbecfebe9b637fbb67cf35cd0750e2552d5e3049c62733084f50757af9c044a84f6f907b76d4a38c07eb9a750d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 1d41eb9014d17f8df1b5971a9e95cdb1 |
| SHA1 | 388ae540f66ef313905b9d166d57ca8f10bc6781 |
| SHA256 | 009eeea7eafd69a6d0bfaf77b59238b17c1f4f36c2b54592dadf1322d9b7000e |
| SHA512 | 3f7a1333a6f72c107be5535fd3c1279719528637dbfa40f5b6de4103fe52236b7e070848a4f7736427b6211baf70cda9417fb99c392643520bb48e4046ab175a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 390a34f9ed12c28b518006befaa4bb24 |
| SHA1 | 6bd6efcbf459c21aa6d0d426c4b7f803999581d8 |
| SHA256 | e011966f189ddcb4c62d39dd5557a6f77dadf60b465f6da835dc5856efe06bc6 |
| SHA512 | f1f9ae5929760c60d0ff3fbe2b77490028a568a4a7be06fd37b53218b2dd1cbbc31b734368e2605fa5b516007087441c8d628401beaa057f9a132f7b603a4719 |
C:\Users\Admin\Downloads\EulenCH3ats-main.zip.crdownload
| MD5 | 60078848bb829962adaaad92b2117d27 |
| SHA1 | e4cb1688eef1f97b85274dc0f7909fcc7e36498d |
| SHA256 | 4a965fe0bb90182c9ab828610a278b4a2e9707fed38fc6e1a2c3ce086de8638e |
| SHA512 | 8715ad5232bbd3e65db1f091b633c67c684803dea64fe5cf05f27746e645857ec7570a3294d7ba6a1a75b537892548fc64ff76fa491d0e071fa063d6939c0e1f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | d5bee06667e7aa655b359d52ec0d3301 |
| SHA1 | efc1125f30c175ca7503a1ef1d92748e2f7bb93d |
| SHA256 | 6b1cc0671bc672a81391f7f938374410c4b80db491a26ffcc28e46a08213c60e |
| SHA512 | a5798278bb20c00a7a6c86d6141b1b2d59eb93f0fc61616adac71bd5bfc8f1220e82b60449c9a20fc4dd7930a491b0bb6c2417689ec551c66af2cce50b08259f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | eff09f2dcd2368974ad31025571f58a3 |
| SHA1 | 4db7b09e6574bd53059564ef7a9f26330fe307ee |
| SHA256 | d32500e14da67f98426808b4850d09333f8ba101698c670fe515497ee6967bc4 |
| SHA512 | 0de2e2ffa396cdd5882f47d652ec757fccef437dc5798d5b7d627a16f5983825aa85cbbe011cbface03894ba9820197acc30b4db4cb1fbd29d13cc4dd1b3c660 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 9355e196cbacc31c93d9d2fbe97173d6 |
| SHA1 | 63551a5b3bcc9e1bb624f7ca27b3bcd807538099 |
| SHA256 | d5652151b7205cc0b5aca977c1f77f748920ea0d907caff5f2c7a6f9a427a0db |
| SHA512 | 43211aac97147bdd1d7639914942b7b362c5ce0048b8c7c94832c1ce5d65ea8dc5dc47341cb7885e3a75fece940c6d24f6893eca2a8e2eccfad13409711621db |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | a95eb84344c7aca576fb16b1e2c003de |
| SHA1 | 88393452e0c6c5f5525ddccb91fb37e39ceea584 |
| SHA256 | 897dca5aaeb3e253684664b0077fbb1ae7c65d437dd897a104e2d894de4491c5 |
| SHA512 | df30ab32bf6c3aafe52e40c5dc4c3a4cba91afcf78a65e928651cd6ddd376f1373f3df82075ffe2840c778864f801e0e3db768e08f6a8e89a53059a073482c8e |
C:\Users\Admin\Downloads\EulenCH3ats-main.zip
| MD5 | fd7d8264aedca99b0993640204c9508e |
| SHA1 | 7a6febefeb6a337a2f33e3a56ba08ad2a95de2ab |
| SHA256 | b87457606eba26db8ff83137a1a40d96f10d33fadd6728fdbcfdb248f6a03968 |
| SHA512 | d48c41078a7cab04ea22a94f8ebae6eb6ab6c7e1a147fab344a977d860f02945331f6af049706ac6d2a667f36a8d95b8a4a676cc35e1a77afb6673021823896e |
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
| MD5 | 4cd0f11f37b1c910b998e1c78d7fbc1a |
| SHA1 | 9b1cfea8434e44a7853d392ec99a532c8722e803 |
| SHA256 | b54eac653edbbcee1b2d5fa082d618b0a582ed6f54aaa835e6509363aff6d106 |
| SHA512 | 823ce10362882fefda9a7dfa72ba98e9ade4fc64db512cfe40e71d12314cacdf6748df259ffa48338cc20e6819a00ad432b50de1334d7c81ca4767e6f75fba27 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | a3b9ce5c61846ff24e80fbc8fa923c33 |
| SHA1 | 714509858668d3cbdc247197d6515e2bd3d7f25c |
| SHA256 | 6f3b2e15f038aaadeae32aed2460ed97809b6f58bf2e2af9fc8f62ab95c06aa4 |
| SHA512 | 40b4c663eb2a2aa422f26416969e17fbab97da3e5d9e8f7ee268e371460b5ff7eef833bee71c5e38b569b34dba53e2d2e58bd9a37f78575dd9cacbfc095febf2 |
C:\Users\Admin\Downloads\EulenCH3ats-main\README.md
| MD5 | 8dea87a2d66c58832a0d82b7b43540c8 |
| SHA1 | d5151a05efe6978f634bf5d5e330ffce9694414d |
| SHA256 | baad6357cb00130d3d25c8077ecf053c50ea9860e712207ebc72bb4bf351b6c0 |
| SHA512 | 3dae0f7f7a967670fc59cc2b3b9688b5cbbf9f0f541e7503511cb95d59e871dd5b7517db7657aa56ae60dbf147a61ed8174e43d6cdfe53665bdf080f38cc7e4f |
C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
| MD5 | 9ed99bd8432a2265d1f5fb611213168b |
| SHA1 | e215f6bfcbc91ed8828ef54cb6840eae1dc72cd0 |
| SHA256 | dde02744526968833651a9f70be666ceec221599b03272c9c5fc5d729667dd72 |
| SHA512 | f75b9ad6823ae8c4e4f5c84202893ba60c9256853d8b3924d47d59a1668e979e485a920b43414b470c5e5fd02975ff81edea3c9a2ed3a16140c13170224f2f28 |
memory/3776-245-0x0000000000E10000-0x0000000000EA7000-memory.dmp
memory/3776-251-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/3776-250-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/3776-252-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/3776-253-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/748-255-0x0000000001380000-0x0000000001417000-memory.dmp
memory/748-260-0x0000000003070000-0x0000000003071000-memory.dmp
memory/748-261-0x0000000002EC0000-0x0000000002EF2000-memory.dmp
memory/748-262-0x0000000002EC0000-0x0000000002EF2000-memory.dmp
memory/748-263-0x0000000002F40000-0x0000000003040000-memory.dmp
memory/3776-264-0x0000000000E10000-0x0000000000EA7000-memory.dmp
memory/748-265-0x0000000001380000-0x0000000001417000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 3056aa9759a4cffa2d514d3dd195255b |
| SHA1 | bebb32331ccfdc65f65f9f0cb57bee9569a8909f |
| SHA256 | 7ed8ae2c939ced4c9e339d7e7662a897bb538c24283afee857a9fcc616c6ca72 |
| SHA512 | 865932445c1a6ca9fd7f8b60864ed0f579f94de2009ff68697c2c823bbf993624e154179b42335e096577d676e51c4dba9c223b824412a6c0a081ea13c0d46c9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 101bc1995ff37a2ee7219bab0f52f53a |
| SHA1 | 2d43332564f10dadb98033779a76f809722b81c7 |
| SHA256 | 66c146916fbc9ddb87cb6f61aa7a0358069a6f77a4680f56cb2032534f154f1f |
| SHA512 | 1d1418603031645f5d16ccc5772d16ea6d83fb39bf7ac6feb060c483f1c625758813c283ce7d2623e89c2de31978b649190fc4deea760a4d2a07126d22f7c3e9 |
memory/3912-290-0x0000000000150000-0x00000000001E7000-memory.dmp
memory/3912-295-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/3912-296-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/3912-297-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/3912-298-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/3912-299-0x0000000000150000-0x00000000001E7000-memory.dmp
memory/372-300-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-301-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-302-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-312-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-311-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-310-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-309-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-308-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-307-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/372-306-0x0000023FA8690000-0x0000023FA8691000-memory.dmp
memory/4936-315-0x0000000000AF0000-0x0000000000B87000-memory.dmp
memory/4936-320-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/4936-321-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/4936-322-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/4936-323-0x0000000000AF0000-0x0000000000B87000-memory.dmp
memory/2076-325-0x0000000000B00000-0x0000000000B97000-memory.dmp
memory/2076-330-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/2076-332-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/2076-331-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/2076-333-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/2076-334-0x0000000000B00000-0x0000000000B97000-memory.dmp
memory/3192-336-0x0000000000EA0000-0x0000000000F37000-memory.dmp
memory/3192-341-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/3192-342-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/3192-343-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2968-345-0x0000000000B30000-0x0000000000BC7000-memory.dmp
memory/2968-351-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/2968-350-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/2968-352-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/2968-353-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/1196-355-0x0000000000FB0000-0x0000000001047000-memory.dmp
memory/1196-360-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/1196-361-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/1196-362-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/3192-363-0x0000000000EA0000-0x0000000000F37000-memory.dmp
memory/2968-364-0x0000000000B30000-0x0000000000BC7000-memory.dmp
memory/1196-366-0x0000000000FB0000-0x0000000001047000-memory.dmp
memory/4552-367-0x00000000008D0000-0x0000000000967000-memory.dmp
memory/4552-372-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
memory/4552-373-0x0000000000BF0000-0x0000000000C22000-memory.dmp
memory/4552-374-0x0000000000BF0000-0x0000000000C22000-memory.dmp
memory/4552-375-0x0000000000BF0000-0x0000000000C22000-memory.dmp
memory/4352-377-0x0000000000650000-0x00000000006E7000-memory.dmp
memory/4352-382-0x0000000000C00000-0x0000000000C32000-memory.dmp
memory/4352-383-0x0000000000C00000-0x0000000000C32000-memory.dmp
memory/4352-384-0x0000000000C00000-0x0000000000C32000-memory.dmp
memory/4352-385-0x0000000000C00000-0x0000000000C32000-memory.dmp
memory/4352-386-0x0000000000C00000-0x0000000000C32000-memory.dmp
memory/4352-387-0x0000000000C00000-0x0000000000C32000-memory.dmp