Malware Analysis Report

2024-12-08 02:57

Sample ID 240510-2e52asgc62
Target f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7
SHA256 f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7
Tags
discovery execution privateloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7

Threat Level: Known bad

The file f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7 was found to be: Known bad.

Malicious Activity Summary

discovery execution privateloader

Privateloader family

Checks computer location settings

Executes dropped EXE

Checks installed software on the system

Loads dropped DLL

Program crash

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Enumerates processes with tasklist

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 22:32

Signatures

Privateloader family

privateloader

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240221-en

Max time kernel

118s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

158s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\resources\dist\pages\cantLoad.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4088 wrote to memory of 4776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4692 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4692 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4088 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\resources\dist\pages\cantLoad.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7fffff8646f8,0x7fffff864708,0x7fffff864718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15518471572850739528,9279813956416945936,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 88.221.83.225:443 www.bing.com tcp
US 8.8.8.8:53 225.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 bearly.ai udp
US 172.67.74.15:443 bearly.ai tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.190.80:80 apps.identrust.com tcp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 15.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 80.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_4088_MSFAQUXEMQSHXIPI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 09dede89998fbbddb3abc0079187e749
SHA1 04df3ee133f39d322c60a458a88bb4e72775c566
SHA256 f399be3b8ce4271ebfc3a38e9496ed7b55079239ac513757d40163a125e4234d
SHA512 857a74d539f3a3c7df07acc12b7c67e66c2f70be540410b5f5ccfb0fb5fff02121fb1872dbca1690d0dfffeb2bd84dc1661a3bcf0f3860fe844425fac2906641

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2bb58b72185d275e47d5aa304b4636fc
SHA1 a8a8480f5ff69e0a827f28396fcc6c10d4edb1b3
SHA256 24bf0c3fd7c33df557f1603b553e4e7c7ad8ce681213432579650f81e7f9cd20
SHA512 f3a6ae511471a5a8002195ef4dd5bb277060334d0c061b72feb30aa1dac336ebbbf6bc5ca56a4cd65d8efd5af33f685701564e1d0c75413748d1eb9283939f3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f3849d6c4e85d258b5c3407960eb3b45
SHA1 f8928875d1154e23ce255b2a0144479bd32a0068
SHA256 61886754668a5b71296fc6afbc2d8f00c127dd6b86418f0db538bc21700c5955
SHA512 2b5e325d530a8e913fab169e4a24b2515dcb5e84213959b6eedfca358b9766c0ea22a4faae3937f7c638125e6d4ad13b4d0795932e099daad3c96354d53b11fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 3f212b144e58e2c4aea6f7c66bb9997a
SHA1 87ab8edbe90f6808e883c1d0d0da2e4eb594fa06
SHA256 8ce5e24c749bc7e7f76e8839b38a4572c9d522cb566a0f3f0cd6ff483f7b2c33
SHA512 e688704b98f55fb418b04c9b25bc89f4809b9e352ea97e859822f7b00bfd9c08a6885796bff62edf57cc3060213f01cca0edce59cc096a4280ea06eebd87d4ff

Analysis: behavioral29

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240426-en

Max time kernel

141s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
BE 88.221.83.225:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 225.83.221.88.in-addr.arpa udp
BE 88.221.83.235:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 235.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Checks installed software on the system

discovery

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\bearly C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\bearly\URL Protocol C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\bearly\ = "URL:bearly" C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\bearly\shell\open\command C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\bearly\shell C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\bearly\shell\open C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\bearly\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bearly\\Bearly.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3368 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 3368 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 3368 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2204 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2204 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2204 wrote to memory of 1820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2204 wrote to memory of 1820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2204 wrote to memory of 1820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2328 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Windows\system32\reg.exe
PID 2328 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Windows\system32\reg.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 2328 wrote to memory of 6216 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe

"C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Bearly.exe" | %SYSTEMROOT%\System32\find.exe "Bearly.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Bearly.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "Bearly.exe"

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe"

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Bearly /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Bearly\Crashpad --url=https://f.a.k/e --annotation=_productName=Bearly --annotation=_version=3.0.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=24.4.0 --initial-client-data=0x478,0x47c,0x480,0x474,0x484,0x7ff78e90dc70,0x7ff78e90dc80,0x7ff78e90dc90

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,12389812939131991336,4261418783116921723,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2004 --field-trial-handle=1760,i,12389812939131991336,4261418783116921723,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Bearly\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2364 --field-trial-handle=1760,i,12389812939131991336,4261418783116921723,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bearly

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Bearly\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3468 --field-trial-handle=1760,i,12389812939131991336,4261418783116921723,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Bearly\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3624 --field-trial-handle=1760,i,12389812939131991336,4261418783116921723,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 --field-trial-handle=1760,i,12389812939131991336,4261418783116921723,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 bearly.ai udp
US 8.8.8.8:53 bearly.ai udp
US 172.67.74.15:443 bearly.ai tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
IE 209.85.203.84:443 accounts.google.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 15.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 84.203.85.209.in-addr.arpa udp
US 8.8.8.8:53 o4504114762612736.ingest.sentry.io udp
US 8.8.8.8:53 o4504114762612736.ingest.sentry.io udp
US 8.8.8.8:53 js.stripe.com udp
US 8.8.8.8:53 js.stripe.com udp
US 34.120.195.249:443 o4504114762612736.ingest.sentry.io tcp
AT 3.161.119.36:443 js.stripe.com tcp
US 8.8.8.8:53 exec.bearly.ai udp
US 8.8.8.8:53 exec.bearly.ai udp
US 8.8.8.8:53 249.195.120.34.in-addr.arpa udp
US 8.8.8.8:53 36.119.161.3.in-addr.arpa udp
US 104.26.10.184:443 exec.bearly.ai tcp
AT 3.161.119.36:443 js.stripe.com tcp
US 8.8.8.8:53 api2.amplitude.com udp
US 8.8.8.8:53 api2.amplitude.com udp
US 44.241.69.166:443 api2.amplitude.com tcp
US 8.8.8.8:53 m.stripe.network udp
US 8.8.8.8:53 m.stripe.network udp
AT 3.161.119.48:443 m.stripe.network tcp
US 8.8.8.8:53 184.10.26.104.in-addr.arpa udp
US 8.8.8.8:53 166.69.241.44.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 m.stripe.com udp
US 8.8.8.8:53 m.stripe.com udp
US 44.235.71.62:443 m.stripe.com tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google udp
US 54.186.23.98:443 tcp
US 54.186.23.98:443 tcp
US 8.8.8.8:53 48.119.161.3.in-addr.arpa udp
US 8.8.8.8:53 62.71.235.44.in-addr.arpa udp
US 54.186.23.98:443 tcp
US 8.8.8.8:53 98.23.186.54.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\chrome_100_percent.pak

MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\chrome_200_percent.pak

MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\ffmpeg.dll

MD5 d8cd1aca8dd3a91d0bf32da2e746545e
SHA1 6a28b357d93fbb3502bc386019899c9f3633b069
SHA256 5b831daa8515b3d1f346b481ec04f881a3fe728944e966624489d3a3872a40bf
SHA512 af70b88194539cdebf353df0927671babbd51f3cdb304cf31dc5c29d65dea1e38136d7389ba48aa0829855d62eeb740f3df12ab981153c7f2eb70ed1e74fbcbb

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\libEGL.dll

MD5 6426112edaa62ca308f7f32d26d4f6ad
SHA1 3edfd900da6a5fb1c67c41e18ea0ec9a2752ba2e
SHA256 a23882d8555d8c3f1d27ba39b0225d68bc446e250d19d36aff4ef65d221458a3
SHA512 f967dea3f18ab81c8ca72b722962944b9a874cfda4c95237e96b1e989ff3657a087957c1ff2c374616ed2e49a75f2786174ff8972a3447589468dfafaf4db582

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\libGLESv2.dll

MD5 b7214621f818dfe440ade5b2f3619519
SHA1 4b95d412e49f2e4c3ce71e10b2d76df3ab63547c
SHA256 59133f095f941eb8d6b3613fd08b98e6d84e8290f3f72ded6d98c8683582f188
SHA512 d8195862a8d6ca8de5aa4096ce1feabda3f8375279904124e80451ef22d1ae13e4de35487afe36996d0b51edc16c48ddda03c5c2b14f4bd5e465ed48e9e3d29b

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\LICENSES.chromium.html

MD5 312446edf757f7e92aad311f625cef2a
SHA1 91102d30d5abcfa7b6ec732e3682fb9c77279ba3
SHA256 c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
SHA512 dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\resources.pak

MD5 a8502a5d32543474520dd8cf1a871b60
SHA1 4b2b4e61a8105dd9583c12e9adfd307c113907c8
SHA256 b6420c40d7d9b4971f6c99a3fd108e10c7e4e6bb95fa655a5a1b00ff2bab36dd
SHA512 c73e578d9b8a990ad11c218c096fc8d8a5d283a3fee4388ef40b4140e14504498f3e376b4b86d0d789dd9cd1dc8957d749a86f59cdf199f85daa28490c129658

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\snapshot_blob.bin

MD5 840169fda65be2a18c85e7dd44ec6051
SHA1 5080736e613be6e11242d37adef740cac0bf8cd1
SHA256 80e58621229b4cb6104ce7f65ebce979a6ebe3eac750447d037660cec34ad0b3
SHA512 2e65ac47ff05830eb0942288daf66468fbd34a1fbc1010f0bcdaca873f4d110ae8f88e825dec7e86dcd7b11dee7a003c29350e3377abd9f886b028cdbb830644

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\v8_context_snapshot.bin

MD5 5a072b0edc88a0b18e1c56a307a341cd
SHA1 20ee0b6521e12dfc4f378eb8d5724456e22e90fd
SHA256 878046ea578d24595d060583cf8f9618aba37d23c603499068e5762dd5509aa1
SHA512 c3a51850d939eea9b5d8926795cdc3e56962ec9eeabb3b80ed62a9c77ae5d6b696528d03a469c212b99d83ec303367f3353cc0fff459e7e577254f037f8fd995

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\vk_swiftshader.dll

MD5 3eb74d173ef00f7c510b11e61c5ab52f
SHA1 13cfe224f966145d7f90640b080bef5dd4d0ff42
SHA256 0749491928a69673f17d39eb674f9a416e789e4fddec48ebb54714914343b48a
SHA512 423ab3765aa01cf39fa31d068ddb761ad93707cb06f57b4e674311c91c5cc9d238c231d1e6882f8d3525d16fea0d8f8db8d0a74bb55309f5a120cbe4a34e40bd

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\vulkan-1.dll

MD5 8439213fbb22a848ce814982d502bdc4
SHA1 6c5831de36a539c0689410b00f1b8aa1dc6f7c2d
SHA256 e69f794109b12523de314a471c56278cd921be58facbd18ec351685d15894cc0
SHA512 e4e570e5b98420d99634167e0d9f920cba27fc4b8e91c70cc4e5b33a4b3299a69ce9b294aae538aeb150135378978a6c7b0644a645b797ab230e185593c828c0

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\af.pak

MD5 7e51349edc7e6aed122bfa00970fab80
SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ar.pak

MD5 56f6dc44cc50fc98314d0f88fcc2a962
SHA1 b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256 7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512 594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\am.pak

MD5 c6ef9c40b48a069b70ed3335b52a9a9c
SHA1 d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA256 73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA512 33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\bg.pak

MD5 945de8a62865092b8100e93ea3e9828d
SHA1 18d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256 f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA512 5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ca.pak

MD5 01acd6f7a4ea85d8e63099ce1262fbad
SHA1 f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256 b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA512 2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\bn.pak

MD5 8feb4092426a0c2c167c0674114b014d
SHA1 6fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256 fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA512 3de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\cs.pak

MD5 a934431d469d19a274243f88bb5ac6fb
SHA1 146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256 51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512 562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\da.pak

MD5 bb5252dc6f0f3c01ce3638138bf946c8
SHA1 bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256 c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512 e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\el.pak

MD5 6922aaa87431699787c1489e89af17b9
SHA1 6fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256 800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512 367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6

C:\Users\Admin\AppData\Local\Programs\Bearly\locales\de.pak

MD5 ed329b35d10e81f55d611fe8748876f8
SHA1 0d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA256 6facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512 bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\en-US.pak

MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\es-419.pak

MD5 5321c1e88c5c6fa20bdbc16043c6d0f6
SHA1 07b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256 f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512 121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\en-GB.pak

MD5 0db7f3a3ba228aa7f2457db1aa58d002
SHA1 bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256 cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA512 9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\es.pak

MD5 e9fa4cada447b507878a568f82266353
SHA1 4a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256 186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA512 1e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\fi.pak

MD5 5518b51d4af7f1b9d686cbea28b69e71
SHA1 df7f70846f059826c792a831e32247b2294c8e52
SHA256 8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512 b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

C:\Users\Admin\AppData\Local\Programs\Bearly\locales\et.pak

MD5 a94e1775f91ea8622f82ae5ab5ba6765
SHA1 ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA256 1606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512 a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\hr.pak

MD5 105472bc766a30bb71f13d86081de68d
SHA1 d014103ad930889239efd92ecfdfcc669312af6c
SHA256 a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512 ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\hi.pak

MD5 b7e4892b2030e4f916364856b6cc470a
SHA1 b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256 093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512 ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\he.pak

MD5 93d9261f91bcd80d7f33f87bad35dda4
SHA1 a498434fd2339c5d6465a28d8babb80607db1b65
SHA256 31661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512 f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\gu.pak

MD5 7b5f52f72d3a93f76337d5cf3168ebd1
SHA1 00d444b5a7f73f566e98abadf867e6bb27433091
SHA256 798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA512 10c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\fr.pak

MD5 0445700799de14382201f2b8b840c639
SHA1 b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA256 9a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512 423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\fil.pak

MD5 3165351c55e3408eaa7b661fa9dc8924
SHA1 181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA256 2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA512 3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\lv.pak

MD5 e4f7d9e385cb525e762ece1aa243e818
SHA1 689d784379bac189742b74cd8700c687feeeded1
SHA256 523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512 e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\lt.pak

MD5 96602a3f3b59faa997a4d337889fa02b
SHA1 94593a270b0d84c006e0959bc136b6c4987dfd3f
SHA256 51db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512 dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ko.pak

MD5 b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1 050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256 ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512 b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\kn.pak

MD5 a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1 f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA256 3c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512 f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ja.pak

MD5 f47efaa76f5200a6c0c23c33684d7bad
SHA1 9b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA256 5b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA512 67d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\it.pak

MD5 7c981a25be0e02fba150e17d9669a536
SHA1 3af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256 ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512 445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\id.pak

MD5 bd9636e9c7dc7be4c7f53fb0b886be04
SHA1 55421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA256 5761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA512 7c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\hu.pak

MD5 b338dcb0e672fb7b2910ce2f561a8e38
SHA1 cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256 bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512 f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\fa.pak

MD5 dcd3b982a52cdf8510a54830f270e391
SHA1 3e0802460950512b98cd124ff9f1f53827e3437e
SHA256 e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA512 3d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ms.pak

MD5 9b3e2f3c49897228d51a324ab625eb45
SHA1 8f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA256 61a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512 409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\mr.pak

MD5 25f2b9842e2c4c026e0fc4bc191a6915
SHA1 7de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256 771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512 ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ml.pak

MD5 3b1305ecca60fb5a7b3224a70398ead9
SHA1 04e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256 c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA512 68fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\nb.pak

MD5 7576c2fa9199a4121bc4a50ff6c439c3
SHA1 55e3e2e651353e7566ed4dbe082ffc834363752b
SHA256 2a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA512 86c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\pt-BR.pak

MD5 a23c805ee4d3d67c811b50826ca25a51
SHA1 c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA256 62be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512 c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\pl.pak

MD5 61c093fac4021062e1838a32d79399c2
SHA1 84a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA256 58067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512 475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\nl.pak

MD5 bc41967b2ff493e7f151c7721245739d
SHA1 7606133ddbb58492dbbf02c03a975fb48da1e26f
SHA256 3dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA512 9e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\pt-PT.pak

MD5 acffa29064f40a014bc7fe13e5ff58a9
SHA1 5a0890c94084075446264469818753f699a3d154
SHA256 423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512 d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ru.pak

MD5 fc0e2fc09aa9089c5db75bab7a0754a7
SHA1 f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256 188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512 377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ro.pak

MD5 19cfc7c8f1a2e4a2de1f9f64475469bc
SHA1 bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA256 3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512 ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\sk.pak

MD5 793c442420f27d54410cdb8d8ecce5ff
SHA1 8995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA256 5a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512 291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ta.pak

MD5 a8beab6896018a6d37f9b2e5bdd7a78c
SHA1 64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256 c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512 73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\sw.pak

MD5 ee8da42ffe40fbb916c56390e2cd99e8
SHA1 6d824f56afe6b3605a881d2c26e69a46e6675347
SHA256 192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA512 7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\sv.pak

MD5 bbe0785c5f9591e8a1e7c4830fe949d6
SHA1 da4f3286079d50e1c04e923529e03e7d334c7fff
SHA256 0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA512 38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\sr.pak

MD5 cf160983a86b51ec42845f4e60ac9123
SHA1 4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256 ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512 b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\sl.pak

MD5 4d9d56ef0b176e7f7aa14270e964ec77
SHA1 515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA256 6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512 740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\te.pak

MD5 02415ded02cc7ac25e8f8d0e83365061
SHA1 5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA256 97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA512 54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\tr.pak

MD5 9f24f44cac0997e1d0a6a419520f3bfe
SHA1 edb61859cbb5d77c666aac98379d4155188f4ff5
SHA256 3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA512 65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\th.pak

MD5 293ad7c20c22d744e4db0fb001ec45bb
SHA1 486c9e0732306a45aceb633da2b3ded281197620
SHA256 d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512 ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\uk.pak

MD5 e4c4e3700469704b936460ca1a90fcc0
SHA1 e809990fc07a1d39fe623046382699e648e343c0
SHA256 29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA512 68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\ur.pak

MD5 d7ec7d551dee1e1ef11be3e2820052f9
SHA1 d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA256 05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA512 92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\vi.pak

MD5 9274866d7c6314f43dd63ed293293e25
SHA1 4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256 dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512 3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\zh-TW.pak

MD5 8f67a9f38ad36d7d4a6b48e63852208d
SHA1 f087c85c51bdbdef5998cfc3790835da95da982a
SHA256 92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512 623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\locales\zh-CN.pak

MD5 9d4f54eb5a12cf4c2f34f5f538dff90b
SHA1 c31b892ce78c733bde0571b6236170103cc9fe7a
SHA256 58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA512 46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\resources\app-update.yml

MD5 1f3fc4ed1c35754da78d76ac2355e681
SHA1 52a2ec4a1267e6b51fb9e376f38dd174799f57f3
SHA256 08c1434ebe835e19645d055993023f8b8048ef6025792bd2ce685ef33f34abe3
SHA512 155895169d921772c125922c82785b34e59ae0b35f909543bbcbb52b88f9b857d2997de335ea87cc4f582d8b928598de4addde423d21953d29d9e3e27932adbb

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\resources\app.asar

MD5 dcf84c7c6436284959898ff76df2601a
SHA1 d64896cf933ef8399c23f678e2b5529c1074e8f9
SHA256 9ab65922798b5f5c4056de45e44a5fdccc489a6321a3cabbfbd99d8ca9daa896
SHA512 1e1361c6ec01637d83e340ef4069f5043fec4aa750df1fcaed5c9ef88e2a90108ca345789ef3053ca7970ebed73d9ab9cd66d5fdcb409038d4618de2037d4f80

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\resources\elevate.exe

MD5 86050c2cbb9f996c1d7b5116fc67b21e
SHA1 59ec79f38d3a3bbe5b63b464bc720b426d7c300a
SHA256 288bce90fd6ffb1dd260f71f73765b9931c45015c3a963514855ae78f1becb9a
SHA512 9d4a1eb417b809299b9eeafc90323032dbea5b0ae9ddc799af6e4e36ecef61d2518dc4756bb4ac398d396926eb72e6886cb64c568dfad80e51c5320a74943b8f

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\resources\dist\pages\cantLoad.html

MD5 af0ebfabf769eacba4deb6fbc9f002ce
SHA1 8b18e6f7c70bf329bb5f9f4c2436c7d6f95faed4
SHA256 6bc293fd068ddac9c3d92116e09417ac768336c76b748fccdc9f167e6466c1d4
SHA512 85d744eb091ed3a9e5b14eb4d87c5233b9909c732c5902c50a2cd38a9645a65dae8723f3773758e02a1a8c591da98fc589377702863090acb527fb20ceded709

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\resources\dist\pages\icon-text-logo.svg

MD5 9e058d4bc591160ec98e36aa65031b48
SHA1 36254fd3bdb61ac27344a69594d91009122808fe
SHA256 a6feedf1437cf6026a950771aee3798a310ad554ddf00508282bba9c50e48c79
SHA512 4e0d4edc0385d9b114f0553c3b182313507ca08e3c680bdb78c7ef05e019b2d4b56a84801792d0923bf16b993918ad72b0029199adc52daa951b209a6c62a125

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\resources\extraResources\[email protected]

MD5 e9b992be1a5ea38cfdbc31508d80b3b9
SHA1 e8395346ff49413abda7950807938baaaeee042d
SHA256 ca3525faef577979cc300996b230ab12f58b539d1361e2831868d515068c2346
SHA512 930501bf1c6d71a2907217bd4c8bfe0231d890f1f665d51963b3011c805a305246d6e4e0ecf6cf6efad37edde6ffed3c7dd088594ac24aab1e13fabd21a35e1a

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\7z-out\resources\extraResources\IconTemplate.png

MD5 2c761c4c5b466c0d6c3fb51907f4a587
SHA1 72bb96c24004b9cf6abde1ae870ebb2315169855
SHA256 c0abd9c5ecfb3cfcd8ef51d6efd969cacfc2c13c59815d067573977664461eec
SHA512 9722b18a6342ea91e5094b41b31eb2bbed4c2fb773f6309b9ad238dd52260773ed3e0ebfa38469ac970b51bf2665f45086fd112f1eb0390513665094b91ea560

C:\Users\Admin\AppData\Local\Temp\nst4382.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

\??\pipe\crashpad_2328_XCUQFCQOTSYSSGKM

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\Bearly\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\Bearly\config.json

MD5 1ffb53e0bcfa1dfde7672728e3114815
SHA1 ec46721ab0c27d9e707f63c2ee748c954d775de2
SHA256 8e3ed5120a02820b427cb66f4f10c93aa4ca6415f332686b39174a6e04a70c76
SHA512 5aaabd51ac0b126c05d881e07fdaf1d82e86f5c6b5aea347ea53ea507fad953409e213ca0ae05bbf0921b478b595fbdbfada1eafd5ec39fbb9454434f0f5d424

C:\Users\Admin\AppData\Roaming\Bearly\config.json.tmp-538038316060c345

MD5 b571feedd7a6cfefa26b73514d57a7c7
SHA1 33d4945a08a2040a4707b44d21483cd00858cb7d
SHA256 bf7d1e5bafc682ba7bf07389750e4165fa3076e69625630998b4a528f5e6d635
SHA512 8d2f594f4f568005005f2ba23bdd67ccdfd4bf56ada577993aaed596c839263f223dc2180897b906d8a8e94fd060eccda97a6cc2f464bd507182db45f4a017c7

C:\Users\Admin\AppData\Roaming\Bearly\config.json.tmp-5380383383262959

MD5 b3ed4e099f2fc7da4f4d8d42fb894e80
SHA1 f9969d8fbef1946bf6f57d6b7af06981b75d7ab9
SHA256 6b2c996a1bac93c2b2549db2cd81d888453ca9d088d3453b17657597d8bff56d
SHA512 b9d20078a583877fa58a9b4a50f63cf131a0a06eefa2da57d8c1f3160ad724e0f470cfd7e94f94b1b5c3c4ae750515e5953cc2b66d2adbb96bc78f1cfc1061eb

memory/6216-1874-0x00007FFDED830000-0x00007FFDED831000-memory.dmp

memory/6216-1873-0x00007FFDECCF0000-0x00007FFDECCF1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Bearly\a9b6a1ea-d6b7-4d81-916e-a31df6576f55.tmp

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\ScriptCache\index-dir\the-real-index

MD5 bf7e48c8bb3d5caa67a496bd6df0484e
SHA1 655dfb7a9cf592e54fa046cfa2bb6df9bfcd6ca9
SHA256 9f6d9cf55e1e1c901e99e6fa8c3c6b753a9f0e88eec6cf4e6ce3691dd9d1456e
SHA512 c4fa136262501c87e85c337e2af473fc7d2c30a0a6ad4191e62a67388264421df4e61840ef72dc751652bb576eecaca8c223b16678ba25dab60ae51755d97121

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d4c5.TMP

MD5 60548faf237220ae07c647791b9a48af
SHA1 f18a216737d77df0219de318739469cd31f385ad
SHA256 d2f3278f9cc58341a8b1371da1ace6944033035c0f38297e5ad30cffaff04a6c
SHA512 d3ba7d52698f03df32410f874bbafcbc6cf1a86bcbe0b0918a05df09139f08427f3aebbf56bdae0e979e902f3d3705ec23ed48231a7aa9124dbfefeec0f938d3

C:\Users\Admin\AppData\Roaming\Bearly\Code Cache\js\index-dir\the-real-index

MD5 1a314fe46353903ace604968089682ac
SHA1 7cb284756db11fc019828129ee98f56e4348cfe9
SHA256 43536b687e7bf3070a3795d616f667bf5af03048e78de69715bdf5eea16ca58d
SHA512 d52709b442d53e1591093698ac9ec63a5911a8a0d96c1b17a63f3d8bdf414b187f31865e29401d52ce34ab0b506c0847d91720b34c1804daa3fe7f6cef4c6c33

C:\Users\Admin\AppData\Roaming\Bearly\Code Cache\js\index-dir\the-real-index

MD5 f925ad848eb71230c7460282b8460540
SHA1 53df1fd35562d29f7fdd0d10e982df85468941ae
SHA256 e9357c42115673b2a2254351685f49e0e00df1bd06e5d333fde82e2b0552d3ec
SHA512 6751f2346f189da7627c6a9e6e6ce51be43b7b5848021d89e2b9b0117db179fce21a305f183ef27e8bae1458977d6e8f7f26b8056abe8406598b178cfdcb7eda

C:\Users\Admin\AppData\Roaming\Bearly\Network\Network Persistent State

MD5 d23dbcd4e6d5f83d7ce729fddf44ac15
SHA1 f12e6797f49d6bcc358ffac3dff045f08eac6f82
SHA256 3481d86eb77df4b7cb031ad7ca509db7206a949300ef34ea85909ca946cdb96b
SHA512 f27587f9aeecc4dcc6f788d4a93caabe9f7e16494e8b54642aa9c858868d315cc2e2a111c5b1eb8e5d091e7ffa470e181853e1fa57e4825fe43398eecf1774a0

C:\Users\Admin\AppData\Roaming\Bearly\Network\Network Persistent State~RFe589517.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

memory/5832-1942-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1944-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1943-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1948-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1950-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1954-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1953-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1952-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1951-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

memory/5832-1949-0x000001F1BE620000-0x000001F1BE621000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20231129-en

Max time kernel

122s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240221-en

Max time kernel

121s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2160 wrote to memory of 2668 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2160 wrote to memory of 2668 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2160 wrote to memory of 2668 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2160 -s 88

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

163s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.107:443 www.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 107.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/5048-0-0x00007FFF98293000-0x00007FFF98295000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_udiyn0hd.t5y.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5048-10-0x000001CF3C820000-0x000001CF3C842000-memory.dmp

memory/5048-11-0x00007FFF98290000-0x00007FFF98D51000-memory.dmp

memory/5048-12-0x00007FFF98290000-0x00007FFF98D51000-memory.dmp

memory/5048-13-0x00007FFF98290000-0x00007FFF98D51000-memory.dmp

memory/5048-16-0x00007FFF98290000-0x00007FFF98D51000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240221-en

Max time kernel

119s

Max time network

136s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Network

N/A

Files

memory/2820-4-0x000007FEF56DE000-0x000007FEF56DF000-memory.dmp

memory/2820-5-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

memory/2820-6-0x0000000002310000-0x0000000002318000-memory.dmp

memory/2820-7-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

memory/2820-8-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

memory/2820-9-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

memory/2820-10-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

memory/2820-11-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240508-en

Max time kernel

93s

Max time network

158s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x300 0x3cc

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.107:443 www.bing.com tcp
US 8.8.8.8:53 107.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/688-0-0x00007FFBF01C3000-0x00007FFBF01C5000-memory.dmp

memory/688-1-0x00000178A1220000-0x00000178A1242000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_km4uzuaw.4gr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/688-11-0x00007FFBF01C0000-0x00007FFBF0C81000-memory.dmp

memory/688-12-0x00007FFBF01C0000-0x00007FFBF0C81000-memory.dmp

memory/688-13-0x00007FFBF01C0000-0x00007FFBF0C81000-memory.dmp

memory/688-16-0x00007FFBF01C0000-0x00007FFBF0C81000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240426-en

Max time kernel

136s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4896 wrote to memory of 5040 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4896 wrote to memory of 5040 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4896 wrote to memory of 5040 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5040 -ip 5040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.123:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 123.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
BE 2.17.107.123:443 www.bing.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20231129-en

Max time kernel

121s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe"

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240426-en

Max time kernel

135s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4564 wrote to memory of 2828 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4564 wrote to memory of 2828 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4564 wrote to memory of 2828 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2828 -ip 2828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.123:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 123.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
BE 2.17.107.123:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 209.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240508-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2992 wrote to memory of 1452 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2992 wrote to memory of 1452 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2992 wrote to memory of 1452 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2992 -s 80

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe"

Signatures

Checks installed software on the system

discovery

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2232 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2232 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2232 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2232 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2260 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2260 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2260 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2260 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2260 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2260 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2260 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe

"C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Bearly.exe" | %SYSTEMROOT%\System32\find.exe "Bearly.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Bearly.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "Bearly.exe"

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\chrome_100_percent.pak

MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\chrome_200_percent.pak

MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\ffmpeg.dll

MD5 d8cd1aca8dd3a91d0bf32da2e746545e
SHA1 6a28b357d93fbb3502bc386019899c9f3633b069
SHA256 5b831daa8515b3d1f346b481ec04f881a3fe728944e966624489d3a3872a40bf
SHA512 af70b88194539cdebf353df0927671babbd51f3cdb304cf31dc5c29d65dea1e38136d7389ba48aa0829855d62eeb740f3df12ab981153c7f2eb70ed1e74fbcbb

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\libEGL.dll

MD5 6426112edaa62ca308f7f32d26d4f6ad
SHA1 3edfd900da6a5fb1c67c41e18ea0ec9a2752ba2e
SHA256 a23882d8555d8c3f1d27ba39b0225d68bc446e250d19d36aff4ef65d221458a3
SHA512 f967dea3f18ab81c8ca72b722962944b9a874cfda4c95237e96b1e989ff3657a087957c1ff2c374616ed2e49a75f2786174ff8972a3447589468dfafaf4db582

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\LICENSES.chromium.html

MD5 312446edf757f7e92aad311f625cef2a
SHA1 91102d30d5abcfa7b6ec732e3682fb9c77279ba3
SHA256 c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
SHA512 dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\libGLESv2.dll

MD5 b7214621f818dfe440ade5b2f3619519
SHA1 4b95d412e49f2e4c3ce71e10b2d76df3ab63547c
SHA256 59133f095f941eb8d6b3613fd08b98e6d84e8290f3f72ded6d98c8683582f188
SHA512 d8195862a8d6ca8de5aa4096ce1feabda3f8375279904124e80451ef22d1ae13e4de35487afe36996d0b51edc16c48ddda03c5c2b14f4bd5e465ed48e9e3d29b

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\v8_context_snapshot.bin

MD5 5a072b0edc88a0b18e1c56a307a341cd
SHA1 20ee0b6521e12dfc4f378eb8d5724456e22e90fd
SHA256 878046ea578d24595d060583cf8f9618aba37d23c603499068e5762dd5509aa1
SHA512 c3a51850d939eea9b5d8926795cdc3e56962ec9eeabb3b80ed62a9c77ae5d6b696528d03a469c212b99d83ec303367f3353cc0fff459e7e577254f037f8fd995

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\snapshot_blob.bin

MD5 840169fda65be2a18c85e7dd44ec6051
SHA1 5080736e613be6e11242d37adef740cac0bf8cd1
SHA256 80e58621229b4cb6104ce7f65ebce979a6ebe3eac750447d037660cec34ad0b3
SHA512 2e65ac47ff05830eb0942288daf66468fbd34a1fbc1010f0bcdaca873f4d110ae8f88e825dec7e86dcd7b11dee7a003c29350e3377abd9f886b028cdbb830644

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\resources.pak

MD5 a8502a5d32543474520dd8cf1a871b60
SHA1 4b2b4e61a8105dd9583c12e9adfd307c113907c8
SHA256 b6420c40d7d9b4971f6c99a3fd108e10c7e4e6bb95fa655a5a1b00ff2bab36dd
SHA512 c73e578d9b8a990ad11c218c096fc8d8a5d283a3fee4388ef40b4140e14504498f3e376b4b86d0d789dd9cd1dc8957d749a86f59cdf199f85daa28490c129658

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\vulkan-1.dll

MD5 8439213fbb22a848ce814982d502bdc4
SHA1 6c5831de36a539c0689410b00f1b8aa1dc6f7c2d
SHA256 e69f794109b12523de314a471c56278cd921be58facbd18ec351685d15894cc0
SHA512 e4e570e5b98420d99634167e0d9f920cba27fc4b8e91c70cc4e5b33a4b3299a69ce9b294aae538aeb150135378978a6c7b0644a645b797ab230e185593c828c0

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\vk_swiftshader.dll

MD5 3eb74d173ef00f7c510b11e61c5ab52f
SHA1 13cfe224f966145d7f90640b080bef5dd4d0ff42
SHA256 0749491928a69673f17d39eb674f9a416e789e4fddec48ebb54714914343b48a
SHA512 423ab3765aa01cf39fa31d068ddb761ad93707cb06f57b4e674311c91c5cc9d238c231d1e6882f8d3525d16fea0d8f8db8d0a74bb55309f5a120cbe4a34e40bd

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\bn.pak

MD5 8feb4092426a0c2c167c0674114b014d
SHA1 6fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256 fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA512 3de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\bg.pak

MD5 945de8a62865092b8100e93ea3e9828d
SHA1 18d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256 f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA512 5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ar.pak

MD5 56f6dc44cc50fc98314d0f88fcc2a962
SHA1 b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256 7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512 594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\am.pak

MD5 c6ef9c40b48a069b70ed3335b52a9a9c
SHA1 d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA256 73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA512 33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\af.pak

MD5 7e51349edc7e6aed122bfa00970fab80
SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\cs.pak

MD5 a934431d469d19a274243f88bb5ac6fb
SHA1 146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256 51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512 562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ca.pak

MD5 01acd6f7a4ea85d8e63099ce1262fbad
SHA1 f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256 b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA512 2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\el.pak

MD5 6922aaa87431699787c1489e89af17b9
SHA1 6fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256 800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512 367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\de.pak

MD5 ed329b35d10e81f55d611fe8748876f8
SHA1 0d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA256 6facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512 bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\da.pak

MD5 bb5252dc6f0f3c01ce3638138bf946c8
SHA1 bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256 c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512 e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\en-US.pak

MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\en-GB.pak

MD5 0db7f3a3ba228aa7f2457db1aa58d002
SHA1 bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256 cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA512 9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\es.pak

MD5 e9fa4cada447b507878a568f82266353
SHA1 4a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256 186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA512 1e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\es-419.pak

MD5 5321c1e88c5c6fa20bdbc16043c6d0f6
SHA1 07b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256 f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512 121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\fi.pak

MD5 5518b51d4af7f1b9d686cbea28b69e71
SHA1 df7f70846f059826c792a831e32247b2294c8e52
SHA256 8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512 b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\fa.pak

MD5 dcd3b982a52cdf8510a54830f270e391
SHA1 3e0802460950512b98cd124ff9f1f53827e3437e
SHA256 e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA512 3d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\et.pak

MD5 a94e1775f91ea8622f82ae5ab5ba6765
SHA1 ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA256 1606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512 a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\hi.pak

MD5 b7e4892b2030e4f916364856b6cc470a
SHA1 b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256 093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512 ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\he.pak

MD5 93d9261f91bcd80d7f33f87bad35dda4
SHA1 a498434fd2339c5d6465a28d8babb80607db1b65
SHA256 31661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512 f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\gu.pak

MD5 7b5f52f72d3a93f76337d5cf3168ebd1
SHA1 00d444b5a7f73f566e98abadf867e6bb27433091
SHA256 798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA512 10c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\fr.pak

MD5 0445700799de14382201f2b8b840c639
SHA1 b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA256 9a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512 423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\fil.pak

MD5 3165351c55e3408eaa7b661fa9dc8924
SHA1 181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA256 2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA512 3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\mr.pak

MD5 25f2b9842e2c4c026e0fc4bc191a6915
SHA1 7de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256 771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512 ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ml.pak

MD5 3b1305ecca60fb5a7b3224a70398ead9
SHA1 04e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256 c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA512 68fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\lv.pak

MD5 e4f7d9e385cb525e762ece1aa243e818
SHA1 689d784379bac189742b74cd8700c687feeeded1
SHA256 523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512 e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\lt.pak

MD5 96602a3f3b59faa997a4d337889fa02b
SHA1 94593a270b0d84c006e0959bc136b6c4987dfd3f
SHA256 51db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512 dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ko.pak

MD5 b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1 050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256 ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512 b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\kn.pak

MD5 a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1 f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA256 3c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512 f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ja.pak

MD5 f47efaa76f5200a6c0c23c33684d7bad
SHA1 9b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA256 5b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA512 67d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\it.pak

MD5 7c981a25be0e02fba150e17d9669a536
SHA1 3af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256 ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512 445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\id.pak

MD5 bd9636e9c7dc7be4c7f53fb0b886be04
SHA1 55421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA256 5761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA512 7c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\hu.pak

MD5 b338dcb0e672fb7b2910ce2f561a8e38
SHA1 cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256 bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512 f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\hr.pak

MD5 105472bc766a30bb71f13d86081de68d
SHA1 d014103ad930889239efd92ecfdfcc669312af6c
SHA256 a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512 ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\nb.pak

MD5 7576c2fa9199a4121bc4a50ff6c439c3
SHA1 55e3e2e651353e7566ed4dbe082ffc834363752b
SHA256 2a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA512 86c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ms.pak

MD5 9b3e2f3c49897228d51a324ab625eb45
SHA1 8f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA256 61a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512 409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\nl.pak

MD5 bc41967b2ff493e7f151c7721245739d
SHA1 7606133ddbb58492dbbf02c03a975fb48da1e26f
SHA256 3dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA512 9e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\sw.pak

MD5 ee8da42ffe40fbb916c56390e2cd99e8
SHA1 6d824f56afe6b3605a881d2c26e69a46e6675347
SHA256 192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA512 7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\sv.pak

MD5 bbe0785c5f9591e8a1e7c4830fe949d6
SHA1 da4f3286079d50e1c04e923529e03e7d334c7fff
SHA256 0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA512 38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\sr.pak

MD5 cf160983a86b51ec42845f4e60ac9123
SHA1 4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256 ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512 b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\sl.pak

MD5 4d9d56ef0b176e7f7aa14270e964ec77
SHA1 515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA256 6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512 740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\sk.pak

MD5 793c442420f27d54410cdb8d8ecce5ff
SHA1 8995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA256 5a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512 291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ru.pak

MD5 fc0e2fc09aa9089c5db75bab7a0754a7
SHA1 f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256 188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512 377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ro.pak

MD5 19cfc7c8f1a2e4a2de1f9f64475469bc
SHA1 bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA256 3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512 ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\pt-PT.pak

MD5 acffa29064f40a014bc7fe13e5ff58a9
SHA1 5a0890c94084075446264469818753f699a3d154
SHA256 423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512 d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\pt-BR.pak

MD5 a23c805ee4d3d67c811b50826ca25a51
SHA1 c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA256 62be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512 c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\pl.pak

MD5 61c093fac4021062e1838a32d79399c2
SHA1 84a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA256 58067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512 475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\zh-TW.pak

MD5 8f67a9f38ad36d7d4a6b48e63852208d
SHA1 f087c85c51bdbdef5998cfc3790835da95da982a
SHA256 92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512 623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\zh-CN.pak

MD5 9d4f54eb5a12cf4c2f34f5f538dff90b
SHA1 c31b892ce78c733bde0571b6236170103cc9fe7a
SHA256 58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA512 46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\vi.pak

MD5 9274866d7c6314f43dd63ed293293e25
SHA1 4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256 dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512 3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\ur.pak

MD5 d7ec7d551dee1e1ef11be3e2820052f9
SHA1 d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA256 05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA512 92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\uk.pak

MD5 e4c4e3700469704b936460ca1a90fcc0
SHA1 e809990fc07a1d39fe623046382699e648e343c0
SHA256 29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA512 68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\tr.pak

MD5 9f24f44cac0997e1d0a6a419520f3bfe
SHA1 edb61859cbb5d77c666aac98379d4155188f4ff5
SHA256 3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA512 65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\th.pak

MD5 293ad7c20c22d744e4db0fb001ec45bb
SHA1 486c9e0732306a45aceb633da2b3ded281197620
SHA256 d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512 ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\locales\te.pak

MD5 02415ded02cc7ac25e8f8d0e83365061
SHA1 5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA256 97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA512 54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

C:\Users\Admin\AppData\Local\Programs\Bearly\locales\ta.pak

MD5 a8beab6896018a6d37f9b2e5bdd7a78c
SHA1 64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256 c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512 73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\resources\app.asar

MD5 dcf84c7c6436284959898ff76df2601a
SHA1 d64896cf933ef8399c23f678e2b5529c1074e8f9
SHA256 9ab65922798b5f5c4056de45e44a5fdccc489a6321a3cabbfbd99d8ca9daa896
SHA512 1e1361c6ec01637d83e340ef4069f5043fec4aa750df1fcaed5c9ef88e2a90108ca345789ef3053ca7970ebed73d9ab9cd66d5fdcb409038d4618de2037d4f80

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\resources\app-update.yml

MD5 1f3fc4ed1c35754da78d76ac2355e681
SHA1 52a2ec4a1267e6b51fb9e376f38dd174799f57f3
SHA256 08c1434ebe835e19645d055993023f8b8048ef6025792bd2ce685ef33f34abe3
SHA512 155895169d921772c125922c82785b34e59ae0b35f909543bbcbb52b88f9b857d2997de335ea87cc4f582d8b928598de4addde423d21953d29d9e3e27932adbb

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\resources\extraResources\[email protected]

MD5 e9b992be1a5ea38cfdbc31508d80b3b9
SHA1 e8395346ff49413abda7950807938baaaeee042d
SHA256 ca3525faef577979cc300996b230ab12f58b539d1361e2831868d515068c2346
SHA512 930501bf1c6d71a2907217bd4c8bfe0231d890f1f665d51963b3011c805a305246d6e4e0ecf6cf6efad37edde6ffed3c7dd088594ac24aab1e13fabd21a35e1a

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\resources\extraResources\IconTemplate.png

MD5 2c761c4c5b466c0d6c3fb51907f4a587
SHA1 72bb96c24004b9cf6abde1ae870ebb2315169855
SHA256 c0abd9c5ecfb3cfcd8ef51d6efd969cacfc2c13c59815d067573977664461eec
SHA512 9722b18a6342ea91e5094b41b31eb2bbed4c2fb773f6309b9ad238dd52260773ed3e0ebfa38469ac970b51bf2665f45086fd112f1eb0390513665094b91ea560

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\resources\dist\pages\icon-text-logo.svg

MD5 9e058d4bc591160ec98e36aa65031b48
SHA1 36254fd3bdb61ac27344a69594d91009122808fe
SHA256 a6feedf1437cf6026a950771aee3798a310ad554ddf00508282bba9c50e48c79
SHA512 4e0d4edc0385d9b114f0553c3b182313507ca08e3c680bdb78c7ef05e019b2d4b56a84801792d0923bf16b993918ad72b0029199adc52daa951b209a6c62a125

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\resources\dist\pages\cantLoad.html

MD5 af0ebfabf769eacba4deb6fbc9f002ce
SHA1 8b18e6f7c70bf329bb5f9f4c2436c7d6f95faed4
SHA256 6bc293fd068ddac9c3d92116e09417ac768336c76b748fccdc9f167e6466c1d4
SHA512 85d744eb091ed3a9e5b14eb4d87c5233b9909c732c5902c50a2cd38a9645a65dae8723f3773758e02a1a8c591da98fc589377702863090acb527fb20ceded709

C:\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\7z-out\resources\elevate.exe

MD5 86050c2cbb9f996c1d7b5116fc67b21e
SHA1 59ec79f38d3a3bbe5b63b464bc720b426d7c300a
SHA256 288bce90fd6ffb1dd260f71f73765b9931c45015c3a963514855ae78f1becb9a
SHA512 9d4a1eb417b809299b9eeafc90323032dbea5b0ae9ddc799af6e4e36ecef61d2518dc4756bb4ac398d396926eb72e6886cb64c568dfad80e51c5320a74943b8f

\Users\Admin\AppData\Local\Temp\nsi1A93.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

memory/2232-602-0x0000000004110000-0x0000000004112000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240221-en

Max time kernel

119s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240508-en

Max time kernel

120s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 220

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240221-en

Max time kernel

120s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 220

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

157s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5620 wrote to memory of 3128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5620 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa57746f8,0x7ffaa5774708,0x7ffaa5774718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13307295332994916111,4078148029015130325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 88.221.83.187:443 www.bing.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

\??\pipe\LOCAL\crashpad_5620_FPEETEGZRAHLSROG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c1cca53483fae45a4d4c3f9f31efdf29
SHA1 f9c3d1d4c6733d8c0f1addefb1576eff6f522a81
SHA256 3c4bb9ea6f34464af0024464d903f1ff39e3e3e89f6d3554e38b3db561691da4
SHA512 cb30c35ff8f70eea6361362fef1e8d601250e8a6334b03231d6d36d389855063f82dc90e7c01f0c0bf6c710d1c562c9d94068ae74637aad79afd8869f852704d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a258f28d15d82e9e4dd12c2af02d752b
SHA1 279cc8a46bf4b29533dec5c81139998ae50036c5
SHA256 f7ff3fcfacbf5f52d07a44bd70fb364dd18131a458eae325c222cdde727d9e75
SHA512 d6143ebf734db76c454c0a743416e372d38cbb6e1d3ef23a832acb96b58c189348b27672c81b26d564409710926f3246f1591080f975e3f01b135bcb78f4fc4b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6de977a88b11a06b9d23fc19e5d14c6a
SHA1 b73ab2e301c7acf59ab4f65c7dd8bbf5a1b800b0
SHA256 73974d95bb6f424c52807302cd11c520c7b11a660ab2065fe21afc4b129bd9d6
SHA512 e37d2a98af612d8e434eebf6b62ba0f72342727c6e24b5ddac2c8fced39092845e7668bfbe7c8e86e060557cd051916a95626271efa6b9d32b9dd49483d142f9

Analysis: behavioral32

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240215-en

Max time kernel

118s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2896 wrote to memory of 2072 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2896 wrote to memory of 2072 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2896 wrote to memory of 2072 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2896 -s 88

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240426-en

Max time kernel

137s

Max time network

111s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2216 wrote to memory of 3208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 3208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 3208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.225:443 www.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 225.83.221.88.in-addr.arpa udp
BE 88.221.83.225:443 www.bing.com tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

164s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.107:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
BE 2.17.107.107:443 www.bing.com tcp
US 8.8.8.8:53 107.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240508-en

Max time kernel

119s

Max time network

126s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Network

N/A

Files

memory/1728-4-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

memory/1728-7-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/1728-8-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/1728-6-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

memory/1728-9-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/1728-10-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/1728-5-0x000000001B610000-0x000000001B8F2000-memory.dmp

memory/1728-11-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/1728-12-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Analysis: behavioral31

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240508-en

Max time kernel

120s

Max time network

163s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 209.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240221-en

Max time kernel

117s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 220

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\bearly\ = "URL:bearly" C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\bearly\shell\open\command C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\bearly\shell C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\bearly\shell\open C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\bearly\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Bearly.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\bearly C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\bearly\URL Protocol C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2972 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Windows\system32\reg.exe
PID 2972 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Windows\system32\reg.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 2972 wrote to memory of 8012 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe"

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

C:\Users\Admin\AppData\Local\Temp\Bearly.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Bearly /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Bearly\Crashpad --url=https://f.a.k/e --annotation=_productName=Bearly --annotation=_version=3.0.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=24.4.0 --initial-client-data=0x404,0x470,0x448,0x40c,0x46c,0x7ff7ae58dc70,0x7ff7ae58dc80,0x7ff7ae58dc90

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1780,i,1586365767992816045,9822850200154952383,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1936 --field-trial-handle=1780,i,1586365767992816045,9822850200154952383,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2356 --field-trial-handle=1780,i,1586365767992816045,9822850200154952383,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bearly

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3600 --field-trial-handle=1780,i,1586365767992816045,9822850200154952383,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3728 --field-trial-handle=1780,i,1586365767992816045,9822850200154952383,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1780,i,1586365767992816045,9822850200154952383,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 88.221.83.200:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 bearly.ai udp
US 8.8.8.8:53 bearly.ai udp
US 104.26.11.184:443 bearly.ai tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 184.11.26.104.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
IE 209.85.203.84:443 accounts.google.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 84.203.85.209.in-addr.arpa udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 o4504114762612736.ingest.sentry.io udp
US 8.8.8.8:53 o4504114762612736.ingest.sentry.io udp
US 8.8.8.8:53 js.stripe.com udp
US 8.8.8.8:53 js.stripe.com udp
US 34.120.195.249:443 o4504114762612736.ingest.sentry.io tcp
AT 3.161.119.36:443 js.stripe.com tcp
US 34.120.195.249:443 o4504114762612736.ingest.sentry.io udp
US 34.120.195.249:443 o4504114762612736.ingest.sentry.io tcp
US 8.8.8.8:53 exec.bearly.ai udp
US 8.8.8.8:53 exec.bearly.ai udp
US 172.67.74.15:443 exec.bearly.ai tcp
US 172.67.74.15:443 exec.bearly.ai tcp
US 8.8.8.8:53 249.195.120.34.in-addr.arpa udp
US 8.8.8.8:53 36.119.161.3.in-addr.arpa udp
US 8.8.8.8:53 15.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 api2.amplitude.com udp
US 8.8.8.8:53 api2.amplitude.com udp
US 44.236.188.147:443 api2.amplitude.com tcp
AT 3.161.119.36:443 js.stripe.com tcp
US 8.8.8.8:53 m.stripe.network udp
US 8.8.8.8:53 m.stripe.network udp
US 151.101.0.176:443 m.stripe.network tcp
US 8.8.8.8:53 m.stripe.com udp
US 8.8.8.8:53 m.stripe.com udp
US 44.240.101.40:443 m.stripe.com tcp
US 8.8.8.8:53 147.188.236.44.in-addr.arpa udp
US 8.8.8.8:53 176.0.101.151.in-addr.arpa udp
US 8.8.8.8:53 r.stripe.com udp
US 8.8.8.8:53 r.stripe.com udp
US 54.187.159.182:443 r.stripe.com tcp
US 54.187.159.182:443 r.stripe.com tcp
US 8.8.8.8:53 40.101.240.44.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 182.159.187.54.in-addr.arpa udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 169.253.116.51.in-addr.arpa udp

Files

\??\pipe\crashpad_2972_NZGEUAZSZAGUROUU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\Bearly\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\Bearly\config.json

MD5 1ffb53e0bcfa1dfde7672728e3114815
SHA1 ec46721ab0c27d9e707f63c2ee748c954d775de2
SHA256 8e3ed5120a02820b427cb66f4f10c93aa4ca6415f332686b39174a6e04a70c76
SHA512 5aaabd51ac0b126c05d881e07fdaf1d82e86f5c6b5aea347ea53ea507fad953409e213ca0ae05bbf0921b478b595fbdbfada1eafd5ec39fbb9454434f0f5d424

C:\Users\Admin\AppData\Roaming\Bearly\config.json.tmp-538037110634ace5

MD5 b571feedd7a6cfefa26b73514d57a7c7
SHA1 33d4945a08a2040a4707b44d21483cd00858cb7d
SHA256 bf7d1e5bafc682ba7bf07389750e4165fa3076e69625630998b4a528f5e6d635
SHA512 8d2f594f4f568005005f2ba23bdd67ccdfd4bf56ada577993aaed596c839263f223dc2180897b906d8a8e94fd060eccda97a6cc2f464bd507182db45f4a017c7

C:\Users\Admin\AppData\Roaming\Bearly\config.json.tmp-5380371226573aeb

MD5 0c2bb92bc63d59da117b6542b8ca9edb
SHA1 1841f159e4e2074fd921877937016a21ff4f0f90
SHA256 dc011a83b38ed30c2eb64000cd76d92dd2fa807170fbe2dbab77bc5221471ab3
SHA512 8b4f251a74afe73a4c8fa003b5e0d65b33ac642567c73500783f1339e892fe76f3e524d5b56faf0bdff6a799c9581136fe33ac6fc1f135400440ce05abd57e9f

memory/8012-1125-0x00007FFEB4920000-0x00007FFEB4921000-memory.dmp

memory/8012-1126-0x00007FFEB4930000-0x00007FFEB4931000-memory.dmp

C:\Users\Admin\AppData\Roaming\Bearly\5f83180a-dd20-4daa-8509-67821a87e4df.tmp

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

memory/8168-1163-0x0000027400C80000-0x00000274013BF000-memory.dmp

memory/8012-1162-0x000002678DFA0000-0x000002678E6DF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\ScriptCache\index-dir\the-real-index

MD5 aafc77b485f20e97a1a5a7837a15c410
SHA1 880629f9b744ed207e0a4b1b5316dc2e2259dab8
SHA256 c900423880a39a87de8d1aa98d120c3937465263b10e8eb7f29a1db9032ead82
SHA512 6221d2554ec44c9d1da9f13a9b3d4778c25e4f50678e8f0ad1352d39027f1203f55983148e49a3a1150e9846529bc7cbac9d379bb2610f1d3119bd8e2dd91ed9

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c302.TMP

MD5 21b7601f58299bd323cdd32b2ef51d45
SHA1 d9c771e1206c4d326eee0d309162a9b739ca05ba
SHA256 4b272420ca08a1439fbaee5c0c6de67f646b387a0586d348dfa37293a9e7b44f
SHA512 7137e2bb7ffd03e47302bdddfd926f339b36af359938770d2305f8cd3f3442e90d51810de7916a85bcf9aa4c280f1b7072545a82f69a6624bb693df59e990ab5

C:\Users\Admin\AppData\Roaming\Bearly\Code Cache\js\index-dir\the-real-index

MD5 3d2b40bae750996f0cefec26d384d39b
SHA1 333cef9dc248e7d8e158a9a1bc0dc35e2838a2d0
SHA256 4ba8cbbfca701bb115c372ae069e68c48fa2baed77982a0b7fe4069594994664
SHA512 36c1ff765484d15dbdea0688b21fef498d507a4366a5d8f4b651962601ab05814b1d13caeb766f95224803245636d5e2d6117466a2569f1be2b8c190a19009d9

C:\Users\Admin\AppData\Roaming\Bearly\Code Cache\js\index-dir\the-real-index

MD5 e91ceef1f6f12d273e07dc68ec09a906
SHA1 4cf84c7a2fb004cc83d97525403494d7ed3fe15a
SHA256 6402ee38d6c2cbf5723c7db0a51c2350148b70ff097e0ea53c8d14584fe0212f
SHA512 20ea4afa2a9199495209f61a256e90a3700d2b0db96549dc847d732b467f89d82ba90a00c8a22e48af84ac3ef4ef7cc7aa2e69e79ab90e418ae88fc00d3fb9b8

C:\Users\Admin\AppData\Roaming\Bearly\Network\Network Persistent State

MD5 ea5c05e868998fcbaca22b137367cb7f
SHA1 20caba9aad9371c4bec11765f9536e658bce7260
SHA256 eb88cd25152800292f71f891fac06c44694bcd14c68762aebbc2696cf29edffb
SHA512 f3cdf574e4700307a3e541e64484a6850d73080b735a60720dd8a47f443a9401e2c40ca75332d0ad197ebb7e7d4e2f4df0bc1904fb0be689b8417ef57e5f11c7

C:\Users\Admin\AppData\Roaming\Bearly\Network\Network Persistent State~RFe588335.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

memory/5132-1215-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1214-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1213-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1219-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1222-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1225-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1224-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1223-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1221-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

memory/5132-1220-0x00000261CC3B0000-0x00000261CC3B1000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240508-en

Max time kernel

119s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 88.221.83.248:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 248.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:36

Platform

win7-20240221-en

Max time kernel

121s

Max time network

156s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f00c8d0bf9c46e2d5b521a3d732a37764a435ef9008476782f73e27d86aeb308000000000e800000000200002000000098261f21cc80c933e6c8c94827a79a06d2b42af2cb3f164110af2c234ec3b76b20000000e3727b7a396892e1b535871f85ff081ce2f931616891850163054df7be87f8ef40000000b9680bbded81b8f75e080dc74849e31c738064c23dc082eafe39eaaf3ff0d0192c6fa2770577cdc8640a409b989e4411728d37b7082dfeb1ab46f70af7c7d1fb C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000074be43e0169a46190800511fc59ede65dd988b8310a172f883f715c4d21347ca000000000e8000000002000020000000a55388bdbc65f62d71df2b5c12e17fdb49db2510afc177ad14fa7624200e3c28900000007e2f9ac0d71da22cee804fe8700167f027ca70ba4548986294fca15aeefcc18bd940d37f0fa69717ca83c61cc185648271b5e79e93cd7b515752aab53ecede790f9bfe0ffe9d818916a3795fc1f898868346ca8e634aab08551d89c976a1a18463452276a5a8c757e43c8d564bed0df8feaaed2fd77732bb8b50a23e0d5a9b784a5374715e2ff34ab1f78f7deec962fb40000000d6bec6211ce2158f7d5bbe005fdbfa6ae259e03d89145cb02f81867e7311fa202831165fd64ccd429b6b0f70e57e8aef64244726f421e68c089ea556c838293b C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ade8302aa3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AF635C1-0F1D-11EF-9F01-52C7B7C5B073} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421542290" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab1374.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar1484.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 911db7d3948c5893130635a0d2060c81
SHA1 c01d5b499685e43b07741fefad8c6c07be6d770e
SHA256 726dcbbd1678bb9f139a02fc5239e487b4fc821801ffae2b8d419e1131fa5e46
SHA512 5ad644410ee6b2e1a42265800a4eeb949fdf014e05a7644b9be84f63700215311758ee7b58a0058a6cc76b1f5a2dc926cc2e97601fc2b73efeb4f652cdf6ba24

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c94b94872ed5817fa8bb7688b1798a69
SHA1 3607a2a79415af7cf3ede9b999356a08b8427c01
SHA256 8686746189d235e4a9805e75e85c186250aebb0ad70b4d96b9bbd7b9b6194c66
SHA512 e07726f7dc4d2c1b989e8d115a38f7991899d079b7e6d51fdcbd0a58cfbd4a270b70587ae2a36567da423e110121f1a359f02831e77c2afb49438d77cd886e35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f4080c990f305350c139901f25869b6d
SHA1 3cf416d72741b45332707160c7afa204e809bf32
SHA256 a4da32101aab828d6e222febbea4379eed72f6c3883b290ee31ed997d10659de
SHA512 d2ed527b07315848fcaa0bd0d22da9207ed4e0aae6087b52fe10de824ec748faced292778d0a5f2ad264ef05bb40eef897efbe79705d3b7689487ac7a1b5f55f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1519d707649d3fbfded138458a6f37cf
SHA1 87aa7ae55544abc039dbc8508d7e5aa1e3c22ebf
SHA256 5bdbb3c6c2d254205db871cbd175f8f53475502d66e32e3bd03f35baaf6edefe
SHA512 8713264df99d2083fd0f4c6c5ccf4fd55d2cfe2737814cb22bfe6913ebdcf767a49189ba196d1c3aef97f6257fa6920eccd1adb75d341904ba9329e017c433ad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f96550b71bff2d0e648b888e09331578
SHA1 3211d653c4db6412cfda02814a5706525698e0f2
SHA256 a55c5e42b94a3091c955f7077ab5d808fd1b80d4e971c64c343b0bf22fb1511e
SHA512 a7e500acd774afa85395fda45159229f857a11acfb6f18931433cae988c6abf87f53deff4237ec9f5453aa8d0032d850c04d91f0ea93ce0b5c2792dc9424194d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c2993f94f47f29e47ae6a9bac21bcd1
SHA1 63a3f67aee31f6cbf3996eaa6b64a8f999f3a2a7
SHA256 8ac8d737f196d19594970d6d71dc1b6dcf63213d5fbe1926a45ef30f6b24a9b6
SHA512 23651254cb4e08233aa2c0eef616bd64b953f5eb57ba4bad6990518f21be40ef0cb3597fd83f8b97281a4fe803cd855118dbb2b195b51be390fad8530064a523

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 962163f0896d18a78cf01f2a97799898
SHA1 0dec0cf0587cccdc27851bfdd5533f86eab337bb
SHA256 7980b89f97761708e1a7d4bc6289707083b2416b9a92971a26b3ea91cafea756
SHA512 cb56a0b511695e1218d08f46a1a41e2111a8555b8f1b66ace70eabcd45db3a3dd30235265d35ec5b146a7c5aa0f07bb4b824aff93f57cee6580ac9f6f3599f71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec7a9c9e22b533bfedc2700d5132a6ec
SHA1 0f0e4f321529713751ded0a8dcb9f75262e9f65c
SHA256 b02d059d2d4b806ac0a99f56375e7be714e5b3a73042fa88a0829518440e9ff2
SHA512 23ab73880c7a981434b38a7e56d44eaeceeec972b42e985684f9951ae4ebb3205a11e582330fbd3380065f238361f8eefac5244c7710eae75a2ad6fe24430e69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5cc4ec037ff5f5cad122e98fb26895df
SHA1 86aefef63be21dba1a0cd588b6b4bf416506acb2
SHA256 ea9b2197563e353151083a491fd68eaf78999f4087ae7a89c471b8c4719524b5
SHA512 36df55d2af663b22079d78039a881dcd62eb70c845fb4b8f3dc77d9796d05decceb1299ab51f8a732503f9db61bd41daaeae081882dc21a861c102581f92e1f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f4b016da7a32f826961bf79ed8a1889
SHA1 acfb57f8a6ee7ad1efa74df2c2ef83f7f456eed2
SHA256 9fb9ec755df131243608891b93d3bd53251b2b893fba0b30f85eb85765caaeb0
SHA512 c4f3a5f268d5fa7b1e1cc2582d96d13c5667c071978a36d7b16965688aeaf215b529f327604b8f47fd4ba7cb898b772129f45b17d969479492cc9dbe147b5e61

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c323c7756c87e0b107d5d2d84f2e0733
SHA1 d91e9f77cf04d8afc4950fc534ffee7937258703
SHA256 539e068d98dc52f57015e968f5335c4244226ce383ca0cd37c31a6e5a3e16b02
SHA512 8c1e377aca1b4e6817d0730b91135ccad23f6be0e83aa72b34f46df40bd3730d4050358e6ed80f19e52582a6bc2f56312ac515cf13f800ed79bcb1dc4195b6c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 baadf3a9884b6a72917d27138ad30118
SHA1 b0f249afa8656e67446f41c08c10a3252a22c528
SHA256 656784fe2651b61e6e7a29933e0fb7bf6948c2803e0dbf981b1a90e84a85cb44
SHA512 f2d92c96bc26e022f28cbf689bc113ef5d75777206ea9123e4f810fc7c3bdd659c6df1dbc7870549b70ea3b68431f1487b56f80d2bc7c12161a22be0f486e789

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec52c4cb7f6b4b13d48db2bc6c9b6a29
SHA1 e6a0e4c8ee67022f736686cf8ff69ff2a886f859
SHA256 91b414882026c12a863225c87679dfff7a27a564e1d9ce35fcaf11b74df788ec
SHA512 70f6c1b766e5bbd25a7f22baa0af3141feb81f24f88c76c1c376144fbaafc7e8771a0a4831a94c4979fb7381261e89cd4c3f768b8a90a098cd80c80e8a20d495

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b486c21ed322a6c43bda8ea57c747e7d
SHA1 31affc84592ecf3c697fa0b8eb8d74c0ca9705c4
SHA256 1e03c80170550b95514f967c3851393e8c1651dbb0b47ef562998a8036b120ba
SHA512 6b167bda216f73fade74401957378a9ea6c1c4fadbf7662d25a0e347b29dc4cd69a5e1ed5a2e20c26ae88978664c24a25024a9d75d54af0572f37b464c80d5de

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 efde9173e1adbf97ea0ca027ba8e7552
SHA1 896e2f7ac670e6a3c581110399993895091e0dc9
SHA256 f7c8f6a622867ca853e054530e37806313e148b12edd4e7fd7123cdb33e7b72c
SHA512 eecd154e2fd532677653eeb3c2f6a4059d80fff06aa94447ded00531a809797bbb60bcc3d25a497964490e48dc4514937ec210516cfc490008ed563b05ac75e3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 742232eca3eb5f070675e2bb885fc091
SHA1 a8cc95e11bc967bd262592902108c03cc50bf23b
SHA256 eef3c415b41c28a4dd54cfb57c204d77c1665615cdc6067e11b6d06f964ff5e0
SHA512 0d2c2eb09748c16c9da7fbd283dc295bd6eff4b623ee03771f501df5eac1eb5b82e013ed0f467ad55fb790437fd289d05c8515df52869dd0831977d6feafa5be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5f7fc7073101f4cf9ccb7f6bc22f86d3
SHA1 d7aae6fd13e121f25999a5f6b4928970fdb09b3d
SHA256 ac161dfa637be93d8f8db250b3b4550ca1839b15caf4778b44a93668937b28c3
SHA512 c3b669c243dff8141c0651f861f098d38279b95064b24458e585113be2fcab94a4d267739c9fc65b13f01e73dbb3680cef8d6bca318c36028ce62aefb1b293ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c9e88986d5b0841d8644a6c4649c60eb
SHA1 69baa840b993d28c053133ca7cdfe512f8b28af8
SHA256 79543d6b7e92d5bf2084a1ef39d21513ddbf71deac5046b3d1c3997b4a9f421d
SHA512 5c43c6844fd557e848d377d7eef162567fb4a30db5462d157b819736ed8f52ffb03af6731715a4035a85b48d9115d84d93ea6e392ab9436f783be3eb32f7d8ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f510e0203b1e25b3eda20f36cb05eec4
SHA1 fdfba0cc2622c3003b44b344e4004a51d23c022a
SHA256 6602f4573ea34335d7b4c66f5e1b59e67037d2ff44116f231285ce2e9ada9f8a
SHA512 6bcdd986fa5b8fdf918ac1ef94f7e4638017670f9fb2108e6eac737ff9086ca125afe13c4285e0eb8e4f45991dc6d09be94c3ede6ca0e5563536ea095da8fbad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 415a7f20d78837a09a8bed504d5375a1
SHA1 2d22e5cd76c6c6769e73d81dea4ed0b03491dc41
SHA256 9e66f987de2a2f6db7120017e411799530af4f3c9962d9e84bea900bf867ad82
SHA512 cca444850151b0264fe16ea684a58d66fd1cafd6c8cd5d22518bc4a53d7eb3a513643faa7baabe63ed0213f57bc2f9044b064f7bdc2e83ac3cd4dec3feb312c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c054dcf4e24d88d47368c8be5af6b4b7
SHA1 a672a1eb8ee10441cb106b4453dc257f092945ba
SHA256 0e704988e6694d8d95a92e349b957d44d07f409be91d2e08bc87b768e9f88c7d
SHA512 824ed0d7a6d35bcfead5fe5227b218f3d5ca197450ffc9291709306fa63f8af55672d350e6509c195675859fabfa284c024d4ef276bab3bafb9f22ca509a8df2

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240426-en

Max time kernel

144s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 193.83.221.88.in-addr.arpa udp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win10v2004-20240426-en

Max time kernel

134s

Max time network

107s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2376 wrote to memory of 1292 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2376 wrote to memory of 1292 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2376 wrote to memory of 1292 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1292 -ip 1292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.248:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 248.83.221.88.in-addr.arpa udp
BE 88.221.83.248:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-05-10 22:30

Reported

2024-05-10 22:35

Platform

win7-20240220-en

Max time kernel

133s

Max time network

134s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\resources\dist\pages\cantLoad.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421542236" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000fe9f866a4db63a99d96403d41734c147e7e17ee41671987d6d15515c3c2dc213000000000e800000000200002000000067ae4a42683841226ce1c251cf71b0213a87c0d918cce3c75a0dd1a53b3e3b2920000000d6e4123d0b137ec903e60e2d82ee01cec58514e8193d21644731c4d67660ffa440000000d6fb1c12e84ffac1eed54e1441d4574cd7dc301f4a7a0a11ab4974b34e9bb85b1b03cdb167db9e86a23f19b1ab4f3663a4b46f7d4a9062f55af16ee4e7472131 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b7700f2aa3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AE40141-0F1D-11EF-A296-4A24C526E2E4} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000093aafa086f376ba75069f5558ffa741e684d13bfeae1a25a305e68086a525e3f000000000e800000000200002000000034e986e1ee289055f4fff3aaaad0477b74cb209711da15c623404e72614ac264900000000e0b1a53e694b357c0667cbac849fba13ab8abbbb9a6f2c7c30ffef421152cf020edf484fd04d4bc660cbfd964d09d7adde190ed5d6dd5ad50fdddfe580c7924fa38d2b58a2ab8bc238661aa65f46c207d1aba1f08783004863ef68cd27c4e918175ff000352c345d26ee225cfa64fbc85edfc2af5f4145dfbad852d547374f7757e6ef802e1dcbc49cc82db78e271d540000000d493711d4d73fddb1e3b60054488977cc3885b6485c7c78b325a9b6e2132b4cc99c628df51d178903d4fc0ff1494fe653575c4469a3725da32e573a9dc9dd9c0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\resources\dist\pages\cantLoad.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab407C.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar416E.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ddd41b5717081ad326c1dca2ca1c6e32
SHA1 3627d11a2edfe19b3d4089749ccb6a4fe555cab8
SHA256 1d715c521f4b17f9a5b4b52505e3dd51d4008e5eb01fc6a729687b25ae7230c8
SHA512 833247ce9ecc087bb83b928fc4d98dd1a416102a378b18a01ead53a8f5ba1af79482a8209a31323928f18b19d1279c9d9c1687ccec2cb27a6c0d2f657c7156d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7d0e4a7a31939aa1b3a8ae8a1dbf3051
SHA1 6d00d5e7976d6c02f17dfc7cb7c1dbc6844b69f6
SHA256 c4e12e48d9a836d1d072e807a9bf026a3f04230e1f94370450b8ca46c13088f3
SHA512 788e0c69dce328a97c46df485cf5a4b8cd92b457ac1b4747178a19a8388121bf71825c609fd4fe3a0a46db26654ea0ea64b7a170cdee5d83aadeef201c9ec2ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 17fb48539c3f3067193fce5e2c72cfc5
SHA1 95df7caaea7463d21967a004837d1452d54857bf
SHA256 0ffa60e46908512d54e9a1550e9f8fab0e525b69dba6b4f87e44aba3f350fabe
SHA512 5ae5923d5574fc32ec3b4b0feffeb6ddf330e1c9c7dd1a093d98f8f50da87a4f78825aced92a04ad8b3ea49dbf34f74c90abf7e8ecbf660c9bf476907b998b27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c6cfb37932ee00d247891d70d91e8b40
SHA1 a98b647d562bcf98fc32e238b18ecfed6037b03d
SHA256 3bb4655562104721d6d4f00add876cc8b36dfefbcf75c228642edeef5d896930
SHA512 8f1ef4bc6965d6836f78cbe9a11a8e9d188cf7a8045acaebd0d9df03b4c128db79d10665a5f96e99db295ad4d373f5c28af625738a18a2f6e046bbc65a47b940

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61ac7ac191c0ebf3289f493a5fc6aea9
SHA1 b71f71cb371ec284b3ca11ac7e63f0b646a4f841
SHA256 08b1bfaa04290b8d9c761c5996a08c53c2d328dc1258985d6d5b566aa0a8ffc4
SHA512 a6c6249d39b7985978beff3f8e2bcf9eccb0163f0d8bb581b72c92649a3680d32477ea27722fd20ecca39210116a220cf9b48a4ac6841a8b881d1aaa7fc05d3a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c927a7a65dd0af76be7fba2b280570f7
SHA1 8840901ef83379b365b545d4dfc40e65b623cf8d
SHA256 09f641a6abe25d8ad27dbd4be0bb8ba98d1fb1e4846ef161b02854f65827917e
SHA512 9fd8015a82a1f0655dda817d615443c977c137067972049a736c853226a4b3150e848b77a628c2d04535c86b788704efce6ff356290dc4ef48c0ccc297fdb0d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d57df480b460e932f8f3c00e57fe5bcf
SHA1 9f35200c2b814225dcb0dbd4a37057c15c14d380
SHA256 3b01693137da9215ffa38b0acbeace5364538bf17ce8b816ad3c45b7b4631e9f
SHA512 77ebf34c4726999dfe39091fb5d632f4c02a6463b50b32b045cc2ea24cc9e1861db84ef57790d5a7b3b213272d98b8ae20186a2d97aed391c1b6cf5fafd13c18

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3b33f080c327d5d6610c9c219b2df342
SHA1 d41189aeca4db693b4dd6bb541aa0b3b8af5c2ee
SHA256 0248e8cf26f627f6375ab5898ccb266fbbfbb3e16eb4871d269a2e685fcd1f96
SHA512 0a5e53259a3c22bf3d727c65710601db2f112a6a4f1d0dccdd12a5793dd85b8967146d2d35d327a093cd2359968ca1f4251638b2a3c8bc5ef5199c26953ad69a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b5cba464c3026aa0d8468ee395a51d19
SHA1 1cf979a12cca140d89cc831dcff7b7092d7efaf8
SHA256 b3cc1870fdeb8a9eec1717c83a08dc7335c55d27fe285276514981102b0d59c9
SHA512 8a34ae2c8555f70cce33c7a23892e15f9f862f2a4bdfeb722f4e6da7d3e0028f122dbd53b92db3d4edcca20597d0bcb4d2cf1e8a8e9f8886cd481f4fe074e4cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c755695d5bc1e9d3bcad3b1679925c16
SHA1 cc3176f1f9329feb059e23dba4802330499dbb70
SHA256 546fcaabe86c757aec3c9b3a5cc04ad5b4fda03c997b9c5b1b5a70637f6f1ac5
SHA512 cf9a858072bf357f5a4879e03a37ffdfabcf12d96575ac70511b17720882df0faaba8619e70ff7b70d9c2650765cd470322d79cf4d8680f725cba31d939ca8d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fdf4356c1ae8e83079e598dc9bff45b2
SHA1 bb46d3d3b237b58cbbcf25539879c821700f4ea7
SHA256 be7c7574975ef344cc8051cf68f75c92f5e8fd19a9573df11b93b823116b05a7
SHA512 946c0bbeeeeb1e70a0e47bd3cbcb3a426f649d28c12bc08c2c68158c22c516b9f48e683743f0daaf77aea45eb3058c91f5cf8a22397959e8aadc695a591755f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51b60515fd0e987c1560f99b54a673e2
SHA1 b28535d75cd6afb3bd3043030e1d14a8c1a2b1fd
SHA256 d23ada4f13946ec87407b47031de383040cf5bd9c38fe93f93c17599116e7f11
SHA512 775efa4fd6ba7da98163c40c0bc02d4abcd800ae56ec9d5b96be4e571ac522503b8bf374a49aa5b0e491f7986ac194490f2b1c3608d49df41bca13296538c1eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 39871f7c59250aa4e3e9dfbe6aaac509
SHA1 5c27ea025b9b584fcdd7b890b7bfa6dea39b36b3
SHA256 66abacff7450abe9ba7bd275faec0ed894cdde3b63651c4c205ef23694a5ec42
SHA512 58d66ab073b07355bed7ce591b1e6842acd5347679b4a28c9d6bf0eb664c3a73805c495ceedd27d8a07ccb9ee1af3d3ae7c4a297b5ce650ea226036c36113982

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f0f13103751919b92de0bcc15f747995
SHA1 da488defa9c05eb9e5aae39bc1b361a639099dc8
SHA256 dfdd897c2bad96e05a3352deb3f010fa14a687314fd0a80f923099c1e0a736b5
SHA512 1dd9924edb80a70a7e3a4525b2fd11574bf80d8608ca46da78cb05efeadee817fe2a153833d8c8174327cec3295a915462bef7846b1339c3b894db4a428567a9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a76fe80db3433f5214c6868f8be31960
SHA1 6cbddff41b6a4f69a91fb87a80de47d4b7886ecd
SHA256 4d2f8486ea7f8e14ca07127bdb8a42e75385337a0b5f237e29a8688ea0b8dd0a
SHA512 279c4541056fbc7c11f00a0df860051c19591e26e6f3220c45097bda0c7cd03965fde4dd2ba195e0402a39134e62df5f3adbf9d909b9bc4a6e948acfebb8e51b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9d7018dd0898cfeb92f6c8ef1ff66bee
SHA1 f6496c6ee3dd5f02047294527fe8f2dcd1d2dc4e
SHA256 bc0bcd0718a61150d8805b991496425b3bc5c1a77a30e9da98ceb29c3b25a8e4
SHA512 30eaf90a20177ad1a19e3466545d18993ca849428133140fc81b45d0aff6083e4a74e05c7c82a8b63d4a62ee432b0aacf1ff57b3a8546957a2a7d04cec1fe4a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 976944078a1c04c946c50bd1aaf4d454
SHA1 60d8b990a177991a55614a7cf05bf20a989f0077
SHA256 61ffefe1388f0bc4b53c3975e4d8ea04be579cc0109dfc30ce7db0f36635ed60
SHA512 6061ab4fc3772246f8484f657ae60c5671745d7f2cfa4f53e0d10e8ec978b61decb953d2d29f6d8b4bacc7394982f4f9bebc04e40699fe91316e6fbd3a564011

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fdba1d5ac9f201d74208c6346c85c75e
SHA1 f8c6efb1724e83e2ce1ee1f9c8c221df948072d5
SHA256 d484a154728f8997b4647e314b3c4cb1523def01f8f724287e15f8af04bf1cc2
SHA512 a40104356f99d831408ab39d0cc40fb38f9100fa75fc38874a78b1eef8154bd16fd06636c72246d2d2d7d22a5286ca7b473b98ae6bfb14789a440e03ac0d79c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1191a6ebc5cd0bd7d4a6d5e262f66bbd
SHA1 1a02b14ed18d77e6e26ddf4bf5ccd50a0bf7d069
SHA256 53b911fb4131bf4dda5bd16b05d6e62d0b8998e8ad756d2fa21e0c78e1699594
SHA512 7283f0f44e1b6d7cbdf1b46fd0ea18b301c433c7886998534795950ae2f869b73f5073e3d4d8451c39e2043fc7675a149fd52dfc6fa3f46ff5bb5f708bb0578b