Malware Analysis Report

2024-12-08 02:56

Sample ID 240510-3spf5sgg7z
Target f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7
SHA256 f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7
Tags
discovery execution privateloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7

Threat Level: Known bad

The file f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7 was found to be: Known bad.

Malicious Activity Summary

discovery execution privateloader

Privateloader family

Checks computer location settings

Executes dropped EXE

Checks installed software on the system

Loads dropped DLL

Enumerates physical storage devices

Unsigned PE

Command and Scripting Interpreter: PowerShell

Program crash

Checks processor information in registry

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates processes with tasklist

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 23:48

Signatures

Privateloader family

privateloader

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240508-en

Max time kernel

121s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe"

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:52

Platform

win10v2004-20240226-en

Max time kernel

195s

Max time network

222s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bearly\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Bearly.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bearly C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bearly\URL Protocol C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bearly\ = "URL:bearly" C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bearly\shell\open\command C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bearly\shell C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\bearly\shell\open C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3132 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Windows\system32\reg.exe
PID 3132 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Windows\system32\reg.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe
PID 3132 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\Bearly.exe C:\Users\Admin\AppData\Local\Temp\Bearly.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe"

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

C:\Users\Admin\AppData\Local\Temp\Bearly.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Bearly /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Bearly\Crashpad --url=https://f.a.k/e --annotation=_productName=Bearly --annotation=_version=3.0.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=24.4.0 --initial-client-data=0x470,0x474,0x478,0x46c,0x47c,0x7ff755b4dc70,0x7ff755b4dc80,0x7ff755b4dc90

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,12419482319018407126,18057322455005694497,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1940 --field-trial-handle=1752,i,12419482319018407126,18057322455005694497,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2356 --field-trial-handle=1752,i,12419482319018407126,18057322455005694497,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bearly

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3364 --field-trial-handle=1752,i,12419482319018407126,18057322455005694497,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3632 --field-trial-handle=1752,i,12419482319018407126,18057322455005694497,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Temp\Bearly.exe

"C:\Users\Admin\AppData\Local\Temp\Bearly.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3588 --field-trial-handle=1752,i,12419482319018407126,18057322455005694497,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
GB 23.44.234.16:80 tcp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:443 dns.google udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 185.199.110.133:443 tcp
US 8.8.4.4:443 dns.google udp
US 172.67.74.15:443 tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 15.74.67.172.in-addr.arpa udp
NL 173.194.69.84:443 tcp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 34.120.195.249:443 tcp
DE 18.66.192.50:443 tcp
US 104.26.10.184:443 tcp
US 8.8.8.8:53 249.195.120.34.in-addr.arpa udp
US 8.8.8.8:53 50.192.66.18.in-addr.arpa udp
US 8.8.8.8:53 184.10.26.104.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 54.191.53.119:443 tcp
US 8.8.8.8:53 119.53.191.54.in-addr.arpa udp
DE 18.66.192.50:443 tcp
US 151.101.0.176:443 tcp
US 8.8.8.8:53 176.0.101.151.in-addr.arpa udp
US 54.187.119.242:443 tcp
US 54.187.119.242:443 tcp
US 8.8.8.8:53 242.119.187.54.in-addr.arpa udp
US 35.83.200.126:443 tcp
US 8.8.8.8:53 126.200.83.35.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 137.71.105.51.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp

Files

\??\pipe\crashpad_3132_KMLKQFFPYWSGITTI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\Bearly\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Bearly\config.json

MD5 1ffb53e0bcfa1dfde7672728e3114815
SHA1 ec46721ab0c27d9e707f63c2ee748c954d775de2
SHA256 8e3ed5120a02820b427cb66f4f10c93aa4ca6415f332686b39174a6e04a70c76
SHA512 5aaabd51ac0b126c05d881e07fdaf1d82e86f5c6b5aea347ea53ea507fad953409e213ca0ae05bbf0921b478b595fbdbfada1eafd5ec39fbb9454434f0f5d424

C:\Users\Admin\AppData\Roaming\Bearly\config.json

MD5 b571feedd7a6cfefa26b73514d57a7c7
SHA1 33d4945a08a2040a4707b44d21483cd00858cb7d
SHA256 bf7d1e5bafc682ba7bf07389750e4165fa3076e69625630998b4a528f5e6d635
SHA512 8d2f594f4f568005005f2ba23bdd67ccdfd4bf56ada577993aaed596c839263f223dc2180897b906d8a8e94fd060eccda97a6cc2f464bd507182db45f4a017c7

C:\Users\Admin\AppData\Roaming\Bearly\config.json

MD5 b3ed4e099f2fc7da4f4d8d42fb894e80
SHA1 f9969d8fbef1946bf6f57d6b7af06981b75d7ab9
SHA256 6b2c996a1bac93c2b2549db2cd81d888453ca9d088d3453b17657597d8bff56d
SHA512 b9d20078a583877fa58a9b4a50f63cf131a0a06eefa2da57d8c1f3160ad724e0f470cfd7e94f94b1b5c3c4ae750515e5953cc2b66d2adbb96bc78f1cfc1061eb

memory/1104-102-0x00007FFE8CAA0000-0x00007FFE8CAA1000-memory.dmp

memory/1104-103-0x00007FFE8C890000-0x00007FFE8C891000-memory.dmp

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\Bearly\Preferences

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

C:\Users\Admin\AppData\Roaming\Bearly\Preferences~RFe5937a0.TMP

MD5 d11dedf80b85d8d9be3fec6bb292f64b
SHA1 aab8783454819cd66ddf7871e887abdba138aef3
SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

memory/1104-155-0x0000020EA6BB0000-0x0000020EA72EF000-memory.dmp

memory/4704-158-0x000002782C630000-0x000002782CD6F000-memory.dmp

C:\Users\Admin\AppData\Roaming\Bearly\Network\TransportSecurity

MD5 7d552722aea07e57b37b4f0aaf6389f2
SHA1 3b265d8e6813177052ee47e8ada4d23968759c79
SHA256 0293b36885db06699f0a36568c9015e1905d3eb20e36be199eb38aec473b580d
SHA512 4701273c1a4289409c44e4bbc55e1cb8412e435aa1db5381e5387079f6e83c0ab5b54b34005c125b43baf60169dc139e712f81e6091dd5f4a95c02cec4cd9f1e

C:\Users\Admin\AppData\Roaming\Bearly\Network\TransportSecurity~RFe596911.TMP

MD5 20a2113f5d5b8e154f1021167564caa4
SHA1 50c2e7c1b36ce6d15a8935a138c17b69a19573ce
SHA256 ef22d4694c4f7b9c633e0de06aa2f5772211fcf66e9a2da930ae990fa03c5afa
SHA512 d55b09629a440f074b5e9c4c24435094bdecb0e69e20ed84f8a677cb8a2b7276e5eb337ce134e85e76d69860a32bdc95cc61cfcee06af20999ee6052f877f0df

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\ScriptCache\index-dir\the-real-index

MD5 aa5587c8851b33b35c6951c6ca64e1ce
SHA1 ed5f477b3f22e8778ab5013725212c19ba08da79
SHA256 9c4bbee08210174180d5457b5ac4d25480c53e3eec4286611e5eb6bc4b5f4011
SHA512 91184c7aa0da8925b46377ea39a225559097858b2b2a82074a456d949ed7d943c5222dac769a7e9f42099200cc338b8c971ea1f209051ec37dde88e803856ad2

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\ScriptCache\index-dir\the-real-index~RFe598488.TMP

MD5 d2be81e9055bfbfbf1a7cf94f949dd4e
SHA1 30fbf437c6f502d23822b9eecb5bdd76b06956d3
SHA256 73a3a072c9496761b87365d54737022409c2edb8fcf0799585ae22a5231c49da
SHA512 d9d559fdcf2534f6fc1301293ad15021693e92ddf6709b80bb4872d6888eb43ab88bff1d216f0af0bf5b7afc0cad45defdfa5a5deee7f1afc8d738c86471940f

C:\Users\Admin\AppData\Roaming\Bearly\Code Cache\js\index-dir\the-real-index

MD5 469942ea0e1b63e2312e6114e3a4d52e
SHA1 039fb2d750c77160ee1d62da43f226dbd1df5631
SHA256 7efdf493a767aef190e59b3d7052417e43ab06f0432e994acf1012f221cb6499
SHA512 f70fd0df779e6a56c332750dac8ae0088590af7033d00aaffb6d1251c3b9d76ec6dfedb0d777fde99ef003c4d5b1d1ac9fb117e0e62b4e45128000d23c958f3f

C:\Users\Admin\AppData\Roaming\Bearly\Code Cache\js\index-dir\the-real-index

MD5 350e6787f22b6665d43487b013acf1c4
SHA1 bf59fe7740a486fd3e44e1748d19b4d09e9957d0
SHA256 6fccdf7da040f962fdcdb89d96bb13ac567d6d0d8fdf876370971431c89a7c60
SHA512 eacec3a90dd80ec0e99fa60647c7fb8123490fa027b68575a4ad1a810369ed7c379ed1a49b806bbd18cfe19fb22c8f6d058e6e9d4a6dcefc1adcdadf5a40cc3d

C:\Users\Admin\AppData\Roaming\Bearly\Network\TransportSecurity

MD5 de9d2b6fdfb265753a5c73f8946da2db
SHA1 a8cf45a6fe56f2e100620b0c27a16b1abdb198e5
SHA256 43e8af85338bda7c8468f0fa0dbf63da2d589f36b2cf17c506a0199a9a779890
SHA512 dd54d3313c7b731cafb12dd4857c50e05e4bc25c327465696d8a2d78f4aa2ff434b6cd7c82440ab872f43cac8f3c99135c8cc4f04e5d1809f0ea8b09ad6e5381

C:\Users\Admin\AppData\Roaming\Bearly\Network\Network Persistent State

MD5 a0e032fece65e845022d9990c540e53f
SHA1 cb1b1036231ce2617a26b285d1bfc36725dc84ca
SHA256 ce2cb2e74274b3bccdb7805fc88dbc294d686b0571024cb0ed4a4eddb42c1d05
SHA512 5a3423746607fd3e60f14429433bbdae113c51ef479b97ffb9c391d22521d0b64b0e3d74a55b395f2f85186e7a6267ae3fab11427cdf953a2eeb198cae6df4b8

C:\Users\Admin\AppData\Roaming\Bearly\Network\Network Persistent State~RFe5a2442.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

memory/4156-224-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-223-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-222-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-235-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-234-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-233-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-232-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-231-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-230-0x000001B648270000-0x000001B648271000-memory.dmp

memory/4156-229-0x000001B648270000-0x000001B648271000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:52

Platform

win7-20240221-en

Max time kernel

117s

Max time network

156s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a41e583d66b5041f1a0ce993f6c3bd446ad5280864411609e09079ed04fafce7000000000e8000000002000020000000add1c04bea103bed77637615e394e3741ed0ffd9fb67e02aefe440163fbf453720000000374da5dc3f82b7e4b17edd4c8f7db0f1a3e372c8cc727be63e3c840f7e7c2a0c40000000ae6d6c859f3089adc544e28365c096de21d6550126edb16925501824f35b9ccecf6c021646578eea5c6439d122beb751c22a9d521e4830f33b43b06606df25ff C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421546882" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B5205C1-0F28-11EF-BF06-56D57A935C49} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000393fba45e62843c853430cc18b14414ff67188fd28e9f877badc4b05a8d04b26000000000e80000000020000200000002ea0cb69c1ab1d25d9e0147e257d65e409d7c6bf71fbb72b8cedacd7be3d594d9000000017bd645736a6d8bc080a83ee0ee9bf805db691e3edc7f7536d2315b01d6a4a116a8da486580cb02b166f32258535ac177a444a1208f5ab0def4789b59a1ad10e79b57e6cdf92e7c4a5bc77f0b56e42b6c71ff3e2a373b0579c428d9f8ac82023ab815bc8c9a464c3588f1b6b90d11f3d75d23276616d8a439be7c65386736d769beeef8dd54d10f343476f81d693cd7240000000e37a02f440bf2cefe43405948b6be2378dc71b56defab55a156465f66280e1050badaf88dbf0ebbd0280b70e14f26b5751fdb0b7067f6e7b1006c1463da661c2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60285ae134a3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabED3D.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fa468871de381db34d529ea3789abb8b
SHA1 d42c7f77d34eb580216b9bdd00a0a80269938c57
SHA256 26e1932ef5abcebba905f5f0b463f31ad5fc4508ed7fd3a79212f5ac768c304c
SHA512 ecae11d56dd8de0da3fa9ecbd967d4ed67ce65ccf71f880f4d6f078c8d0baefa78f2167cc85f5597e4c9c7a4ff9ba351dc4045f627996a82b5b84c52414f0949

C:\Users\Admin\AppData\Local\Temp\TarEEAD.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bbb5aba03146e451cdae5c98271f9af0
SHA1 30906a4cfafd10fe800433ea8c8aa9b110f97eb8
SHA256 b53773b4c465f314588a73d3f6e4951a5ba392d8354cb6333304ed7060038673
SHA512 bd6358bfb953899492d131d9980348ed0132412f1170f064c46792e28e678173c78394e7b496b0577f811b03c66137a9ee03bc6a1803f4f5c8afafef1e768840

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b489456db505f470ce0ccae9ea996cd
SHA1 626c26b9358ae6095470b46bffe98e5128596e41
SHA256 552d68f8b2c87c841a3ea7ededada58ce6ea3efe12044c8edab7d0d5ff17f1ed
SHA512 b6e5a58f99b9118b73cb71b49e2b8c8a754005aaaa9de48df69fb4988f9ffc4aea71b1fbb52d4be9987bc39eebeadddc1cdecd36fc4bfd5349d58f4cb0264587

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 634f3e72d6483129aeae478b4f52b34f
SHA1 1e1f743a949cf1481c951f2406e2dc4f03e82016
SHA256 a4717f0286f9ee986b6ae99cd0818b1f6474cd22f2f2967ff99e0573bc55e398
SHA512 b3af62c16ff42738dfddefb7b1329ae2d73ed6af2fdc39e2a57d0e864c5d0cdd3072b8400d20c952291feaf9efb71412c6fcb91803e3da0b48513a1c9f9bbde6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 037f8a474580be9f3ddfdf8a7997ef49
SHA1 73d05b8528fbf521a3ae79c79ec39881715ef71c
SHA256 80e585169f9e1a636af2f2e312e51f8cbe01cc70256eaf855f42a19ca76cfdd6
SHA512 08c33ceb1af975908fa6ffe30a3c5c9095bce4b94f4dde47a0ffe73b550d08cf7823e54ae47e4254d5fbf7557acd988b7ef1103aaf3d9136844f0e268749d15e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f83884bef85ec9785071fc8903c1f244
SHA1 635627077c369c5640e1b7ac8d0de8ce4c27fd60
SHA256 aa5c04b3dc6ab9c71d7790c3e26fa990e698c4b854136d2896e817452ba60c6a
SHA512 1aea577fe472e76f3b047c160a1b32176849ae8f9d5aa5f84325352bef35230670f23a647f5bd28e71398988ba590016b074794ea957399c840ba5a0b53c8640

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93405ece742f1db1202966db0a8f7429
SHA1 41a772c95050263b793bdb9a29b8276a0427a0f6
SHA256 770f6c50c25aa36d61167bc56f40135369cbb811b52f4799d19f7cb6e7a7cb07
SHA512 404ccf2e0fd6d440c7ff66d014e243f7e611938db6e117d30eebbfd14938b8f3717ba295bebdfbf7c44a7d2e1506c32a6219d7634d38f2b87fb79e07ff10afc6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 32a37d2af14a12fd8d8aa85aefc5648d
SHA1 938b7106a9eee57ac9ebfdae9318ede9ac28b282
SHA256 c7f12ca083d877270ab5091179679f1857fe548b1caff63e2c0518a98ad016af
SHA512 95f7d92e73a4462bd792197b79ae4984a35e38fc6c549a47bb2a7e40a263ea20c41b100677c8fea395290d0105a2c5a767982e3311a848dcf2a2dccc13f81ff7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 90c0f063a1654c6f4ac07e414c33e550
SHA1 acf1070936fa04401f517942af74a4a37608f24d
SHA256 47f04038aa06a416c1c7b369b1621c3fa4c91440679e80fc5d1e3bc5ead48593
SHA512 1beda5fcc8fd27a8c91ddeae6c681e51a606a0440b736f96888b4097c02c02fecbfc2b26d968e989ed0cf692dc8250724b8bc513d88175056f181640722e92d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78a589d6c98e0f03cafad5fca80ae690
SHA1 4705faae820c104f6f59c20ed67cadf190174292
SHA256 afb739e3a035a9c68bd73e45797e8c0105a0b09c091fb60d5610799e859ac595
SHA512 eebeca0eeb28ccd985f3b8701327f15fc5e5aec82716b0831442779d071667faf6ae1671c0cdff608a4eb42598053ba9f218dc74569d417d8370a4bc30df9370

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06445658d91533f0bc5960b31366d6da
SHA1 4ba65134dd77090f5fd24bf72ab3da8ca3b52a1e
SHA256 adb704b32b317732eeb7b756ea302a1c2a1558fc2ad3e2fbb414e7262a53f299
SHA512 589b2d305a49c344d99a038f72d00b758305d6a6beb5a4435c5bff56020d4f4a8dc85e5b6dc4726cb5f7d2b5a2553cae0ae379502e3475ffac5051b16181e2b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e97960ce1ae500ca2b85b83deb6ce052
SHA1 7ffffa3c5889d9ca5cc98894fb2d16f260c61a00
SHA256 4bac0f12b41c8e4be39d57d2195faec2d79eb154d1f2d99abdf09ff68a8aad2c
SHA512 3f8ac7526ff0d7c1e91edaad2df04013f60f34b03ad57654aa3dd431ee5ad683af50b30bbfb12e5083e3f85aacd5acaff3dd01980d6335988a92e1a249cd20b1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a392b7df701f7f085f291fabcf760173
SHA1 82b06ade8c93bcc73941a183d7ceffb3fdb74464
SHA256 6cfd2922f0d991a95d06dee8934096998256182e259dc9ecc73b979ff383eb45
SHA512 e9ace7e59a286866b5bdb0717c831b73be8d2d5c08f3b081ca11b8cee0d2fc5856e50c73f13d0c161a90919a3ec564509d0f248169928532d8b0d560e2f711f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 753d31bc627a621f508b2a70e4e56e09
SHA1 6ee63c1f9175e2e8cc9927a5c0385e7c14b57cd6
SHA256 fa11236417975499f05e8278ea4df259d153c1085070cad72c6b60f05cb4af84
SHA512 29ce5d94e3f71eb014a4ff1b8de808da1c439980735bca44f26ce8772534584d33110188fe2668e02a9fd0e1f1e1d3fb78e9bfa68f4d23ee2e0c617e74e05e16

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5219e75d168ad70768bd4a68228cda09
SHA1 f92eaf98c27da66cb6d1c10633c0b43c6c798757
SHA256 1e80e1d45a5a8d39fde8309b145964423c31c396c47f8f2727ff1c8e3cd93aa6
SHA512 1a7588c74001cdd95f63007d6e6e6752059eec37515d60306f141345638983aac210f9b4348da27a04d591d93a9da7cea2bb55ff21b004ee0cceace383e72637

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ac74b3a0391492b48037afcb5eb1ae0
SHA1 5fd5bc49e3c4ab0aec8b84c46e833c0fd22b44e2
SHA256 ea369dd54659336e239240c350366cb87d52d511f911a42241aec0969794f540
SHA512 62f6d3293b5af77ae5fa01a3a185ed4e990273d444e324872b946df668e7ee02c9c0f32d627c31cdf100e6dedca77e32482e8d4cb3c6f9580bb0ffe063e33f3a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b1ba3360b83ffa8d9e93c5c8f593bd36
SHA1 7fee569321595bc971505d7e672d9a55361de8d0
SHA256 f2f33edf708dcb38d2eca1745bc20e0d33d4cc891b32e043500f35967c37f7ff
SHA512 93d39cbf330be71950055fd2519ca49332430b128402506be1161562fca7262abc77e95f15a674b93914975ddf48c51c368c98e048b4fee362ccd25c6ca87eb1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6cfc58c6ce9380072992487542aaf76c
SHA1 6a7f0d1b146ed9ebe310e3b0a6f5d2d44e829926
SHA256 1ca4fa055036230858b3bdee047010f2126d84b1035a2882c25fca222de135ca
SHA512 70badbbacdd67b5efdadb1308f7e9a2f108afb4926a38902db6715d991e269a042ee065b5d411c1f9e0ac0a796a7bc89a7e06dba4a48c857e268f81323a2d847

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 825f05fcf79af23b3965a5120c499d91
SHA1 ad9124768c5a7c8e4da4f54b828e79abf2e8ca4d
SHA256 0250d55b13c54310fdfb6689f1ce0932624ba5224b2d169f0bac32cf912454a9
SHA512 da9dda5eb8faff7cb8a47b0454d322eea5b1cfba7e8bbee240dae7d4c4db96656c24d4da0fe712c3fad53b5a9d2a0d045a87b7dabb14e574f2296f0368ab6418

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15788eab7f54c102af171c75b56b2569
SHA1 7f76c5193a46f7ecb3143c640fe754bd517d5110
SHA256 e6e64afbf41fa85740876ccd2018f351f0c2bfbdf13ef95e9effc525a7278746
SHA512 05dd80f073b5f06a5d32cf33029d7ce1b49d001661699e4d5687c9a2367fa4f3bb89b2e82c2e9971af90c9aa06439bf22935c574f479b9cd26194b4f4e289938

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:52

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
NL 23.62.61.97:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Checks installed software on the system

discovery

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\bearly\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bearly\\Bearly.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\bearly C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\bearly\URL Protocol C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\bearly\ = "URL:bearly" C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\bearly\shell\open\command C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\bearly\shell C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\bearly\shell\open C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4664 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 4664 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 4664 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 1340 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1340 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1340 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1340 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1340 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1340 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 3768 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Windows\system32\reg.exe
PID 3768 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Windows\system32\reg.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe
PID 3768 wrote to memory of 7808 N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe

"C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Bearly.exe" | %SYSTEMROOT%\System32\find.exe "Bearly.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Bearly.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "Bearly.exe"

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe"

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Bearly /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Bearly\Crashpad --url=https://f.a.k/e --annotation=_productName=Bearly --annotation=_version=3.0.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=24.4.0 --initial-client-data=0x460,0x468,0x46c,0x43c,0x470,0x7ff75fdcdc70,0x7ff75fdcdc80,0x7ff75fdcdc90

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,5823892703017653033,5640470725411651452,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1920 --field-trial-handle=1756,i,5823892703017653033,5640470725411651452,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Bearly\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2320 --field-trial-handle=1756,i,5823892703017653033,5640470725411651452,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bearly

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Bearly\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3576 --field-trial-handle=1756,i,5823892703017653033,5640470725411651452,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Bearly\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3756 --field-trial-handle=1756,i,5823892703017653033,5640470725411651452,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Bearly" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1756,i,5823892703017653033,5640470725411651452,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 bearly.ai udp
US 8.8.8.8:53 bearly.ai udp
US 104.26.11.184:443 bearly.ai tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 184.11.26.104.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 o4504114762612736.ingest.sentry.io udp
US 8.8.8.8:53 o4504114762612736.ingest.sentry.io udp
US 8.8.8.8:53 js.stripe.com udp
US 8.8.8.8:53 js.stripe.com udp
US 34.120.195.249:443 o4504114762612736.ingest.sentry.io tcp
US 151.101.0.176:443 js.stripe.com tcp
US 34.120.195.249:443 o4504114762612736.ingest.sentry.io udp
US 34.120.195.249:443 o4504114762612736.ingest.sentry.io tcp
US 8.8.8.8:53 exec.bearly.ai udp
US 8.8.8.8:53 exec.bearly.ai udp
US 172.67.74.15:443 exec.bearly.ai tcp
US 8.8.8.8:53 249.195.120.34.in-addr.arpa udp
US 8.8.8.8:53 176.0.101.151.in-addr.arpa udp
US 8.8.8.8:53 15.74.67.172.in-addr.arpa udp
US 151.101.0.176:443 js.stripe.com tcp
US 8.8.8.8:53 m.stripe.network udp
US 8.8.8.8:53 m.stripe.network udp
DE 18.66.192.96:443 m.stripe.network tcp
US 8.8.8.8:53 api2.amplitude.com udp
US 8.8.8.8:53 api2.amplitude.com udp
US 44.233.224.35:443 api2.amplitude.com tcp
US 8.8.8.8:53 35.224.233.44.in-addr.arpa udp
US 8.8.8.8:53 96.192.66.18.in-addr.arpa udp
US 8.8.8.8:53 m.stripe.com udp
US 8.8.8.8:53 m.stripe.com udp
US 44.229.0.33:443 m.stripe.com tcp
US 8.8.8.8:53 r.stripe.com udp
US 8.8.8.8:53 r.stripe.com udp
US 54.186.23.98:443 r.stripe.com tcp
US 54.186.23.98:443 r.stripe.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 98.23.186.54.in-addr.arpa udp
US 8.8.8.8:53 33.0.229.44.in-addr.arpa udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\chrome_100_percent.pak

MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\chrome_200_percent.pak

MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\libEGL.dll

MD5 6426112edaa62ca308f7f32d26d4f6ad
SHA1 3edfd900da6a5fb1c67c41e18ea0ec9a2752ba2e
SHA256 a23882d8555d8c3f1d27ba39b0225d68bc446e250d19d36aff4ef65d221458a3
SHA512 f967dea3f18ab81c8ca72b722962944b9a874cfda4c95237e96b1e989ff3657a087957c1ff2c374616ed2e49a75f2786174ff8972a3447589468dfafaf4db582

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\ffmpeg.dll

MD5 d8cd1aca8dd3a91d0bf32da2e746545e
SHA1 6a28b357d93fbb3502bc386019899c9f3633b069
SHA256 5b831daa8515b3d1f346b481ec04f881a3fe728944e966624489d3a3872a40bf
SHA512 af70b88194539cdebf353df0927671babbd51f3cdb304cf31dc5c29d65dea1e38136d7389ba48aa0829855d62eeb740f3df12ab981153c7f2eb70ed1e74fbcbb

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\libGLESv2.dll

MD5 b7214621f818dfe440ade5b2f3619519
SHA1 4b95d412e49f2e4c3ce71e10b2d76df3ab63547c
SHA256 59133f095f941eb8d6b3613fd08b98e6d84e8290f3f72ded6d98c8683582f188
SHA512 d8195862a8d6ca8de5aa4096ce1feabda3f8375279904124e80451ef22d1ae13e4de35487afe36996d0b51edc16c48ddda03c5c2b14f4bd5e465ed48e9e3d29b

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\LICENSES.chromium.html

MD5 312446edf757f7e92aad311f625cef2a
SHA1 91102d30d5abcfa7b6ec732e3682fb9c77279ba3
SHA256 c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
SHA512 dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\vulkan-1.dll

MD5 8439213fbb22a848ce814982d502bdc4
SHA1 6c5831de36a539c0689410b00f1b8aa1dc6f7c2d
SHA256 e69f794109b12523de314a471c56278cd921be58facbd18ec351685d15894cc0
SHA512 e4e570e5b98420d99634167e0d9f920cba27fc4b8e91c70cc4e5b33a4b3299a69ce9b294aae538aeb150135378978a6c7b0644a645b797ab230e185593c828c0

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\vk_swiftshader.dll

MD5 3eb74d173ef00f7c510b11e61c5ab52f
SHA1 13cfe224f966145d7f90640b080bef5dd4d0ff42
SHA256 0749491928a69673f17d39eb674f9a416e789e4fddec48ebb54714914343b48a
SHA512 423ab3765aa01cf39fa31d068ddb761ad93707cb06f57b4e674311c91c5cc9d238c231d1e6882f8d3525d16fea0d8f8db8d0a74bb55309f5a120cbe4a34e40bd

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\v8_context_snapshot.bin

MD5 5a072b0edc88a0b18e1c56a307a341cd
SHA1 20ee0b6521e12dfc4f378eb8d5724456e22e90fd
SHA256 878046ea578d24595d060583cf8f9618aba37d23c603499068e5762dd5509aa1
SHA512 c3a51850d939eea9b5d8926795cdc3e56962ec9eeabb3b80ed62a9c77ae5d6b696528d03a469c212b99d83ec303367f3353cc0fff459e7e577254f037f8fd995

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\bn.pak

MD5 8feb4092426a0c2c167c0674114b014d
SHA1 6fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256 fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA512 3de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\bg.pak

MD5 945de8a62865092b8100e93ea3e9828d
SHA1 18d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256 f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA512 5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ar.pak

MD5 56f6dc44cc50fc98314d0f88fcc2a962
SHA1 b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256 7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512 594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\am.pak

MD5 c6ef9c40b48a069b70ed3335b52a9a9c
SHA1 d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA256 73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA512 33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\af.pak

MD5 7e51349edc7e6aed122bfa00970fab80
SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\cs.pak

MD5 a934431d469d19a274243f88bb5ac6fb
SHA1 146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256 51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512 562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\fil.pak

MD5 3165351c55e3408eaa7b661fa9dc8924
SHA1 181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA256 2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA512 3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\lt.pak

MD5 96602a3f3b59faa997a4d337889fa02b
SHA1 94593a270b0d84c006e0959bc136b6c4987dfd3f
SHA256 51db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512 dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\sv.pak

MD5 bbe0785c5f9591e8a1e7c4830fe949d6
SHA1 da4f3286079d50e1c04e923529e03e7d334c7fff
SHA256 0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA512 38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ta.pak

MD5 a8beab6896018a6d37f9b2e5bdd7a78c
SHA1 64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256 c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512 73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\sw.pak

MD5 ee8da42ffe40fbb916c56390e2cd99e8
SHA1 6d824f56afe6b3605a881d2c26e69a46e6675347
SHA256 192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA512 7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\uk.pak

MD5 e4c4e3700469704b936460ca1a90fcc0
SHA1 e809990fc07a1d39fe623046382699e648e343c0
SHA256 29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA512 68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\resources\dist\pages\icon-text-logo.svg

MD5 9e058d4bc591160ec98e36aa65031b48
SHA1 36254fd3bdb61ac27344a69594d91009122808fe
SHA256 a6feedf1437cf6026a950771aee3798a310ad554ddf00508282bba9c50e48c79
SHA512 4e0d4edc0385d9b114f0553c3b182313507ca08e3c680bdb78c7ef05e019b2d4b56a84801792d0923bf16b993918ad72b0029199adc52daa951b209a6c62a125

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\resources\extraResources\[email protected]

MD5 e9b992be1a5ea38cfdbc31508d80b3b9
SHA1 e8395346ff49413abda7950807938baaaeee042d
SHA256 ca3525faef577979cc300996b230ab12f58b539d1361e2831868d515068c2346
SHA512 930501bf1c6d71a2907217bd4c8bfe0231d890f1f665d51963b3011c805a305246d6e4e0ecf6cf6efad37edde6ffed3c7dd088594ac24aab1e13fabd21a35e1a

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\resources\extraResources\IconTemplate.png

MD5 2c761c4c5b466c0d6c3fb51907f4a587
SHA1 72bb96c24004b9cf6abde1ae870ebb2315169855
SHA256 c0abd9c5ecfb3cfcd8ef51d6efd969cacfc2c13c59815d067573977664461eec
SHA512 9722b18a6342ea91e5094b41b31eb2bbed4c2fb773f6309b9ad238dd52260773ed3e0ebfa38469ac970b51bf2665f45086fd112f1eb0390513665094b91ea560

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\resources\dist\pages\cantLoad.html

MD5 af0ebfabf769eacba4deb6fbc9f002ce
SHA1 8b18e6f7c70bf329bb5f9f4c2436c7d6f95faed4
SHA256 6bc293fd068ddac9c3d92116e09417ac768336c76b748fccdc9f167e6466c1d4
SHA512 85d744eb091ed3a9e5b14eb4d87c5233b9909c732c5902c50a2cd38a9645a65dae8723f3773758e02a1a8c591da98fc589377702863090acb527fb20ceded709

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\resources\elevate.exe

MD5 86050c2cbb9f996c1d7b5116fc67b21e
SHA1 59ec79f38d3a3bbe5b63b464bc720b426d7c300a
SHA256 288bce90fd6ffb1dd260f71f73765b9931c45015c3a963514855ae78f1becb9a
SHA512 9d4a1eb417b809299b9eeafc90323032dbea5b0ae9ddc799af6e4e36ecef61d2518dc4756bb4ac398d396926eb72e6886cb64c568dfad80e51c5320a74943b8f

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\resources\app.asar

MD5 dcf84c7c6436284959898ff76df2601a
SHA1 d64896cf933ef8399c23f678e2b5529c1074e8f9
SHA256 9ab65922798b5f5c4056de45e44a5fdccc489a6321a3cabbfbd99d8ca9daa896
SHA512 1e1361c6ec01637d83e340ef4069f5043fec4aa750df1fcaed5c9ef88e2a90108ca345789ef3053ca7970ebed73d9ab9cd66d5fdcb409038d4618de2037d4f80

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\resources\app-update.yml

MD5 1f3fc4ed1c35754da78d76ac2355e681
SHA1 52a2ec4a1267e6b51fb9e376f38dd174799f57f3
SHA256 08c1434ebe835e19645d055993023f8b8048ef6025792bd2ce685ef33f34abe3
SHA512 155895169d921772c125922c82785b34e59ae0b35f909543bbcbb52b88f9b857d2997de335ea87cc4f582d8b928598de4addde423d21953d29d9e3e27932adbb

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\zh-TW.pak

MD5 8f67a9f38ad36d7d4a6b48e63852208d
SHA1 f087c85c51bdbdef5998cfc3790835da95da982a
SHA256 92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512 623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\zh-CN.pak

MD5 9d4f54eb5a12cf4c2f34f5f538dff90b
SHA1 c31b892ce78c733bde0571b6236170103cc9fe7a
SHA256 58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA512 46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\vi.pak

MD5 9274866d7c6314f43dd63ed293293e25
SHA1 4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256 dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512 3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ur.pak

MD5 d7ec7d551dee1e1ef11be3e2820052f9
SHA1 d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA256 05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA512 92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\tr.pak

MD5 9f24f44cac0997e1d0a6a419520f3bfe
SHA1 edb61859cbb5d77c666aac98379d4155188f4ff5
SHA256 3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA512 65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\th.pak

MD5 293ad7c20c22d744e4db0fb001ec45bb
SHA1 486c9e0732306a45aceb633da2b3ded281197620
SHA256 d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512 ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\te.pak

MD5 02415ded02cc7ac25e8f8d0e83365061
SHA1 5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA256 97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA512 54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\sr.pak

MD5 cf160983a86b51ec42845f4e60ac9123
SHA1 4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256 ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512 b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\sl.pak

MD5 4d9d56ef0b176e7f7aa14270e964ec77
SHA1 515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA256 6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512 740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\sk.pak

MD5 793c442420f27d54410cdb8d8ecce5ff
SHA1 8995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA256 5a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512 291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ru.pak

MD5 fc0e2fc09aa9089c5db75bab7a0754a7
SHA1 f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256 188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512 377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ro.pak

MD5 19cfc7c8f1a2e4a2de1f9f64475469bc
SHA1 bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA256 3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512 ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\pt-PT.pak

MD5 acffa29064f40a014bc7fe13e5ff58a9
SHA1 5a0890c94084075446264469818753f699a3d154
SHA256 423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512 d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\pt-BR.pak

MD5 a23c805ee4d3d67c811b50826ca25a51
SHA1 c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA256 62be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512 c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\pl.pak

MD5 61c093fac4021062e1838a32d79399c2
SHA1 84a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA256 58067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512 475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\nl.pak

MD5 bc41967b2ff493e7f151c7721245739d
SHA1 7606133ddbb58492dbbf02c03a975fb48da1e26f
SHA256 3dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA512 9e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\nb.pak

MD5 7576c2fa9199a4121bc4a50ff6c439c3
SHA1 55e3e2e651353e7566ed4dbe082ffc834363752b
SHA256 2a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA512 86c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ms.pak

MD5 9b3e2f3c49897228d51a324ab625eb45
SHA1 8f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA256 61a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512 409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\mr.pak

MD5 25f2b9842e2c4c026e0fc4bc191a6915
SHA1 7de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256 771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512 ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ml.pak

MD5 3b1305ecca60fb5a7b3224a70398ead9
SHA1 04e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256 c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA512 68fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\lv.pak

MD5 e4f7d9e385cb525e762ece1aa243e818
SHA1 689d784379bac189742b74cd8700c687feeeded1
SHA256 523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512 e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ko.pak

MD5 b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1 050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256 ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512 b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\kn.pak

MD5 a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1 f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA256 3c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512 f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ja.pak

MD5 f47efaa76f5200a6c0c23c33684d7bad
SHA1 9b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA256 5b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA512 67d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\it.pak

MD5 7c981a25be0e02fba150e17d9669a536
SHA1 3af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256 ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512 445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\id.pak

MD5 bd9636e9c7dc7be4c7f53fb0b886be04
SHA1 55421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA256 5761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA512 7c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\hu.pak

MD5 b338dcb0e672fb7b2910ce2f561a8e38
SHA1 cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256 bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512 f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\hr.pak

MD5 105472bc766a30bb71f13d86081de68d
SHA1 d014103ad930889239efd92ecfdfcc669312af6c
SHA256 a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512 ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\hi.pak

MD5 b7e4892b2030e4f916364856b6cc470a
SHA1 b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256 093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512 ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\he.pak

MD5 93d9261f91bcd80d7f33f87bad35dda4
SHA1 a498434fd2339c5d6465a28d8babb80607db1b65
SHA256 31661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512 f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\gu.pak

MD5 7b5f52f72d3a93f76337d5cf3168ebd1
SHA1 00d444b5a7f73f566e98abadf867e6bb27433091
SHA256 798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA512 10c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\fr.pak

MD5 0445700799de14382201f2b8b840c639
SHA1 b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA256 9a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512 423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\fi.pak

MD5 5518b51d4af7f1b9d686cbea28b69e71
SHA1 df7f70846f059826c792a831e32247b2294c8e52
SHA256 8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512 b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\fa.pak

MD5 dcd3b982a52cdf8510a54830f270e391
SHA1 3e0802460950512b98cd124ff9f1f53827e3437e
SHA256 e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA512 3d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\et.pak

MD5 a94e1775f91ea8622f82ae5ab5ba6765
SHA1 ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA256 1606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512 a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\es.pak

MD5 e9fa4cada447b507878a568f82266353
SHA1 4a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256 186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA512 1e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\es-419.pak

MD5 5321c1e88c5c6fa20bdbc16043c6d0f6
SHA1 07b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256 f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512 121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\en-US.pak

MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\en-GB.pak

MD5 0db7f3a3ba228aa7f2457db1aa58d002
SHA1 bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256 cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA512 9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\el.pak

MD5 6922aaa87431699787c1489e89af17b9
SHA1 6fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256 800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512 367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\de.pak

MD5 ed329b35d10e81f55d611fe8748876f8
SHA1 0d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA256 6facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512 bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\da.pak

MD5 bb5252dc6f0f3c01ce3638138bf946c8
SHA1 bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256 c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512 e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\locales\ca.pak

MD5 01acd6f7a4ea85d8e63099ce1262fbad
SHA1 f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256 b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA512 2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\snapshot_blob.bin

MD5 840169fda65be2a18c85e7dd44ec6051
SHA1 5080736e613be6e11242d37adef740cac0bf8cd1
SHA256 80e58621229b4cb6104ce7f65ebce979a6ebe3eac750447d037660cec34ad0b3
SHA512 2e65ac47ff05830eb0942288daf66468fbd34a1fbc1010f0bcdaca873f4d110ae8f88e825dec7e86dcd7b11dee7a003c29350e3377abd9f886b028cdbb830644

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\7z-out\resources.pak

MD5 a8502a5d32543474520dd8cf1a871b60
SHA1 4b2b4e61a8105dd9583c12e9adfd307c113907c8
SHA256 b6420c40d7d9b4971f6c99a3fd108e10c7e4e6bb95fa655a5a1b00ff2bab36dd
SHA512 c73e578d9b8a990ad11c218c096fc8d8a5d283a3fee4388ef40b4140e14504498f3e376b4b86d0d789dd9cd1dc8957d749a86f59cdf199f85daa28490c129658

C:\Users\Admin\AppData\Local\Temp\nsz5276.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

\??\pipe\crashpad_3768_RYZKJRRHXINOAOXL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\Bearly\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\Bearly\config.json.tmp-5384948077995f45

MD5 b571feedd7a6cfefa26b73514d57a7c7
SHA1 33d4945a08a2040a4707b44d21483cd00858cb7d
SHA256 bf7d1e5bafc682ba7bf07389750e4165fa3076e69625630998b4a528f5e6d635
SHA512 8d2f594f4f568005005f2ba23bdd67ccdfd4bf56ada577993aaed596c839263f223dc2180897b906d8a8e94fd060eccda97a6cc2f464bd507182db45f4a017c7

C:\Users\Admin\AppData\Roaming\Bearly\config.json.tmp-5384948193f395e1

MD5 0c2bb92bc63d59da117b6542b8ca9edb
SHA1 1841f159e4e2074fd921877937016a21ff4f0f90
SHA256 dc011a83b38ed30c2eb64000cd76d92dd2fa807170fbe2dbab77bc5221471ab3
SHA512 8b4f251a74afe73a4c8fa003b5e0d65b33ac642567c73500783f1339e892fe76f3e524d5b56faf0bdff6a799c9581136fe33ac6fc1f135400440ce05abd57e9f

C:\Users\Admin\AppData\Roaming\Bearly\config.json

MD5 1ffb53e0bcfa1dfde7672728e3114815
SHA1 ec46721ab0c27d9e707f63c2ee748c954d775de2
SHA256 8e3ed5120a02820b427cb66f4f10c93aa4ca6415f332686b39174a6e04a70c76
SHA512 5aaabd51ac0b126c05d881e07fdaf1d82e86f5c6b5aea347ea53ea507fad953409e213ca0ae05bbf0921b478b595fbdbfada1eafd5ec39fbb9454434f0f5d424

memory/7808-1804-0x00007FFDD3C40000-0x00007FFDD3C41000-memory.dmp

memory/7808-1803-0x00007FFDD3430000-0x00007FFDD3431000-memory.dmp

C:\Users\Admin\AppData\Roaming\Bearly\98ec6911-d079-4d43-8498-9289875152f2.tmp

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

memory/7808-1842-0x00000187BC1D0000-0x00000187BC27D000-memory.dmp

memory/7968-1843-0x0000025A4FCE0000-0x0000025A4FD8D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\ScriptCache\index-dir\the-real-index

MD5 ef62667afa33a62f2f9213439c3502db
SHA1 5d9121bf4d9ec7edb3b657a0cb1f02b84690ea78
SHA256 f051189e142ad7875131adb2dd90dc1dbb5f31a3900461ea2b14a5a9b39405c2
SHA512 408341601f6dff33b8f2750a1b8d512c052d583e3ed900170109bcfa7436125d1340c3049c8987cc9883378ba206201974b61c3456f30990e7dc3815ce2ed9da

C:\Users\Admin\AppData\Roaming\Bearly\Service Worker\ScriptCache\index-dir\the-real-index~RFe57db7b.TMP

MD5 8fc65572354a104b4b922f902be42f89
SHA1 817372254b1a1fcba853a5fed6373cf7ef473675
SHA256 68410668f8289c0c4aef85ef42d7bfeb25bc104cba7541ddce6db575f410ab09
SHA512 573c4202392c426476d75cb2e83a875f91e98fa69487b3eb57647b3b901367891e799eb75e328a1e8c0122e07f9f9194cba1c2c732bbf2f11ae859489d02c008

C:\Users\Admin\AppData\Roaming\Bearly\Code Cache\js\index-dir\the-real-index

MD5 8f4e887121b17965c0f3ede8d53c8826
SHA1 fa6ea43c4063e598d4f8c6440c306e521e722deb
SHA256 dc071fc45d31f524d5562ccd225a74edb46a0da6263030970f6353f7b4c3de85
SHA512 25ffb980c4d1d59b7e8d95f7ffd064833a942af472faa9d6cb62d0bc3705851ea70383c8ffa73ae766348a635af839dfbdb7741c9443ecfb78aedbaf751a6812

C:\Users\Admin\AppData\Roaming\Bearly\Code Cache\js\index-dir\the-real-index

MD5 0c18be4916f94667f44332201a98c217
SHA1 1dc8c3e0b36df42ab2625d8c652c309b420e45c5
SHA256 1f5b0fd5c7cb06fd4acdf294cd8cb96f9e18a0390d971a15b3a32b6f47673600
SHA512 e41d83204e5d76dadccff482d18aab31dee52d572a2941cb0ad37f3e69ba0f85eb6e0c9cdd2097cb2f579821b607e496d965d4f178801fb50fe5a1765be7be1e

C:\Users\Admin\AppData\Roaming\Bearly\Network\Network Persistent State

MD5 f0506445c5b89d4c713d7babf7f89a2f
SHA1 eb72fd7aa00173034a5f1cee06cd59c483681f36
SHA256 2dd4f5a140c0642057561269eb93943ab40f232030b5a6de8d63019a6c1d8e7b
SHA512 7821b673daa14221f59ace5f242e3b91aa86c3e12667141605a77979dbfd47ce78b795839cffee091fc98c5ac77d97f57496250ae1d3f9a47ec6ae948926f34c

C:\Users\Admin\AppData\Roaming\Bearly\Network\Network Persistent State~RFe589bdd.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

memory/2204-1895-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1896-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1897-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1901-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1903-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1907-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1906-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1905-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1904-0x000001F639770000-0x000001F639771000-memory.dmp

memory/2204-1902-0x000001F639770000-0x000001F639771000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240221-en

Max time kernel

122s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 220

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240426-en

Max time kernel

129s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1928 wrote to memory of 2852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1928 wrote to memory of 2852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1928 wrote to memory of 2852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2852 -ip 2852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240508-en

Max time kernel

90s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

158s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 137.126.19.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/1716-0-0x00007FFB062F3000-0x00007FFB062F5000-memory.dmp

memory/1716-1-0x000001602FAA0000-0x000001602FAC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uwfbmq5y.qmn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1716-11-0x00007FFB062F0000-0x00007FFB06DB1000-memory.dmp

memory/1716-12-0x00007FFB062F0000-0x00007FFB06DB1000-memory.dmp

memory/1716-13-0x00007FFB062F0000-0x00007FFB06DB1000-memory.dmp

memory/1716-16-0x00007FFB062F0000-0x00007FFB06DB1000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240221-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe"

Signatures

Checks installed software on the system

discovery

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2324 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2656 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2656 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2656 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2656 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2656 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2656 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2656 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe

"C:\Users\Admin\AppData\Local\Temp\f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Bearly.exe" | %SYSTEMROOT%\System32\find.exe "Bearly.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Bearly.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "Bearly.exe"

C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe

"C:\Users\Admin\AppData\Local\Programs\Bearly\Bearly.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\chrome_100_percent.pak

MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\chrome_200_percent.pak

MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\ffmpeg.dll

MD5 d8cd1aca8dd3a91d0bf32da2e746545e
SHA1 6a28b357d93fbb3502bc386019899c9f3633b069
SHA256 5b831daa8515b3d1f346b481ec04f881a3fe728944e966624489d3a3872a40bf
SHA512 af70b88194539cdebf353df0927671babbd51f3cdb304cf31dc5c29d65dea1e38136d7389ba48aa0829855d62eeb740f3df12ab981153c7f2eb70ed1e74fbcbb

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\vulkan-1.dll

MD5 8439213fbb22a848ce814982d502bdc4
SHA1 6c5831de36a539c0689410b00f1b8aa1dc6f7c2d
SHA256 e69f794109b12523de314a471c56278cd921be58facbd18ec351685d15894cc0
SHA512 e4e570e5b98420d99634167e0d9f920cba27fc4b8e91c70cc4e5b33a4b3299a69ce9b294aae538aeb150135378978a6c7b0644a645b797ab230e185593c828c0

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\vk_swiftshader.dll

MD5 3eb74d173ef00f7c510b11e61c5ab52f
SHA1 13cfe224f966145d7f90640b080bef5dd4d0ff42
SHA256 0749491928a69673f17d39eb674f9a416e789e4fddec48ebb54714914343b48a
SHA512 423ab3765aa01cf39fa31d068ddb761ad93707cb06f57b4e674311c91c5cc9d238c231d1e6882f8d3525d16fea0d8f8db8d0a74bb55309f5a120cbe4a34e40bd

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\v8_context_snapshot.bin

MD5 5a072b0edc88a0b18e1c56a307a341cd
SHA1 20ee0b6521e12dfc4f378eb8d5724456e22e90fd
SHA256 878046ea578d24595d060583cf8f9618aba37d23c603499068e5762dd5509aa1
SHA512 c3a51850d939eea9b5d8926795cdc3e56962ec9eeabb3b80ed62a9c77ae5d6b696528d03a469c212b99d83ec303367f3353cc0fff459e7e577254f037f8fd995

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\snapshot_blob.bin

MD5 840169fda65be2a18c85e7dd44ec6051
SHA1 5080736e613be6e11242d37adef740cac0bf8cd1
SHA256 80e58621229b4cb6104ce7f65ebce979a6ebe3eac750447d037660cec34ad0b3
SHA512 2e65ac47ff05830eb0942288daf66468fbd34a1fbc1010f0bcdaca873f4d110ae8f88e825dec7e86dcd7b11dee7a003c29350e3377abd9f886b028cdbb830644

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\resources.pak

MD5 a8502a5d32543474520dd8cf1a871b60
SHA1 4b2b4e61a8105dd9583c12e9adfd307c113907c8
SHA256 b6420c40d7d9b4971f6c99a3fd108e10c7e4e6bb95fa655a5a1b00ff2bab36dd
SHA512 c73e578d9b8a990ad11c218c096fc8d8a5d283a3fee4388ef40b4140e14504498f3e376b4b86d0d789dd9cd1dc8957d749a86f59cdf199f85daa28490c129658

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\LICENSES.chromium.html

MD5 312446edf757f7e92aad311f625cef2a
SHA1 91102d30d5abcfa7b6ec732e3682fb9c77279ba3
SHA256 c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
SHA512 dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\libGLESv2.dll

MD5 b7214621f818dfe440ade5b2f3619519
SHA1 4b95d412e49f2e4c3ce71e10b2d76df3ab63547c
SHA256 59133f095f941eb8d6b3613fd08b98e6d84e8290f3f72ded6d98c8683582f188
SHA512 d8195862a8d6ca8de5aa4096ce1feabda3f8375279904124e80451ef22d1ae13e4de35487afe36996d0b51edc16c48ddda03c5c2b14f4bd5e465ed48e9e3d29b

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\libEGL.dll

MD5 6426112edaa62ca308f7f32d26d4f6ad
SHA1 3edfd900da6a5fb1c67c41e18ea0ec9a2752ba2e
SHA256 a23882d8555d8c3f1d27ba39b0225d68bc446e250d19d36aff4ef65d221458a3
SHA512 f967dea3f18ab81c8ca72b722962944b9a874cfda4c95237e96b1e989ff3657a087957c1ff2c374616ed2e49a75f2786174ff8972a3447589468dfafaf4db582

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ar.pak

MD5 56f6dc44cc50fc98314d0f88fcc2a962
SHA1 b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256 7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512 594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\am.pak

MD5 c6ef9c40b48a069b70ed3335b52a9a9c
SHA1 d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA256 73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA512 33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\af.pak

MD5 7e51349edc7e6aed122bfa00970fab80
SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\bg.pak

MD5 945de8a62865092b8100e93ea3e9828d
SHA1 18d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256 f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA512 5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ca.pak

MD5 01acd6f7a4ea85d8e63099ce1262fbad
SHA1 f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256 b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA512 2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\bn.pak

MD5 8feb4092426a0c2c167c0674114b014d
SHA1 6fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256 fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA512 3de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\fi.pak

MD5 5518b51d4af7f1b9d686cbea28b69e71
SHA1 df7f70846f059826c792a831e32247b2294c8e52
SHA256 8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512 b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\fil.pak

MD5 3165351c55e3408eaa7b661fa9dc8924
SHA1 181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA256 2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA512 3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\fr.pak

MD5 0445700799de14382201f2b8b840c639
SHA1 b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA256 9a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512 423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\he.pak

MD5 93d9261f91bcd80d7f33f87bad35dda4
SHA1 a498434fd2339c5d6465a28d8babb80607db1b65
SHA256 31661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512 f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\hu.pak

MD5 b338dcb0e672fb7b2910ce2f561a8e38
SHA1 cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256 bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512 f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ja.pak

MD5 f47efaa76f5200a6c0c23c33684d7bad
SHA1 9b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA256 5b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA512 67d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ko.pak

MD5 b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1 050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256 ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512 b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\mr.pak

MD5 25f2b9842e2c4c026e0fc4bc191a6915
SHA1 7de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256 771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512 ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\pl.pak

MD5 61c093fac4021062e1838a32d79399c2
SHA1 84a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA256 58067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512 475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\sr.pak

MD5 cf160983a86b51ec42845f4e60ac9123
SHA1 4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256 ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512 b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\zh-TW.pak

MD5 8f67a9f38ad36d7d4a6b48e63852208d
SHA1 f087c85c51bdbdef5998cfc3790835da95da982a
SHA256 92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512 623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\zh-CN.pak

MD5 9d4f54eb5a12cf4c2f34f5f538dff90b
SHA1 c31b892ce78c733bde0571b6236170103cc9fe7a
SHA256 58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA512 46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\vi.pak

MD5 9274866d7c6314f43dd63ed293293e25
SHA1 4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256 dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512 3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ur.pak

MD5 d7ec7d551dee1e1ef11be3e2820052f9
SHA1 d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA256 05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA512 92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\uk.pak

MD5 e4c4e3700469704b936460ca1a90fcc0
SHA1 e809990fc07a1d39fe623046382699e648e343c0
SHA256 29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA512 68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\tr.pak

MD5 9f24f44cac0997e1d0a6a419520f3bfe
SHA1 edb61859cbb5d77c666aac98379d4155188f4ff5
SHA256 3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA512 65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\th.pak

MD5 293ad7c20c22d744e4db0fb001ec45bb
SHA1 486c9e0732306a45aceb633da2b3ded281197620
SHA256 d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512 ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\te.pak

MD5 02415ded02cc7ac25e8f8d0e83365061
SHA1 5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA256 97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA512 54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ta.pak

MD5 a8beab6896018a6d37f9b2e5bdd7a78c
SHA1 64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256 c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512 73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\sw.pak

MD5 ee8da42ffe40fbb916c56390e2cd99e8
SHA1 6d824f56afe6b3605a881d2c26e69a46e6675347
SHA256 192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA512 7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\sv.pak

MD5 bbe0785c5f9591e8a1e7c4830fe949d6
SHA1 da4f3286079d50e1c04e923529e03e7d334c7fff
SHA256 0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA512 38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\sl.pak

MD5 4d9d56ef0b176e7f7aa14270e964ec77
SHA1 515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA256 6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512 740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\sk.pak

MD5 793c442420f27d54410cdb8d8ecce5ff
SHA1 8995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA256 5a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512 291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ru.pak

MD5 fc0e2fc09aa9089c5db75bab7a0754a7
SHA1 f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256 188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512 377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ro.pak

MD5 19cfc7c8f1a2e4a2de1f9f64475469bc
SHA1 bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA256 3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512 ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\pt-PT.pak

MD5 acffa29064f40a014bc7fe13e5ff58a9
SHA1 5a0890c94084075446264469818753f699a3d154
SHA256 423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512 d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\pt-BR.pak

MD5 a23c805ee4d3d67c811b50826ca25a51
SHA1 c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA256 62be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512 c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\nl.pak

MD5 bc41967b2ff493e7f151c7721245739d
SHA1 7606133ddbb58492dbbf02c03a975fb48da1e26f
SHA256 3dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA512 9e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\nb.pak

MD5 7576c2fa9199a4121bc4a50ff6c439c3
SHA1 55e3e2e651353e7566ed4dbe082ffc834363752b
SHA256 2a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA512 86c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ms.pak

MD5 9b3e2f3c49897228d51a324ab625eb45
SHA1 8f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA256 61a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512 409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\ml.pak

MD5 3b1305ecca60fb5a7b3224a70398ead9
SHA1 04e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256 c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA512 68fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\lv.pak

MD5 e4f7d9e385cb525e762ece1aa243e818
SHA1 689d784379bac189742b74cd8700c687feeeded1
SHA256 523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512 e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\lt.pak

MD5 96602a3f3b59faa997a4d337889fa02b
SHA1 94593a270b0d84c006e0959bc136b6c4987dfd3f
SHA256 51db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512 dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\kn.pak

MD5 a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1 f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA256 3c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512 f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\resources\app-update.yml

MD5 1f3fc4ed1c35754da78d76ac2355e681
SHA1 52a2ec4a1267e6b51fb9e376f38dd174799f57f3
SHA256 08c1434ebe835e19645d055993023f8b8048ef6025792bd2ce685ef33f34abe3
SHA512 155895169d921772c125922c82785b34e59ae0b35f909543bbcbb52b88f9b857d2997de335ea87cc4f582d8b928598de4addde423d21953d29d9e3e27932adbb

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\resources\elevate.exe

MD5 86050c2cbb9f996c1d7b5116fc67b21e
SHA1 59ec79f38d3a3bbe5b63b464bc720b426d7c300a
SHA256 288bce90fd6ffb1dd260f71f73765b9931c45015c3a963514855ae78f1becb9a
SHA512 9d4a1eb417b809299b9eeafc90323032dbea5b0ae9ddc799af6e4e36ecef61d2518dc4756bb4ac398d396926eb72e6886cb64c568dfad80e51c5320a74943b8f

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\resources\extraResources\[email protected]

MD5 e9b992be1a5ea38cfdbc31508d80b3b9
SHA1 e8395346ff49413abda7950807938baaaeee042d
SHA256 ca3525faef577979cc300996b230ab12f58b539d1361e2831868d515068c2346
SHA512 930501bf1c6d71a2907217bd4c8bfe0231d890f1f665d51963b3011c805a305246d6e4e0ecf6cf6efad37edde6ffed3c7dd088594ac24aab1e13fabd21a35e1a

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\resources\extraResources\IconTemplate.png

MD5 2c761c4c5b466c0d6c3fb51907f4a587
SHA1 72bb96c24004b9cf6abde1ae870ebb2315169855
SHA256 c0abd9c5ecfb3cfcd8ef51d6efd969cacfc2c13c59815d067573977664461eec
SHA512 9722b18a6342ea91e5094b41b31eb2bbed4c2fb773f6309b9ad238dd52260773ed3e0ebfa38469ac970b51bf2665f45086fd112f1eb0390513665094b91ea560

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\resources\dist\pages\icon-text-logo.svg

MD5 9e058d4bc591160ec98e36aa65031b48
SHA1 36254fd3bdb61ac27344a69594d91009122808fe
SHA256 a6feedf1437cf6026a950771aee3798a310ad554ddf00508282bba9c50e48c79
SHA512 4e0d4edc0385d9b114f0553c3b182313507ca08e3c680bdb78c7ef05e019b2d4b56a84801792d0923bf16b993918ad72b0029199adc52daa951b209a6c62a125

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\resources\dist\pages\cantLoad.html

MD5 af0ebfabf769eacba4deb6fbc9f002ce
SHA1 8b18e6f7c70bf329bb5f9f4c2436c7d6f95faed4
SHA256 6bc293fd068ddac9c3d92116e09417ac768336c76b748fccdc9f167e6466c1d4
SHA512 85d744eb091ed3a9e5b14eb4d87c5233b9909c732c5902c50a2cd38a9645a65dae8723f3773758e02a1a8c591da98fc589377702863090acb527fb20ceded709

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\resources\app.asar

MD5 dcf84c7c6436284959898ff76df2601a
SHA1 d64896cf933ef8399c23f678e2b5529c1074e8f9
SHA256 9ab65922798b5f5c4056de45e44a5fdccc489a6321a3cabbfbd99d8ca9daa896
SHA512 1e1361c6ec01637d83e340ef4069f5043fec4aa750df1fcaed5c9ef88e2a90108ca345789ef3053ca7970ebed73d9ab9cd66d5fdcb409038d4618de2037d4f80

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\it.pak

MD5 7c981a25be0e02fba150e17d9669a536
SHA1 3af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256 ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512 445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\id.pak

MD5 bd9636e9c7dc7be4c7f53fb0b886be04
SHA1 55421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA256 5761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA512 7c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\hr.pak

MD5 105472bc766a30bb71f13d86081de68d
SHA1 d014103ad930889239efd92ecfdfcc669312af6c
SHA256 a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512 ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\hi.pak

MD5 b7e4892b2030e4f916364856b6cc470a
SHA1 b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256 093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512 ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\gu.pak

MD5 7b5f52f72d3a93f76337d5cf3168ebd1
SHA1 00d444b5a7f73f566e98abadf867e6bb27433091
SHA256 798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA512 10c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\fa.pak

MD5 dcd3b982a52cdf8510a54830f270e391
SHA1 3e0802460950512b98cd124ff9f1f53827e3437e
SHA256 e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA512 3d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\et.pak

MD5 a94e1775f91ea8622f82ae5ab5ba6765
SHA1 ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA256 1606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512 a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\es.pak

MD5 e9fa4cada447b507878a568f82266353
SHA1 4a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256 186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA512 1e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\es-419.pak

MD5 5321c1e88c5c6fa20bdbc16043c6d0f6
SHA1 07b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256 f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512 121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\en-US.pak

MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\en-GB.pak

MD5 0db7f3a3ba228aa7f2457db1aa58d002
SHA1 bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256 cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA512 9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\el.pak

MD5 6922aaa87431699787c1489e89af17b9
SHA1 6fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256 800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512 367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\de.pak

MD5 ed329b35d10e81f55d611fe8748876f8
SHA1 0d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA256 6facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512 bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\da.pak

MD5 bb5252dc6f0f3c01ce3638138bf946c8
SHA1 bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256 c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512 e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

C:\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\7z-out\locales\cs.pak

MD5 a934431d469d19a274243f88bb5ac6fb
SHA1 146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256 51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512 562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

memory/2324-602-0x0000000002B40000-0x0000000002B42000-memory.dmp

\Users\Admin\AppData\Local\Temp\nst1AD2.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240221-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2244 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2244 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2244 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2244 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2244 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2244 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240508-en

Max time kernel

126s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240419-en

Max time kernel

119s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:52

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

200s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\resources\dist\pages\cantLoad.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\resources\dist\pages\cantLoad.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4000 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4028 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5028 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5536 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5668 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5720 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
NL 23.62.61.194:443 www.bing.com tcp
GB 13.87.96.169:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 2.21.17.194:443 www.microsoft.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 169.96.87.13.in-addr.arpa udp
US 8.8.8.8:53 bearly.ai udp
US 8.8.8.8:53 bearly.ai udp
US 104.26.11.184:443 bearly.ai tcp
US 8.8.8.8:53 194.17.21.2.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 184.11.26.104.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 52.182.143.212:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 212.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
NL 2.18.121.10:443 bzib.nelreports.net tcp
US 8.8.8.8:53 10.121.18.2.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240221-en

Max time kernel

118s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2880 wrote to memory of 2928 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2880 wrote to memory of 2928 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2880 wrote to memory of 2928 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2880 -s 88

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240221-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 880 wrote to memory of 2028 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 880 wrote to memory of 2028 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 880 wrote to memory of 2028 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 880 -s 88

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:52

Platform

win10v2004-20240508-en

Max time kernel

89s

Max time network

159s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x50c 0x4e0

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/1708-0-0x00007FF8F51F3000-0x00007FF8F51F5000-memory.dmp

memory/1708-1-0x00000240A1B70000-0x00000240A1B92000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_my3owgqs.24j.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1708-11-0x00007FF8F51F0000-0x00007FF8F5CB1000-memory.dmp

memory/1708-12-0x00007FF8F51F0000-0x00007FF8F5CB1000-memory.dmp

memory/1708-13-0x00007FF8F51F0000-0x00007FF8F5CB1000-memory.dmp

memory/1708-16-0x00007FF8F51F0000-0x00007FF8F5CB1000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:52

Platform

win7-20240221-en

Max time kernel

120s

Max time network

147s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\resources\dist\pages\cantLoad.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102f45d134a3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000a20197131dca8107e95e442788f24cdeb5c05c314299e413a42f2d57c9005af000000000e8000000002000020000000ec7ca864bce5a3e64da0da06955cd974f5e036c64d15725f96a718336bc75d229000000080270cc9d92611bcc12eb22928979a7e90373db3c8023168f6114a9ac93707541e6effcbf1bd03a954ed2a210c884315e340a9a982c746d0e554bca9917ba2275b06424928af28a55315a14608ac23c126d381e1e91a91829b9348bbf8ef4f6176ac69d045b5ce3f518189eb456f2b5549ba79f285ac30876416f020890bf746659c8daaf8efcd500fdd3476f59d9a6f40000000309388aef29da19bdad1cd3179051ad6557a66f9909353f0c50efde678bd5feb919defdb38607848865673d36ceeb071b6870963d5d864156db17de025f3a967 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC0AA541-0F27-11EF-B2DC-EA263619F6CB} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421546856" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ef2385d82f4dfb2da7941b98f17c4d412a975bd8bdc2dabe0c1b4f6cb12c4ddb000000000e8000000002000020000000e522202e2d2bd29836bd53d47c53a8d17e3e4326d97d4a8f9b0d07dbf318c03720000000031e51f16a7b1208ab1af1f85a30ad78aa5424e3d669f85b1770d888405845c34000000009673f69f9297ff94fd45083fe53589e2f5555083cd3f7d641e8ee1294dbcbe3ecdd937b8e807f3ea60987ef81371df2202d8d364f6bb8d36f5c131a9202dda9 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\resources\dist\pages\cantLoad.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabE12C.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\TarE25E.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ecf1d15ca9bd99159ee85da13b81ec0
SHA1 7a2677c796908311e40a8d600528c80691720afa
SHA256 0731581fa270af60beb0c9406d4a49e9633d2adba8d5a636950277695f75241e
SHA512 4e311f15ad766765365d64b8967d542bfb2871962cfc821eecec9e09f38a3b2918eb30d0e4b2f4a7d60239619759afcef6e6924b20627a447b33ea9792006b22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d42eb295a87050653c9eb3f5b2ccca23
SHA1 01ad54ed048f3cd2b762a771fcf711d13a3ae8a9
SHA256 0134a5d5625af27bdea5d3f975f7402b6fa7bbabdda588bbb8e6c65d6cf38e2f
SHA512 e9cae53f5835880f20da6d9742c1142a6a582e194114c73277a926eee4451b4972cd1b918383ef0bf7ae8cf312668d3b6f90481c0ff095537a28821315b5df21

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e1695388a001f0ad5fa12fe278587ce
SHA1 3a1fa955c6951f2ff3622ce02a33e6ae4e875e25
SHA256 18594143d7ce0a07622c4619506d25f7b361dff50c279fd3a3e0b907b644a539
SHA512 b22eb5fafdfff028301caa3a0a154f59cc2297a28fa17c392383afab1ebf2e16aa52c83bf3fcceae01d952553e343d443820d552e2d566fea5f299e8314eb84c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6fcc0693dd63c8f1caa5f37d34b9c92
SHA1 d7d3da4cf3f64a704d92134daf16c9d8e76c5ed6
SHA256 ad9c79f4d2afb0e23465034704a599b2996e00a15a13f158ca8fb4b93c19e6e8
SHA512 2bcd10b27d04d6b565e97aac5e6494bd5a7a8ae94b5c12e897a5f236789979567c420bf71cb4e471bb06083aa08be8575fec949b50320e2ed3c62759663cc365

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afd7274c88ec34a7754dac2df8aa1ea9
SHA1 cc9593b1ade2c92995d6205c4fc1782b09e60e46
SHA256 43b63ae206e637728bd32094c84ed0537bcdd06e26dfcd7ce6c0a34261bfc23b
SHA512 fa7afabeb9b73d0776967148826d7ace69978f6c66d63ff6b753695e8cd795a947720665ea3148eecdede0f6d7fd84f186875f0194d682db9327fd060b7dea9f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 12f0e3e94e3a9a96699bf222da835adf
SHA1 a65760c7eedf799e5d3afc8d8fe5f078e46a631f
SHA256 c00cc1a75189fd08c36abf3104329bdbcc4e4cc3157f6b910ac2ba79cc97fa31
SHA512 5dc38c3f31f2f4006d5f288363089d036715719bb9cc1089ae8240252de04a6485c7f9d1155740019871ac2848bdd5aa6e09875d66250c261ca84afce753828c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63259d91efaed5e0d32916ead51edded
SHA1 f9750924efb9d0f11d9f9b9a560781606164f385
SHA256 a4d99b843395c86ebe83812f4b9e38c9441ba61fd42db17b5355d7252d01ee67
SHA512 4e6b33159255c79ba29601161ca56379967a4bbee6a9ce9ba16578b8159469b30b265084ea316bea72cf034fdc08466954a66b6b1eab11a5128e377322251353

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3719d638b90a63a486e0ac566c47f1d
SHA1 2637fad9e77453f9de2781b3f3b7f0c73b9a78ef
SHA256 814d9db6ae0902be8f31a964b6f0878be61be47bbd628ab90441792eb3855eb3
SHA512 b8b178d71ea736b151aaaedd81621331f408c987b2e598c18bcf13ede17775360bbe0f9107bc2f941effd2e8352b54c370ebea47aa39c553922af68400216ff8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b9d69906b429a2e465c6bf40c88278c
SHA1 071b5544123208ae551371ea6e3f97d2aa548588
SHA256 075ae1bf9a872c74f74e697de998d07d70f918c1d13a52840aff2307c454de83
SHA512 1a75c70c53e5d66c2ce2d79c96a3fe77b3657c7e42ff5bce0967122943ab22031fa78dbbc557156e7bfaa7d1eb517d970c9b4fa4e467a71dce648d5d75d5b448

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 404ea593933fb7669ee719da868b3c3b
SHA1 6a672cb489e5537f3e4109c9617a2fb80f7c86d4
SHA256 bde1cc3ac953fccf1172178c5f34463b6ca6ec469062d637912fbc749d94fc6f
SHA512 01ee450bb3924f77e8cd40413b377385b2d21c8df178ea3ca090d1e624d869749f8ac71ec0ec084c46b2a832abc6d13e3a48b5ade7ec1480df113841dd439e13

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3df692a17511d9b43dab5186930492a5
SHA1 20c29d160c3b5a0e47baba895b496acbf27c2c42
SHA256 9ae0e2647c40042ba49b3875fb01b289b17d1f2c9afbc2b231d64a7417432cc9
SHA512 cc0b6d87776783c0142ae23ea4459d3e581587425c1de08b782dcfeec139483dc30ff74449f052d95c83023598105e92ddb13f6291f86a5cf4bbcf6a643fcc96

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1565c799fb2b4ea7cae51f56dd59e5cc
SHA1 1402854960ff57f4ff21ac946b036f0b7dcce4d7
SHA256 15980991fdf81435f2a07397fe0ae83b5bbab9a89762ced297eb1043ff200ddd
SHA512 0c81e1ac5706ed3dcb51dcb9dc41a3a044277fa8dcf4c5451fc6f2b8bfaf178cf32c341b87077e0d1cb74292a83eef9e6723d5702cbcb6e79c832397d3d4acf6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 55d41801b36cb2f30c17ba60355e6596
SHA1 df0c69a9e8456a3f3a44d001bb96fe8f0f6f2493
SHA256 d63aa35b99a8380a4da9021c772cc09817319e3e46749debc4195942dd281546
SHA512 5f943d40a239ab16addfb4d10cb15d5ff9953a355778ebef107c4b11de6d520ee9abdc5c21ca147c3c4644e5c18985d4b06fc26ec52c7f95a49f376c1ae0f5e3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2ee207333f0225339fd87b7bc8981df0
SHA1 40e6df4cda98c6bb7737a2106b19f5104dfe9908
SHA256 ad43cefaf33a0f6100f9b5e972128bcb7d559afe907936f4df1caca5544344ef
SHA512 f241509c2b97bfc7af8c9c24028d16c5de6c75d1028ffe4d3c2dae8da27bd3ddaf2a3c0b875e72f3298e3d860bfc4fcef6f1b4f4944d2e643f37d66c6a7a0ad3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 90873a652e0cdf93adb497edb32b881a
SHA1 fe87aead24245c81ca07e940a8f7907b1ff7dd88
SHA256 4bf09bfd6e0dc7424b5fa1476a626321bbc16ba60a2ae31ccdf1713e01b79fad
SHA512 d95b6affbb3d0d5a5ee7117afcba38a6e85fed9f95488dbe642945dcf224b16fe025900a232ce9717436486566f42090aff4c4746810edf8472810f5ffc5c6b1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 54bb72724320001cf98bf5eb1c4ad8c5
SHA1 01976098df90ee37fd3f14a36e79c1c28d408371
SHA256 fd5e538e96b2d146957584518810a1e63855a007c18bd23b294ac5ce30758058
SHA512 f7b9e724d1d0521ce9b0fc032151dab39be3a3b94640830c04105910cdda67ab5e97c287be5054574894baa078ac8a54a08457ffef351bc33946b9832bb57dd6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 261782b957e06b1b95b96adcd036f9f2
SHA1 3bf6a609b943593958975dcbe7e7bce848d91c96
SHA256 956d544c0a70aa75f8a9ac3b2b56b004f1fead402bbaa713cb52c936f047e723
SHA512 f79d6733345024b37f560574a84881de0646564551306fbe941b656cbd4ca83a02161a27e330aa24c12dfc17b198f2a2b82287cd8aac542d71dfa7b933694e2a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da61eaec43d7082a5632c4b7e96d9b16
SHA1 cdf3cb80dccec386279811debe75752b25fcf0b6
SHA256 50dc70bf27aec6ceb8123d61404fc7810c410cf10aef9b4a033db3bcc6321232
SHA512 bf7c72f8fb650b27cff54d20429177051bfed2c348609b53705b0fb2b0d93c349adfc84f8a996a834010fd706df35be8f8c665cc6d5a61611ecdecb4769f255e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 994a058fd75523b6dc27744693b71d75
SHA1 57611aa8cced78b87621d3b5db8766e972d345a3
SHA256 fecf7c8bea84479022c8ad814997832c4626f5728cca1e78b275485c9263e6ce
SHA512 6f8e3656a1b07847ee96870334fbb47ffea93e03fa4c489cfc1add2593c94f12dfd51ae48738eb52c4be3f80965bc207eb9e407cd34fddaaf25768d4368793d9

Analysis: behavioral29

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 137.126.19.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240419-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 220

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2900 wrote to memory of 2400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2900 wrote to memory of 2400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2900 wrote to memory of 2400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2400 -ip 2400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 34.56.20.217.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

162s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2308 wrote to memory of 3392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 3392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2308 wrote to memory of 232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac11e46f8,0x7ffac11e4708,0x7ffac11e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14288522265159439716,9321451925131554958,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_2308_MPCEPLCJLQMIDBRL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0a3ad143a43a97c171ffde0100635c6a
SHA1 731e7eef0149639cbaf14919bb53ef741cfe5a18
SHA256 cc3b90c9784c069e1843b77d15fae5e67b9596b13ce3ed5701f906e53e552561
SHA512 32a578090352d94d288031722364eaf8e7479d45ccabf0d5e1a7e71bc10ac804439f2b8aa9feeddf348f30010205e90f7982d90c960152ae0a44847110326252

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a2c4bc80f2cf248f23c78cf494a40cfc
SHA1 31b64b8980330405fb63f038cd29592398a2fe71
SHA256 52494bd0dd9e7a6d9c9bade198a043f67ea776d57c2808554267eb0f653cd68c
SHA512 becd0b2f427ecd4c70cbedaddaf22378eadc7f369f6d6e70256a433c5ee8ee87f369b8e74e4287d083b8db1610f5fd6c6e696cf1807cfb8d077bb72e69123e08

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a9db52b3efe787fec1cdd4267b85a0d7
SHA1 e9166075b55806b667c6d267ce2ea8851f0991df
SHA256 ebaccb6e84798414e817ba9e22aa515ecae78cce2fe16c0a8f397ca623b77fbd
SHA512 d4cba3f7f57ff0cfb1230be759e1b32bde58ad1c7791b7a4e73799716242e33773ae455e3689235baf9af0690976e415a63b47ce0e4715bede19ce604e188365

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240426-en

Max time kernel

134s

Max time network

138s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1008 wrote to memory of 5092 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1008 wrote to memory of 5092 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1008 wrote to memory of 5092 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 138.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240220-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20231129-en

Max time kernel

118s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 220

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 138.136.73.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win10v2004-20240508-en

Max time kernel

91s

Max time network

100s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4572 wrote to memory of 2200 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4572 wrote to memory of 2200 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4572 wrote to memory of 2200 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2200 -ip 2200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20231129-en

Max time kernel

120s

Max time network

126s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Network

N/A

Files

memory/2356-4-0x000007FEF5F9E000-0x000007FEF5F9F000-memory.dmp

memory/2356-5-0x000000001B620000-0x000000001B902000-memory.dmp

memory/2356-7-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

memory/2356-6-0x00000000023B0000-0x00000000023B8000-memory.dmp

memory/2356-8-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

memory/2356-9-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

memory/2356-10-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

memory/2356-11-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

memory/2356-12-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Analysis: behavioral30

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240221-en

Max time kernel

121s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2944 wrote to memory of 1652 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2944 wrote to memory of 1652 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2944 wrote to memory of 1652 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2944 -s 80

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240508-en

Max time kernel

121s

Max time network

130s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Network

N/A

Files

memory/2976-4-0x000007FEF614E000-0x000007FEF614F000-memory.dmp

memory/2976-6-0x0000000001F70000-0x0000000001F78000-memory.dmp

memory/2976-5-0x000000001B610000-0x000000001B8F2000-memory.dmp

memory/2976-7-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

memory/2976-8-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

memory/2976-9-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

memory/2976-10-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-05-10 23:46

Reported

2024-05-10 23:51

Platform

win7-20240220-en

Max time kernel

119s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A