Malware Analysis Report

2024-08-06 15:25

Sample ID 240524-ys5qxahc9x
Target d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe
SHA256 d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b
Tags
neshta nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b

Threat Level: Known bad

The file d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe was found to be: Known bad.

Malicious Activity Summary

neshta nanocore evasion keylogger persistence spyware stealer trojan

Detect Neshta payload

Neshta family

Neshta

NanoCore

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Modifies system executable filetype association

Checks whether UAC is enabled

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Privilege Escalation
TA0004
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-24 20:03

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-24 20:03

Reported

2024-05-24 20:06

Platform

win7-20231129-en

Max time kernel

140s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NanoCore

keylogger trojan stealer spyware nanocore

Neshta

persistence spyware neshta

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1964 set thread context of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Windows\svchost.com N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\cboobs\cboobs.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2200 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe
PID 2200 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe
PID 2200 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe
PID 2200 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe
PID 1964 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 2808 wrote to memory of 2656 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 2656 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 2656 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 2656 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 1964 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 1964 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 2240 wrote to memory of 2816 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2816 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2816 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2816 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 2584 wrote to memory of 2452 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2452 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2452 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 1964 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 2584 wrote to memory of 2452 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe

"C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/3582-490/d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe" "%temp%\cboobs\cboobs.exe" /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /c copy C:/Users/Admin/AppData/Local/Temp/3582-490/d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe %temp%\cboobs\cboobs.exe /Y

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\cboobs\cboobs.exe:Zone.Identifier

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c ren "%temp%\cboobs\cboobs.exe.jpg" cboobs.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /c ren %temp%\cboobs\cboobs.exe.jpg cboobs.exe

C:\Users\Admin\AppData\Local\Temp\svhost.exe

"C:\Users\Admin\AppData\Local\Temp\svhost.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /c echo [zoneTransfer]ZoneID = 2 > %temp%\cboobs\cboobs.exe:Zone.Identifier

Network

Country Destination Domain Proto
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp

Files

\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe

MD5 ec3ff21f19f66cbf04eaef83bcb98d48
SHA1 9396d73edf6456cb066aebd73763b164b99eafc7
SHA256 5cc202d31a7052450bc13b1c09495c4257760e562c9644cb4526a128d14fa507
SHA512 b3f322bd5e1799190bf5c4cc5857192a3b0441082a0e7e6bd53ca72eeaadf575f61de5cb17cce41c72eba4c0ccfa08ec16a0b3c8b6c18d41690bdba1ac8c84f7

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

memory/1964-15-0x0000000074681000-0x0000000074682000-memory.dmp

memory/1964-16-0x0000000074680000-0x0000000074C2B000-memory.dmp

memory/1964-17-0x0000000074680000-0x0000000074C2B000-memory.dmp

C:\Windows\svchost.com

MD5 61b1cab0553d262f543aa99726b020bf
SHA1 b08414daedaf7c10bfb6a009db989a08c57e9db1
SHA256 5b9585fcc15aab1938e6d88f859734ff346f01259f952b0b67d15316de5d6c02
SHA512 0908ed84271dc87409d07720bd24e7c8e0a24e6c84420501b4696a109f6f45ae7444c801794237308da5a64ec742bddc80629291a58a9d694621354191fa7400

C:\Windows\directx.sys

MD5 263d52bd07cd6e5085f8b912f46e12a4
SHA1 d85d5380ce7588ff8eab30d3e09fafe0d1f8222a
SHA256 6b5f7befc93318f6ca29d97acc8c0157d2fa06a85f1d4e6bb6b1df120f310dec
SHA512 5b0c3bc63eb911872db70d5cea3b4cc82f48ea82a28957d4e8fb6b857b8a4a37e97a8d7b9afe51443468ee8c85afa4fe396e8aaaea61c67608246854795e6025

C:\Windows\directx.sys

MD5 07ebabe87e80f8c4e5bd291658d52706
SHA1 58e055eb667676e30e05eb1b11069c39a948e5f8
SHA256 1f0f4ac427031f2ead5bd5ebddad3a0898af0bf231f2dd2259438fc0a1c8e48d
SHA512 aacd65075bb3d2c751952a5660617ef2407d924d8fcdb5dff086ba44ce796b3b62d8366c9bdd5b17aac7887a313a594b77330e874d7225d0535bb6369107eb7f

memory/2240-47-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 2e5f1cf69f92392f8829fc9c9263ae9b
SHA1 97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA256 51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512 f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

memory/2472-68-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2472-67-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2584-71-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2472-65-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2472-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2472-62-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2472-60-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2472-58-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2472-56-0x0000000000400000-0x0000000000438000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5 02ee6a3424782531461fb2f10713d3c1
SHA1 b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA512 6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

MD5 566ed4f62fdc96f175afedd811fa0370
SHA1 d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA256 e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
SHA512 cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

MD5 58b58875a50a0d8b5e7be7d6ac685164
SHA1 1e0b89c1b2585c76e758e9141b846ed4477b0662
SHA256 2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
SHA512 d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe

MD5 0da2d682733a37ac0eff5886129e9192
SHA1 5c7def546e6e3a0fa55df37d7a0f9270ebc6119e
SHA256 ea67f9e673e395dce99a8e4ca5b755c4556ab7031e24f79762d6a59fbc8110fe
SHA512 1a9986d648f2fb77767bd267a0fa6a1a4c24f39a7a064ce3012a9110c9f087a2f367741d1039976d7848b72bece481b8597cb7acdc2ce72d710a17f7121ff2f6

C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe

MD5 6570f18406183e572b1f8d4cea13bc66
SHA1 838e8537f613a33d9828defeb4cb1af2f8ed5f2b
SHA256 0466a343fc8ec05657758df972183869b74dd15936f9ac18663462128c88be64
SHA512 0b6807b721ec3934de420498014be32d1cb66d2d6ccb57f86b996d4423a7fa9d719f864317ffe1d48ca7c2bc5a72cb7b93f32fa03d09f144b1dba8006e0ebdf4

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE

MD5 c275134502929608464f4400dd4971ab
SHA1 107b91a5249425c83700d64aff4b57652039699d
SHA256 ca5263f340cc735ba279532bbd9fe505fcf05d81b52614e05aff31c14d18f831
SHA512 913cadcb575519f924333c80588781caecd6cd5f176dc22ac7391f154ffc3b3f7302d010433c22c96fde3591cac79df3252798e52abf5706517493ef87a7ef7d

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE

MD5 623288b46813a3c1c960b801762a3fde
SHA1 c73da36974aac1c21f57afde8879a8c5fb7b6a4c
SHA256 65777f734ceaa4a20a594cd0b52d7a02ee9a200f01641817ad9526b79117c3ff
SHA512 573d760b64c417dac7d9e765766e38ae465f2c0c0d177933302731048a5f4661964e60676844e57780eb65ef94cbcde1378e75d8d0a30c6a26bc1413e43c3eba

C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe

MD5 693ed385cb9c7d902c9aa4271d345d7e
SHA1 36f512f61342924f3e4ea8d92badfc0e21e7ebe8
SHA256 01e693491511a132443e9aae0b3d8522ff258bb1f47d5d5e9dc0407a24e67eaf
SHA512 f31c5b3b02d698fff2b956850cc0d79bbbf2a083bc82fbd406426eac19a598bb5ebae028aecdaddd7010501237f2422fe4e709be91e18368a78995486cfa5cee

C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE

MD5 abfa225c2a1a1094c155028ba2ee77f7
SHA1 74136932691b15195ffef5a81a47a9aeafb6b9b7
SHA256 06b967634c744ad9232ab1286da77794848c03ab83a26e125931e9b47e8befbc
SHA512 5dd807b1ae91587c99948699e7fbf67dc5512c50cec1a738dd9c8ba3758500089eaf8bd7d13ea277bd101eee91d53dfd5cf1ea033cb0575082e6759e416ebc0a

C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE

MD5 277bb19584ee5f26d8bdafe0f064b307
SHA1 004eaa0533b0d57256c92bdb9dc297e412f9a539
SHA256 1f8bca08379c64cba05645aa1541a01a3bd810b803086870b121fe97b299390f
SHA512 c9e8acf4582cb004e3d6f85aa60ab1f50f9a68ab763509a2f2d8b074329b5dc23df1c097ab432f6565004b696ef059bd7490a25f9ee12e0a76fc1191111a8e65

C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE

MD5 154b891ad580307b09612e413a0e65ac
SHA1 fc900c7853261253b6e9f86335ea8d8ad10c1c60
SHA256 8a3598c889dbcb1dca548a6193517ed7becb74c780003203697a2db22222a483
SHA512 39bf032033b445fc5f450abec298ea3f71cadecfeafc624f2eb1f9a1d343a272181a874b46b58bb18168f2f14d498c3b917c3392d4c724fe4e5ae749113c2ad6

C:\PROGRA~2\MICROS~1\Office14\OIS.EXE

MD5 4545e2b5fa4062259d5ddd56ecbbd386
SHA1 c021dc8488a73bd364cb98758559fe7ba1337263
SHA256 318f1f3fbdd1cf17c176cb68b4bc2cf899338186161a16a1adc29426114fb4f8
SHA512 cf07436e0219ca5868e11046f2a497583066a9cf68262e7cca22daad72aded665ac66afea8db76182c172041c45fcef1628ea6852751c4bf97969c9af6cfefa1

C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE

MD5 08ee3d1a6a5ed48057783b0771abbbea
SHA1 ebf911c5899f611b490e2792695924df1c69117d
SHA256 3f6decd82b72a5ba1ee224b52d9fbd6486be22a0b855e28eaad47ae92df266f0
SHA512 1711d023c60d4b047d553a654797bc3a2eecd951b310698c1a2c549e136c33f55e0fc1167a4a38f793b7796f7cfc3fb30017935127b147a21da2812eb38faac5

C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE

MD5 6b63036a88f260b7a08da9814cf17ce0
SHA1 cac1bd549343a1c3fcefacc2d588155a00c4467b
SHA256 8f9fb3c2ce132a64e157738feaf82bb512ec03d03fa2da95c26470defeef513d
SHA512 383b8676a85e0f2447536bd15019c23bed15a51d633dafe5ac7bcbea75d8064ef9fd938461eab25df7f3eae3de18b87640e8cc12e95f7b58de1209937d8da284

C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE

MD5 525f8201ec895d5d6bb2a7d344efa683
SHA1 a87dae5b06e86025abc91245809bcb81eb9aacf9
SHA256 39a089d363b15c37cca9f747a17e89ad1dbe0bc86ff23466526beaa5e36d6d4b
SHA512 f0a2070f11eb3f0bdf996ada42becc7710aab76e84268e5cdbbd9ecbf13ef5fb85b52b6227711137a9c511f8d731b018530cbf1935f8fcfd61ff2ef6c1348d63

C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE

MD5 61631e66dbe2694a93e5dc936dd273be
SHA1 b1838b8ca92fa5ca89e1108ceb2630a6ecd2b8c2
SHA256 5811b7b694d99c703b4c4bc72d6b7d846d05b2b0f45a7e3e4279cdb6fd81265f
SHA512 323463c267ccdb701d5967198f4f72158056f5a6e889c47bf19d1a670233ab071a5fe8c108430beb67753b77af1c59028007101a8e1266618fe91fa0127b4dcf

C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE

MD5 9b1c9f74ac985eab6f8e5b27441a757b
SHA1 9a2cf7d2518c5f5db405e5bd8d37bf62dcaf34f5
SHA256 2a189b995a7283b503bb5864dd9ca57976b3812a6a34aaf89a7551336c43bc24
SHA512 d72e83aeaf1d34627a6c6aa469821af8a8d464a72c764fbb064484adea509a8c1d3628e2166859286e84daae8ebdf4f800693ce203984a8c313b1f2263e101c4

C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE

MD5 5ae9c0c497949584ffa06f028a6605ab
SHA1 eb24dbd3c8952ee20411691326d650f98d24e992
SHA256 07dd9364be7babc5f9a08f0ccd828a9a55137845df1782b147f12943f234ea4e
SHA512 2e99bb500c281c367cc54fa283905b2537905ea4fe8986f676adbb1aaf58460dd2db082bb46a3dbe9dc836fbae3ee8832990839432dd99c74de58cc9b9295788

C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE

MD5 0d9146d70ac6a41ead1ea2d50d729508
SHA1 b9e6ff83a26aaf105640f5d5cdab213c989dc370
SHA256 0b876ddeefd88d5e98de7e409c5b6546ba8ffa195c168f9a4b6ba33b44d437ab
SHA512 c9394decfd469bfedd883095d604e11208aa290334ff5c0dce852f2ca74fba27c37ba2984dab8b27430e573681e22c9f903e53b01510a4b77d337cbd92c56cb3

C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

MD5 cc5020b193486a88f373bedca78e24c8
SHA1 61744a1675ce10ddd196129b49331d517d7da884
SHA256 e87936bb1f0794b7622f8ce5b88e4b57b2358c4e0d0fd87c5cd9fa03b8429e2a
SHA512 bc2c77a25ad9f25ac19d8216dafc5417513cb57b9984237a5589a0bb684fdac4540695fcfb0df150556823b191014c96b002e4234a779bd064d36166afeb09d2

C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

MD5 31685b921fcd439185495e2bdc8c5ebf
SHA1 5d171dd1f2fc2ad55bde2e3c16a58abff07ae636
SHA256 4798142637154af13e3ed0e0b508459cf71d2dc1ae2f80f8439d14975617e05c
SHA512 04a414a89e02f9541b0728c82c38f0c64af1e95074f00699a48c82a5e99f4a6488fd7914ff1fa7a5bf383ce85d2dceab7f686d4ee5344ab36e7b9f13ceec9e7f

C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

MD5 24179b4581907abfef8a55ab41c97999
SHA1 e4de417476f43da4405f4340ebf6044f6b094337
SHA256 a8b960bcbf3045bedd2f6b59c521837ac4aee9c566001c01d8fc43b15b1dfdc7
SHA512 6fb0621ea3755db8af58d86bdc4f5324ba0832790e83375d07c378b6f569a109e14a78ed7d1a5e105b7a005194a31bd7771f3008b2026a0938d695e62f6ea6b8

C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

MD5 06366e48936df8d5556435c9820e9990
SHA1 0e3ed1da26a0c96f549720684e87352f1b58ef45
SHA256 cd47cce50016890899413b2c3609b3b49cb1b65a4dfcaa34ece5a16d8e8f6612
SHA512 bea7342a6703771cb9b11cd164e9972eb981c33dcfe3e628b139f9e45cf1e24ded1c55fcdfa0697bf48772a3359a9ddd29e4bb33c796c94727afd1c4d5589ea3

C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

MD5 2acb54dd83be1957482f0df591ade3f5
SHA1 c6e9ebe71564c55a7260d1e8f45b11bd125d95cc
SHA256 af7961a615915aa0c59b735254e537004eab00e57466585390bbb0e29a5948a6
SHA512 011a2ca1d42e4bc26db7353ca79a9800cb9c9be271c531ce2afbb230b8487729da02c307f65a52f828459ca1b3aa4326c576bb4364f70b149e8b4f479b06cc1a

memory/1964-214-0x0000000074680000-0x0000000074C2B000-memory.dmp

memory/2808-216-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-215-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp

MD5 b5ba49aca1445d20e581ecdd9344d334
SHA1 430a23ae592945c51ddce71dcf4a822fc115af84
SHA256 3f3ca40f84d78c5cd1b76892a4ecbc621d4eca5c7d556887c9459a323f24979c
SHA512 cb51f1ce57477f4d045157505f107b192103ab0c7f66d847d34d9368972787a6ae7858c682d628469af7ea223b0a8da93943ae6d7198120cf3a5a892ce2baf12

memory/2808-218-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-221-0x0000000000400000-0x000000000041B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 20:03

Reported

2024-05-24 20:06

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NanoCore

keylogger trojan stealer spyware nanocore

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4768 set thread context of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_pwa_launcher.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.17\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\BHO\ie_to_edge_stub.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\BHO\ie_to_edge_stub.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~4.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_proxy.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\notification_helper.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~3.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\elevation_service.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MIA062~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\cookie_exporter.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\cboobs\cboobs.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1804 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe
PID 1804 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe
PID 1804 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe
PID 4768 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 4768 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 4768 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 2852 wrote to memory of 4964 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 4964 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 4964 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 4768 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 4768 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 4768 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 4768 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 4768 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 4768 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Windows\svchost.com
PID 2936 wrote to memory of 3312 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2936 wrote to memory of 3312 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 2936 wrote to memory of 3312 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 4768 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 4768 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 4768 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 4768 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 4768 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 4768 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 4768 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 4768 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe
PID 4696 wrote to memory of 4100 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 4696 wrote to memory of 4100 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 4696 wrote to memory of 4100 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe

"C:\Users\Admin\AppData\Local\Temp\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/3582-490/d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe" "%temp%\cboobs\cboobs.exe" /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /c copy C:/Users/Admin/AppData/Local/Temp/3582-490/d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe %temp%\cboobs\cboobs.exe /Y

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\cboobs\cboobs.exe:Zone.Identifier

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c ren "%temp%\cboobs\cboobs.exe.jpg" cboobs.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /c echo [zoneTransfer]ZoneID = 2 > %temp%\cboobs\cboobs.exe:Zone.Identifier

C:\Users\Admin\AppData\Local\Temp\svhost.exe

"C:\Users\Admin\AppData\Local\Temp\svhost.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /c ren %temp%\cboobs\cboobs.exe.jpg cboobs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 56.94.73.104.in-addr.arpa udp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 ayewhatsgoodbrolmao.duckdns.org udp
CA 89.36.78.121:1689 ayewhatsgoodbrolmao.duckdns.org tcp
US 8.8.8.8:53 209.80.50.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\d98b360e720475ce31f7c4166e070aebeabdbc93030638471bd46830e357ac2b.exe

MD5 ec3ff21f19f66cbf04eaef83bcb98d48
SHA1 9396d73edf6456cb066aebd73763b164b99eafc7
SHA256 5cc202d31a7052450bc13b1c09495c4257760e562c9644cb4526a128d14fa507
SHA512 b3f322bd5e1799190bf5c4cc5857192a3b0441082a0e7e6bd53ca72eeaadf575f61de5cb17cce41c72eba4c0ccfa08ec16a0b3c8b6c18d41690bdba1ac8c84f7

memory/4768-13-0x0000000073B42000-0x0000000073B43000-memory.dmp

memory/4768-14-0x0000000073B40000-0x00000000740F1000-memory.dmp

memory/4768-15-0x0000000073B40000-0x00000000740F1000-memory.dmp

C:\Windows\svchost.com

MD5 61b1cab0553d262f543aa99726b020bf
SHA1 b08414daedaf7c10bfb6a009db989a08c57e9db1
SHA256 5b9585fcc15aab1938e6d88f859734ff346f01259f952b0b67d15316de5d6c02
SHA512 0908ed84271dc87409d07720bd24e7c8e0a24e6c84420501b4696a109f6f45ae7444c801794237308da5a64ec742bddc80629291a58a9d694621354191fa7400

C:\Windows\directx.sys

MD5 263d52bd07cd6e5085f8b912f46e12a4
SHA1 d85d5380ce7588ff8eab30d3e09fafe0d1f8222a
SHA256 6b5f7befc93318f6ca29d97acc8c0157d2fa06a85f1d4e6bb6b1df120f310dec
SHA512 5b0c3bc63eb911872db70d5cea3b4cc82f48ea82a28957d4e8fb6b857b8a4a37e97a8d7b9afe51443468ee8c85afa4fe396e8aaaea61c67608246854795e6025

C:\odt\OFFICE~1.EXE

MD5 02c3d242fe142b0eabec69211b34bc55
SHA1 ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e
SHA256 2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
SHA512 0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

memory/2936-41-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 84c42d0f2c1ae761bef884638bc1eacd
SHA1 4353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256 331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA512 43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

memory/3816-43-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Windows\directx.sys

MD5 07ebabe87e80f8c4e5bd291658d52706
SHA1 58e055eb667676e30e05eb1b11069c39a948e5f8
SHA256 1f0f4ac427031f2ead5bd5ebddad3a0898af0bf231f2dd2259438fc0a1c8e48d
SHA512 aacd65075bb3d2c751952a5660617ef2407d924d8fcdb5dff086ba44ce796b3b62d8366c9bdd5b17aac7887a313a594b77330e874d7225d0535bb6369107eb7f

memory/4696-53-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 6c833335f6b46d0c6a9f98b08cf0cba0
SHA1 a3f617acb3a1daf7afe114e075499a1f37cb361d
SHA256 578e612231ed634e8fb169552b1a480d9c438b49412c40886904783f98ef5f9c
SHA512 c7d479641b8a6c365e607d833e0a067877847ecaa0c404335ca786273c5f22507ada8e2ae21600f606371592b380bb6f17e52c2c5a1aa28128bda77d884eaf2c

memory/1804-56-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

MD5 807b614450ef87a85f26acc7c098b840
SHA1 47526304305593399d66ce9ffff881ba7e3dda26
SHA256 d6559d1fac51f19009ccb1b5bfee2353853698c3ac178c5c1352d9115556e693
SHA512 85576a7277e1b32a337818e653f71ae5ab9f88a5971130c2dff8eb71eecf1f385f612de9cb67dc0f435379b37e932a95d1fddaf2e55c6c4b2fee9729f2e7ea4a

C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE

MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be

C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE

MD5 3b35b268659965ab93b6ee42f8193395
SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab

memory/4768-92-0x0000000073B40000-0x00000000740F1000-memory.dmp

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe

MD5 341fcb9fa7b3bd9a2ccf17b2b2d8e99c
SHA1 6cef9a7c9477deb91c8def4a13a9af61bddbbe76
SHA256 f9e6fcaac5b7b2223db2c64026453513a6e516a0243e1a6e5846c9f0ab2e93a9
SHA512 2c430cea872df790ee6bb5a9b7a6fdff9abad9734c252ce9e924bd3886d3c689b0ae8989d1ea819e01e38d05ae0cb29e6c5e50d021894a6c258b5ee150852348

memory/1804-97-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-98-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe

MD5 a86afb3fa465bf9bb4d8a55ee58c6a07
SHA1 d3c83ae5232ea99b3779e8ac2edb728988f86668
SHA256 4768e8061e174c132cff83bf39d46390e8118a4c71d25bfafb827b910b003acb
SHA512 70d0521fe17502002299745c89b9551019f9026ca658c24244a6a389cedd65de5aa05198bb1bca1fd0a0741c524c6b58ec1cb31201c2652ef1e7b40e91ba0391

C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe

MD5 2fbf8e73fc690c57c64459cb4c349ddb
SHA1 1038053aff4e542a8dbb77fc4d100fe083493e50
SHA256 408ad7354171bc8d51846bbe8238e8fbd6a5bf9b0b12b3f55b43f61e03371bf2
SHA512 7e29b6ae75865dc9e7004665f6c90513e5b8f593509cbd209f523ea5602ea9e242ef1fee867f8d293781a51fa816d502456bbe97414de2e7ecbc6f6f640a49fc

C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe

MD5 927c75ca98552179273baebb2038b44e
SHA1 e85f3a6b2f25c344a76306579a488ee3a757a1cf
SHA256 625a894f316118bcb6b291fcfe0d35b3bf0204285999885eb5b489bf1bd8581f
SHA512 55b0498c69568b3ef45a5ea22dbccb582b45e969678339b66264ab2186416ff373a3cef4c13b4ec06fe18dca575e7d54ba20a0645c3c54816882fd3d51c48bfc

C:\PROGRA~2\Google\Update\DISABL~1.EXE

MD5 6a57dc8a285dc9738c88e78fba506d22
SHA1 6c7fbb72d162b60ae27df884aa379c9e41ecbf9d
SHA256 b3c0c2c2eba96fb385979636c2593d7322ef3d72a6d67cad4bb9ef64f7eb4699
SHA512 4d559ded8758ce92b4f2bb7ad819873aa6fcb4f351e1aec820d49ba87cb840a593f9c6dca6f5244bbe4748b9f1c623e981ba0e77ad57e1364a1876f6fc3a88f1

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\INSTAL~1\setup.exe

MD5 0727361d4c5123a1016523834e59752e
SHA1 402dae10eafa45586443097ac900a1de7cf410fa
SHA256 94b567d46e3278cee68db82521b2b5eecb9d79e4868dc8af3f639188da0b8410
SHA512 5f2e42057c5fd0e089471d9701883ceddc8e0797187a794d59a1360619f516c8e122a95437aa38752e5f0fb5496b84efb0d977c24732ed0bc68b1d672b75be84

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedgewebview2.exe

MD5 a4b214a072e3b243c4ebc478e6eb36a7
SHA1 03d0e04d345971141a1cd5f56e31e7f8480974f7
SHA256 77411e2933273fb7b04fd0dec90ea0a620b2293b6fbdbd5c29afa0cd7536fa51
SHA512 e32edd286477a52cbeaea9a0d20c49328bf78e86698620cee8c6900b672c0cc7feed5d2a5426770e9c2c70fe2a339814db4468d9fc960070e61e928ca3866a8d

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\BHO\IE_TO_~1.EXE

MD5 46bda7f4ac4ec1457af4aceec4b0951e
SHA1 9038a90a2b4f6363fd20dc45984405e1d1e2a2d6
SHA256 5eb1cd925ce4a5c5dd035a0de64bb7249303e53d1efff96ea510b0930470524f
SHA512 36e917760e250ad7550b73b20471c5c8264a6ab12984e95d4bba1f3f15602aa8ac1acbb0af3fa8fbd9aba80f002eeb444d1fb49a6d64b720e5368a7a8ce58465

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\COOKIE~1.EXE

MD5 fe0269e24575d8a8590185540f7b4f6c
SHA1 e133f0f269ac97b93caf93fe6f7ecf55e929cef1
SHA256 1b3d321b505dd2f13e8b669f554b31e6e00f5a5ab4f98160a8f7a0dd96c3b9fa
SHA512 b30ce7aad664d2ad7ad9ff046e16a80bbf13caa70c981c12ee164f45f570b7e2013dacb630d6341ee67d4821519a9c33277f2801ad87521329b984e66873e6c0

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\ELEVAT~1.EXE

MD5 f31b25bb1e8bd429892a63eaac0bce5d
SHA1 f007774635ef84623a7b4e0c892a8ee14c4b6221
SHA256 35e16cb335e2e73dc5a8ea0117598cebc98aa2e3550b32a4fb2b3d1f60be17d9
SHA512 f9515824dc4de6968903471bcc842e97acc30489d2054357c61098af190aae30ec7027c5e99aa9da1f527d53cddc209dd793db937e69f316ba1c9206884dff0a

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\IDENTI~1.EXE

MD5 15cd9e7eaf820175f296898804aa5c4a
SHA1 742c03970ea22b85ed5afaa53226475046b45f01
SHA256 e109f477b2569c5d5e35442ddbb17228834d94b1d9edf5d7c1fc18259226f31a
SHA512 5ce8d6e3cf7879e86afe1389501682d74d6d6c661d7bd484718153ded06f7ebbd16d6b5262bcfce4e8cd333d81d581c464ca32642f6b2670fb646d98e52531ec

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\PWAHEL~1.EXE

MD5 6aa892c7d9621d5388526f832195fc0f
SHA1 9f77f2fe1166734a4eda02222b5ec080091b68c9
SHA256 e5f38ea31c0d27d3d0435d4f19e3da0e023a9fa94bf611d5d522b72d9a2b3b66
SHA512 6bf56ce59afcf84265cd757ff99b8d664361f0f23d521386b0092b1574d34eb619184c6f8925b57fa0b94f5edf30453d6cec3b39273f8735cfe1835961ac0e3c

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\NOTIFI~1.EXE

MD5 9265ab18f47b9624d04a7bcc4794cd89
SHA1 4589d080807701f5a4813326a1b72d62e71d2880
SHA256 0cb11ab79f1810b4589f2a28a12dee99c8c913428b6c6e497123800e2134ec3c
SHA512 aa7870c60af1a278e78569c487950f6b9868b4941a25783fad63ea4bc07ba2959a8bb1b2242fc492a2ec85df610dcfcda08013501a2dd9fd9b8dcd728c0d5ead

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\MSEDGE~3.EXE

MD5 3fb2cf6a0421577b8472a17467bfb35d
SHA1 87c2bbb724b4b0b7188b1920f2153c690dcc119f
SHA256 deb41ac70ab764b0d2f33c59ecc8fc053506be487e2f9115822610812d79c1b2
SHA512 b4de8e9643455ae7b32c8fdd3a6484af62814b270a748898e12a65c4ed4b64ab1efa29db09a6b09318021da2630bc521ce16632317fc947bbe16b8aa0d6abe47

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\MSEDGE~2.EXE

MD5 f84dfd8a1abe7969d7fabd9ed8980526
SHA1 45d52593f1c3a65cba20e89075fae77f7a3d0e15
SHA256 2a25cb005e74bf5ffc879f575d41d9d8d142444528f2af2f6f214e9f7fa32864
SHA512 ff4d9645d1540cf55afe81fa13ada1f1fec735a6bad8031d9537cd50086001975a594602ae8ebb03432b1ffe9ca271df164d6689963cdfa96609f87fc36e1a90

C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\msedge.exe

MD5 5d756a0168c787760258a53087193fcd
SHA1 3a1190370ec84df9cbc2d0b8dc2c3c040268e667
SHA256 4dcb3cc3b7e87ea4fdfe524d5d24a32eab1f87f1d477620879edbf8ac99c25d8
SHA512 213c39edbce4602f5e2882ba39d59ab51552b5e1c384c5e274addf3ddaafecd50fd9763a888fac7b406f136dcca63ca29a696ba407ae5e1e0446bee95ad24af4

C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~3.EXE

MD5 4cffb68680511742ad8a15d3c261387c
SHA1 754153050f13c2e54713b7be3c939a0d04cc87e2
SHA256 9700b052d9424d6397e8c0da2274b5bdd9c49a5b6943def938481a0b9a05aa60
SHA512 edeaa427cdc0c2a18c679ced0cc6ddfcd6e619fbe344b86486ea6ad8f3b93cf874a1055b9260159108a9698acdaa11ea82e6fac91938886f670c66dad6f52981

C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe

MD5 5d656c152b22ddd4f875306ca928243a
SHA1 177ff847aa898afa1b786077ae87b5ae0c7687c7
SHA256 4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
SHA512 d5e50ee909ea06e69fc0d9999c6d142f9154e6f63462312b4e950cf6e26a7d395dbb50c8e2a8c4f4e1cfb7b2c6ae8ad19e3b7c204c20e7557daa1a0deb454160

C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

MD5 32853955255a94fcd7587ca9cbfe2b60
SHA1 c33a88184c09e89598f0cabf68ce91c8d5791521
SHA256 64df64b39ac4391aea14eb48b0489e6a970a3ea44c02c6a8f10c278cc0636330
SHA512 8566b69668729d70567ff494de8f241329baf2a7748ab0ebf5a53308c3e53e646100af4f6fc33325f3851030d11ff045a7e85e5897008e95c991990d8f80a997

C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe

MD5 05bdfd8a3128ab14d96818f43ebe9c0e
SHA1 495cbbd020391e05d11c52aa23bdae7b89532eb7
SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
SHA512 8d9b9fc407986bd53fe3b56c96b7371cc782b4bac705253bfb0a2b0b1e6883fdb022f1ac87b8bfd7005291991b6a3dfbaceab54f5d494e0af70f0435a0b8b0da

C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

MD5 97510a7d9bf0811a6ea89fad85a9f3f3
SHA1 2ac0c49b66a92789be65580a38ae9798237711db
SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
SHA512 2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

MD5 54e67c8b0443ce246f62af0ab4e4c1bb
SHA1 0fc53839297408e094ff6400a632f18493290f01
SHA256 323b0928e6c7353ac217d77f11ca873e9b9d6cc22aa74ba93c6df6a41b8b50b2
SHA512 53c11c7d9aa996f68fe9bdaff67e0013d376ca236f1f6eb5590ad9d24319584641704a4d58287b238d15825b5d4b91a984d9acbb3f64f822ed3541e98ab96983

C:\Users\ALLUSE~1\PACKAG~1\{FB050~1\WINDOW~1.EXE

MD5 443cfb6389cc0462180c83a6c84e2f50
SHA1 1be84e7fedb5b094808cf186d87d0128b6841cbc
SHA256 c640e656f0f715391b77c9c14cb60042daae6dbd8a22ddd0952c5d91a556c292
SHA512 18423c27e5e229e288ce8dd6e96bd33921c503ca491a20a6d81cd1b124ce7c0d56957e029ed9ba2c97042300353f37c7b78ac262c55697c556608ba1e2426896

C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

MD5 91490c78c45cbd686ac759b6a252e898
SHA1 51bb6c5aa14cf478b0b6fa0329c7366d1f6fb480
SHA256 47f3331b4f35012d38bc11cdeae0ff7b4ae1186d4e916e3e48a9440438296821
SHA512 f7d44cd6df2c0c492731c14ca27e26605e8cddb9cb9287bf083fe1e43f753cafa11c341f0915510ad1d189466e92bb3f4e219b3599e9df72878bde14518bee35

C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

MD5 158ac449f157d04475a90f7f2abbc6ae
SHA1 d36b5662db65b384671c112c19f3ecd5cb481c96
SHA256 601ec6798ab46e1c73843625b13039364839f33c6d3a4988d1fcaa655117963c
SHA512 000723eb73cc00d2f8c1110887defa7102d33e0cbc261d9a0f6bf055249a4c56425bd8bd78dd98cf1af7836b4f7b2406141c636fc1b960b750cb45a42dc44c3a

C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

MD5 4cf3954a39b7e27f364cbb5e58a3a957
SHA1 4498a5dea907da2b85e30bf6a1ebddfbaba2eb18
SHA256 f24a6d80aff3ee9ee65a609376d1aa3fdb3a034847ebbc0e4e65ff20ab0893fb
SHA512 d7dd8c5ad15dda561ae309fbf18e5ad2e852e951e937ea062cc0cb035df74ecb5a9aa636c6813aef37271268cedb1b3c5d39a8b6519fd54f5346445a2a9ef57d

C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

MD5 cc5020b193486a88f373bedca78e24c8
SHA1 61744a1675ce10ddd196129b49331d517d7da884
SHA256 e87936bb1f0794b7622f8ce5b88e4b57b2358c4e0d0fd87c5cd9fa03b8429e2a
SHA512 bc2c77a25ad9f25ac19d8216dafc5417513cb57b9984237a5589a0bb684fdac4540695fcfb0df150556823b191014c96b002e4234a779bd064d36166afeb09d2

C:\Users\ALLUSE~1\PACKAG~1\{17316~1\WINDOW~1.EXE

MD5 34b91dd4c39e8812fb015119143e74eb
SHA1 5915b72bc65bcb7bde748210fa148ee1381977c8
SHA256 b5755ccd0c747dfe3a4d2b3eaff7e2d5039b7874b6e1b77b8c631a6f10e59780
SHA512 a5d5d1ced6b9e54cdbded107f28f1f947557296ba8c0b7e9e55fa19b99813169c89faa00dc96a1ded599f5dea3b26e3104f3386bfa9338011d3475ce6274c814

memory/1804-213-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-214-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-215-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-216-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-217-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-218-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-219-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-220-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-221-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-222-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-223-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-224-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-225-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-226-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-227-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-228-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-229-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-230-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-231-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-232-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-235-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-236-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-237-0x0000000000400000-0x000000000041B000-memory.dmp