Malware Analysis Report

2024-11-15 06:22

Sample ID 240525-llr51scg5t
Target FILMORA 13 (BY JOCO).exe
SHA256 a876e5b597b87eed8c8065ceed5527ac56bbefb92bc37e1b4fee53a8828f9c80
Tags
lumma stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a876e5b597b87eed8c8065ceed5527ac56bbefb92bc37e1b4fee53a8828f9c80

Threat Level: Known bad

The file FILMORA 13 (BY JOCO).exe was found to be: Known bad.

Malicious Activity Summary

lumma stealer

Lumma Stealer

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Modifies data under HKEY_USERS

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-25 09:37

Signatures

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

152s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Ef

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Ef

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

157s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Ic

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Ic

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3856 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240221-en

Max time kernel

122s

Max time network

130s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Advocacy

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Advocacy

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20231129-en

Max time kernel

121s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Explosion

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Explosion

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240508-en

Max time kernel

122s

Max time network

126s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Gonna

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Gonna

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240426-en

Max time kernel

130s

Max time network

103s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Gonna

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Gonna

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

107s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Injuries

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Injuries

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240221-en

Max time kernel

121s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\758307\Justice.pif N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2256 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe C:\Windows\SysWOW64\cmd.exe
PID 2256 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe C:\Windows\SysWOW64\cmd.exe
PID 2256 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe C:\Windows\SysWOW64\cmd.exe
PID 2256 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2568 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2568 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2568 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2568 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2568 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2568 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2568 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2568 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2568 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\758307\Justice.pif
PID 2568 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\758307\Justice.pif
PID 2568 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\758307\Justice.pif
PID 2568 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\758307\Justice.pif
PID 2568 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2568 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2568 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2568 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe

"C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Respiratory Respiratory.cmd & Respiratory.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 758307

C:\Windows\SysWOW64\findstr.exe

findstr /V "ALLOYEQUIVALENTMESSAGESFABULOUS" During

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b With + Associated + Applicants 758307\J

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\758307\Justice.pif

758307\Justice.pif 758307\J

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 hYvplTRUHhRzVVjOgS.hYvplTRUHhRzVVjOgS udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Respiratory

MD5 28a32da63bcaa0f28261d6693d1cf0bd
SHA1 0acc082d401ddcd462e1f10e5b5b013b986e85bd
SHA256 69a87a5d3a96ca7695d8176bdbe52329a79174793e7a3b53fe65ca4965297dae
SHA512 04d129e0515dd1feb3364003f8148b0717484ed65bc69154c8033cd84ca285c8801079d6fc536d7a71c9893ed539c74a9b66e0393758b855e21b9a3c8c4dafb4

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\During

MD5 5e2f9a5d71031e5af5ee1982ec122385
SHA1 264c3509c957136f55ccdc7884f893455e09480b
SHA256 9205db3f3386e0fa7588d6035786206d6e6b9ab60682df1a4a7306dacd6e9099
SHA512 0284a9157babae7b7977323ddb0c1d9e91837dcd71a5bbd11a6acf490407d2febf66fc041b436b156987f0ea5db1f6e19746ab0b62514ef97665ad7c9747b10f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Simplified

MD5 5623833ba5e2e365474b50e574b61e09
SHA1 d27a4d0a32b189c1da716ee43ffd32796994a1c7
SHA256 5ee0f0c77156fd012867d48d599dea4af80274667184502ddbfe144c7ea4caac
SHA512 559d87505e89954ecf594fc4e1093cace164f426cc44478e16667598a2d26e1e3835d684639eb8037f261802f5233584dfdaf2eb5580bb1434b9b149c45bb5cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Most

MD5 ce82a72d4f27fa54cde08d6a7de023ea
SHA1 aa3cd0ce7eb810dff50eb268561d40088855d967
SHA256 8461569d69ae18e7e6d38878515ebdca73819ec958668a079cb151334048bfb5
SHA512 e17e6f1e13bca672fbfd412251f236288d37c4404f72e2adc1264b2837752bce0c5f563f0b8d57562550f7fd695f10f8527204cb430f1874ea46c0a88aa6afcd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Injuries

MD5 20e964022656bb60eefce6b8fc5f019d
SHA1 bb79fa886732357689f48224756612fd34018e08
SHA256 1895144876550efb1671c206f1f5ac2d19ff12a87d04c2b067b9b7a666e52f08
SHA512 7ee7e8d7e46677226b812b1b9782e087aabf261cb011b80e3ed22dd6b5cba4c42abbd3f20301d8b8a4f26c45b2cdb657f746f347d3e69eeea169452e974a2da8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Explosion

MD5 d9b65c63a23ea8785038fca4dab8a4cd
SHA1 420d8830448645805256934521bebc1c974a3f8a
SHA256 1a0c2c8c92e81131fb12f3230ea8d1af07d0e19fa97b7d7b36f1a6f2357b4c42
SHA512 2f45d89004b58194d344cfcb847b82b155d4ff93826e502887b20dacd79fa9e3058ef50d5a02ff76081bd618cab200ba20c462376a02515870eeae63992aac60

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Wang

MD5 77b7324cc8feb4c47b47bc7d286734cb
SHA1 6238e454e9e58fbac8b313249bd1b13d9a5bc4e3
SHA256 7e1a43e7847002230ef430cabcfcfd8ff9dca802ebfbc1418a65dadd5911ca71
SHA512 c2b10b969a170dff4bdd9644caa5b56288b1544ca4c331af74c2681162bdd7a5e6d2a35da99134cde3f0396e6570eea818a7ed3429880cacb0e8a5d3969b8ce8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Performances

MD5 a2ea22ae85c45c3f4689b048dde7ca55
SHA1 3a13e93d4946fb22247fdffeb7e75d0f70abc08d
SHA256 889ebea27ea2fcbe7f1fa089bd0ba557d4803fca709e24878b6ab94dbdb8beed
SHA512 49ad088c70eae5bcc37fbac000830a251cbb789e3bf78143767407769247aae43d7585638840c0bcc1e4cefa7b6160c59351b06346c48b7080f8f0d18c3bed0d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Ic

MD5 5a9e0657cc95cec7266e2a3de5e1c2f2
SHA1 7deb2d008de04abb82635ae70484e7a52c499dbd
SHA256 6ae82e6c6e98758148fe1d1c96d6e2a95b0380a53508c8cfb3fa20ad533f6b40
SHA512 ca896c43f21ecbb84d2547821bf00e9e52fb7c4c64b59402e0bdf15bd083f19fc73f36e2746f9f78178323fd47afb5e67a92c15e29e491b51e1d3eaab71f27ea

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Waiting

MD5 a7df329dd255b2c80bceee92df472210
SHA1 1714c8ce7244f66dd5cda0834c44a7df82ba8e57
SHA256 34962fb69dc17f470ff5a4c3213820959474c207c06bc775f244fe78f66a7ba6
SHA512 564c6dc70f0a6bd220db0f6dc9037fead99f4e4017e53ab2ba67e023f57be8fbdee8fd3cc789ccdf497baeb22d5ea3a55b963cec4d491d8f2c4af12d535dcb87

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Changing

MD5 dd6ecb24734c87548ec4de5a793d0c88
SHA1 ebe7f894bc46cb73fa98bef6a437bf2a75110dda
SHA256 b07130b67007fe4f67741622414345b2bf14dd4d39f78358dab5fb5cf2d90421
SHA512 125834d49b4a2c21e02bbaf9fbf327357fa8de751857a2c76b77df6d901a9a1b98fb3ab78a7ded4641f886d60e5fe6a2e60b0520b4ecf33606b4a13f9b99abd5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Mongolia

MD5 2b5fb210a74518d2e86bcae9042a8d5c
SHA1 c3f9b187d75d00d4e01cceb03a4efb23da303b03
SHA256 1be1017e615283be7067f2072a1813a938fa5658e42c9480cfd36c5ac406967d
SHA512 b330eaa894445eea9501bf93c7e56c1a74a8bafe8673b79e84d6aaf8c60a7cb8247e3617d93f5887f866b2aca2085c1a01d388b62082d3b378ea0f8d0c76bf60

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Php

MD5 d8b75fc54451c85d14d74259065e5da4
SHA1 2420587cb41ec4730e74d311318b250128981f15
SHA256 082947db684b3b46092ed50334374635df7f3744ee0610b98062c10e262fe549
SHA512 10c09f8c224df991605e5d2e0f1b79e5239e2aa57f10bda0a1f749c0539986d43a1609b330a1e05e65978dc4d7d97f4abb17dae79a780f0f511ff5b292395fb0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Whats

MD5 888bad733c3271ceaf810887f5b40f8e
SHA1 97168d394c8b6f6fe16fd9c7d635864de168d078
SHA256 840db24d9f6c2978a3d81afee47f207aff56b1fb7f943d9c2e2d4ce30a2bee03
SHA512 1a200029046a4acd62e6cbff1e1dfa2ee56323706cdf5ccb9aeee407d6d2e0f95d3bc03a52842983b75bfd1e9d7dc2447b84af55cf6cca45d7beecd52c37e461

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Advocacy

MD5 e26a559dde37f92271827ec4ed2adb13
SHA1 37f4c674d82d3460fcc24554f5d11a8a4544aa0d
SHA256 527c08426c6e685cdc21a19de0a7fc2d7786f6c56a91ff6523887c10c4bb1d8d
SHA512 ad89ffb0470107adf10ccd2e90ff51c7423f31c407f05010a2cab07c257d49a409ba1058de9f75ec5f4805ff2bce4f1dc7e3b47c1770f40b36b28ab3c5f1b31b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Cameras

MD5 6b571766b51b70f0249280b0fc92fbb4
SHA1 80963aa0dfadb9d56471d80441c042dfa0918087
SHA256 bf18164c379b2528a0386df84c01d9bd42ca63d04d1abb063c157910a35a4a92
SHA512 e1329c7f16e12ccc9a1bdb09d683ae589173e02d541e33c87b9de6c8af5761d782adf751cf287a5eb1694babc599c1763beaf52e27aa23753d8b3335fd4b9167

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Jewellery

MD5 f513340a4547a8e731dfe86986969820
SHA1 6f6a15d3baa032e2aa29d00e4aaa2a3db802962d
SHA256 a28a2969510302da63eaa9cbff53bf2d0c1fb0c7f87326c70666d3d191ddf622
SHA512 149e54f9fba9240a00ddb2959b7cde5f6d4ce4261c6a4d69d45141da6ccd0fbed9e830532874b7ffa8b85cb37e584fc775e04e7acba77354feb21eb7a0c7a3cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Governance

MD5 f400f0fc5e1d4b0e1eb6a7fcae0c6ff6
SHA1 b04fdc6ad7ce69345edcd37b4c5d64ac57681317
SHA256 a7eabb41e493a8eda7e819ff0a566165d331e4529efe8c30a02656fa705d114f
SHA512 c2e7be4a50299bbed912d427046a6ec3d29a11f4db048b03152e143e286ca5dcf94b35d28dd92dc1c6754cfe2c242bec68bc0e59afe4b8b53056fd80c7eb7118

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Ef

MD5 2f6de9debc85a1372017f1d53b514847
SHA1 84cef7bce5d3be1875a58a98a277b1ee9efa38e1
SHA256 2e0ce43509bcdc4f80c4c52bc93720057e90f111cdb8c93500bf1a4c42effbe8
SHA512 f1042dcb829ff1dd34b4f2379251511da037f6b8c93905c6235d31fcc2d08b1ce8393bcbe3406caf5916c63417df3e10bf50834aa9e20d40c4609f6a4e52572e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Gonna

MD5 ecd5d4a92ab8b6566b8eff353f3b3a52
SHA1 9142ded6c17161fa5ed75d5cb762580cff2f4d04
SHA256 df034187cd05fcca080deef2246163dc3262b6489790c24972f0c2ac673973d5
SHA512 663deb88b285e639e77a74e74d5b6429e794b08d57ae3cc381bafd611ed4765b0e8b7ecd9ad4da682f703c0e23c5e8006e09a6199c6b5fad1a7ebfda3fa2a6db

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Aa

MD5 fb9095392691fe46b68c700d50c4baba
SHA1 92517b3ef6f8353c8d923eda240011bb842d380e
SHA256 5995416df42c8637e6a7d90cf9c2afa2945426147c5f7bd52ad2bf71b5359076
SHA512 42e836ec88e8d256c6128adccdcb5d9d2904cb03ffcbd281d9a058984322308bbb218202826f0698b68c42b43ace04fdf0c4878996fca7d5fcd891a54e6691ce

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Libraries

MD5 aac33fa382313bad35ee11afb674c94f
SHA1 3cf10ea74ed3cea5cc5dce301481cc9067b55ced
SHA256 5939c5aa8db9b1d9cc877d848aa62841a322e4d3ec5b7124019340653afdf3e7
SHA512 c0469e2fc25eff9564b86e00213df3aecc10c9b25d64baa997465d2d0068e4fcf0909718a70cce92c7609fba0afba829425e11e19efe76ea68a7a7644bb483a1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Unlikely

MD5 e8711d99626f2ae5579aa632d279bb5e
SHA1 4c13538d6d78c0b8a4c513b10554bac7f881ee2b
SHA256 a45e5dd7c81a36746bdae34bea9ff0ef565961b7fcfe3025a27cdcde173b4f83
SHA512 35848d209ef429e64fa9c0977a40d7428ade10de6765dbf9b2ab5b867fea6bb03a6fec9a5751f17b251cc938dd93c1e682b901e7645365e89918f78fea234e3e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Contract

MD5 62f016ee6db03edaffacf2fb2ba04443
SHA1 c2b31048fb4a369e32b6b8cd031fb7510f425429
SHA256 c77dd03f7682c6d4fd4ab858a71689acf9f8dec170c619fbe991415ecc04f79c
SHA512 ef53a34251e61341eda99a49eb437819c0474847b119e20dd53ee64b38af4508f086a13787e7cb66724b554845ec449fba5ad5ee7b2c7fc2d7ffa88ade8890c9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Feet

MD5 c8ed6a40a768ff35af4884211ff3a8b4
SHA1 a985de77272ca083bc0a84697cc856833dbe97db
SHA256 f00583f79086b4c9042df7c3931757f6c52f4569aa3e81bd43fd7bc4373cfe07
SHA512 7c4b65d3af3f6146d65204dfcde2471e2abb80dd11217df94d47a8b4de07c08bd956d4c4b2034150b07a5867533d91db10c5574fc8227e46986062bc644d4ba6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Intelligence

MD5 15552fbc3180c803818e6bb207b85700
SHA1 1a0af952c19c11a312a330a6c12906cb0ea14735
SHA256 174c65afa32c8c5b4b886203bfed99e76b911c8a88a1fbee23d7a34ac0265aef
SHA512 5a17e7eed148267b313cca2f0400b7db4428e1a811f73b66b980079f2e178d782d50334d386ef0c87b5b63dda8673be30fe90be4ff08c676bbe624358f43e9dc

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Mixture

MD5 04cbed56a83520535b4a35ceaa0891e1
SHA1 e30340ba2ab5be93effd7983f512206de89cef45
SHA256 212d1a2858e27afe0dbdbe56a2f905b5dd62010e60b9a7c46e07b85ab7e36b1e
SHA512 914b3adf4565f8a846389cb81bcf74cf275adb906e131a0b3ae27765f8381bc48313d685e588c7f87fd512423c75a9396b44c25e65c5eccefd246ad68f45aa1a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\With

MD5 d60caf4c9c0a8529d01dcad128b0874a
SHA1 34e5a795b05afc57ffdc1b5951aabfdc0d47caeb
SHA256 b7874126ec5c92b48d1106303efe7e0f5dc21cf14e8410fb247f6521930a69e7
SHA512 4dbabc0f45bcc447760fe2c4daddaca0c6d1143670f75341980c8741a5a5bb13455c352c212cf9d16830df251952430d9ddae110dafd5c5b5e54d1a7f40a008b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Associated

MD5 1934da70e0369ff239aeadcad9a93e77
SHA1 ef04acd1095cea42f616ec6955e659873b4555eb
SHA256 3bb205bdba68f1ade823e795dd345431b1fd94fa9adad95689795fd20ca2bad6
SHA512 1971e8ae1da32870f72f3562cf8db8565be8634d5384f3b931a9f4b90a60cc942915852ebdc4bf57b9a2477ec8830ab3eb8a76afb8d35db19806b000311a189d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Applicants

MD5 6cc470c103bc3db5998d4e7b7d88256d
SHA1 8a951ad26262fb29e8a244d823ec235abbba215e
SHA256 29618cdc3196dce7c2253eacb18ef0a092355a3d3e1fb0169637a7a3a34cfb43
SHA512 356dae535f69441ea7d5457e65f98eb62e9cae28718cd64b8cba4a5784f2a4934030ed3106e26362ca1a96fc7d21461477c8ceaf18495dd98f9f10e0c19a457d

\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\758307\Justice.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\758307\J

MD5 da985bc25aac16cb99c881f1e787c9d2
SHA1 d9d2993e8fcf8ec387ebe70d7bcf6a61d8c964b9
SHA256 c8bed52df50f12d72b9d3f675fc96c09ca2f40181c77758f63c71f85a55ac3d1
SHA512 a5b2e1ab8db5b2ed14ea2ae8a5d41b9ec107cc612405ee88abf0dbf53090bc642f044e66d3adba0a0e733545605c9f550ee3cda03380910510ff3852cbad3b53

memory/2328-537-0x0000000003E30000-0x0000000003E87000-memory.dmp

memory/2328-536-0x0000000003E30000-0x0000000003E87000-memory.dmp

memory/2328-538-0x0000000003E30000-0x0000000003E87000-memory.dmp

memory/2328-540-0x0000000003E30000-0x0000000003E87000-memory.dmp

memory/2328-539-0x0000000003E30000-0x0000000003E87000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240508-en

Max time kernel

119s

Max time network

123s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Applicants

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Applicants

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

148s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Associated

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133611035412232558" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 744 wrote to memory of 5060 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 5060 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 2892 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 4944 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 4944 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 744 wrote to memory of 528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Associated

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa7030ab58,0x7ffa7030ab68,0x7ffa7030ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3684 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4584 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1932,i,15273781091473420996,6330840171255123912,131072 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

\??\pipe\crashpad_744_DTSHMSAPQPWNWDYZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 4e799423e422872cd6ccd52499f90180
SHA1 73a3915eb91cfc2654b0436651b764d9a985f86f
SHA256 587aecf3b0652a5782077f6efd70780a21907387e60b8ac3ec7d8ff9edc3215d
SHA512 17a5f3bbe7fd6552a94c1ea878a80b18c5a42e64dd74a5f80661cc8c7ef5f5f1f7c1ff06080dd2cc53c30f8e056fbdd454cb75a68a3f8f6b92ea3624d5ea684d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c69b679decad9f7a4d3b478a2182ee32
SHA1 c3702f64f2db9708d75a5958d580da94d2a57a64
SHA256 c6c04bd7cdbee68d8358fb132fd22d61ca3423df8a13306aa56e3d2b936efe24
SHA512 336dbd15f9dac7c162a320d3a0703fee01cd2034d2305358ad4138276f85ed8b2b9e35d59b0dea286b2477f80d644d4f915732af9efd2b42942994fc84bbead9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 6e93b96b9209b7cc95bdd534e3921a6f
SHA1 db1b3d953b2fddc72aff9d8759080efd0ef0055d
SHA256 0466d276ed9b3092a35ade776d84010d5e99e8f242bc3ea43d8dd21b82b7d9c4
SHA512 11323125290dd7335ea925fac0f1902053d5e56a16aef438fcf61f3f44737a3329e859c010f73f7f8ad62c9907bed73fa31ada382a5d0f76e93a7795e3f62b9c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 5f3299630d21aa047f69280d27cbe9a6
SHA1 fec660d3fd4040615c39d5ef1d7101d65d564960
SHA256 7fe55c695cc8c47f91e7f7f67fb774cb493338c4acf1317484ef9516f257bc3c
SHA512 bbeebc057687fb17916867c3d0ba379e97613daff76888928b0108dade206df8d34a5c8f038c4f6e42e47b8952f1d241465777a5dae0e0115f94714a629317ae

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 10652601e66bf8c1c3f5ab6a6f40019f
SHA1 873b5d683ece0cd705421cdf741a8a00c3983120
SHA256 9992ab11329cc68b8a843b7da32f027f5a8e332788a4e77e042df86ee2a1f296
SHA512 5e44cad519dfced75c9894ea8f719b65fe8cb5077868aa518c082802c832bd1ff33dcce6b0f2649b58752ebdc104bc949868c54f937bf9ef32fe8e709d11b5c7

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Explosion

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Explosion

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Governance

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Governance

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240426-en

Max time kernel

135s

Max time network

110s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Governance

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Governance

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

156s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Aa

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Aa

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240220-en

Max time kernel

122s

Max time network

126s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Cameras

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Cameras

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Cameras

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Cameras

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240221-en

Max time kernel

120s

Max time network

128s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Changing

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Changing

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20231129-en

Max time kernel

117s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Aa

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Aa

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240221-en

Max time kernel

118s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Contract

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Contract

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

157s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Contract

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Contract

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4260 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240215-en

Max time kernel

117s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Associated

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Associated

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240221-en

Max time kernel

120s

Max time network

126s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Ic

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Ic

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20231129-en

Max time kernel

118s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Injuries

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Injuries

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

130s

Max time network

104s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Advocacy

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Advocacy

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

154s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Changing

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Changing

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\During

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\During

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

107s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\During

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\During

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240426-en

Max time kernel

135s

Max time network

109s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Feet

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Feet

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240426-en

Max time kernel

137s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe"

Signatures

Lumma Stealer

stealer lumma

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\758307\Justice.pif N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2620 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2864 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2864 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2864 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2864 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2864 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2864 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2864 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\758307\Justice.pif
PID 2864 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\758307\Justice.pif
PID 2864 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\758307\Justice.pif
PID 2864 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2864 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2864 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe

"C:\Users\Admin\AppData\Local\Temp\FILMORA 13 (BY JOCO).exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Respiratory Respiratory.cmd & Respiratory.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 758307

C:\Windows\SysWOW64\findstr.exe

findstr /V "ALLOYEQUIVALENTMESSAGESFABULOUS" During

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b With + Associated + Applicants 758307\J

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\758307\Justice.pif

758307\Justice.pif 758307\J

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 hYvplTRUHhRzVVjOgS.hYvplTRUHhRzVVjOgS udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 survivalpersisttww.shop udp
US 104.21.84.7:443 survivalpersisttww.shop tcp
US 8.8.8.8:53 museumtespaceorsp.shop udp
US 172.67.184.107:443 museumtespaceorsp.shop tcp
US 8.8.8.8:53 7.84.21.104.in-addr.arpa udp
US 8.8.8.8:53 buttockdecarderwiso.shop udp
US 104.21.45.202:443 buttockdecarderwiso.shop tcp
US 8.8.8.8:53 averageaattractiionsl.shop udp
US 104.21.62.60:443 averageaattractiionsl.shop tcp
US 8.8.8.8:53 femininiespywageg.shop udp
US 172.67.141.63:443 femininiespywageg.shop tcp
US 8.8.8.8:53 107.184.67.172.in-addr.arpa udp
US 8.8.8.8:53 employhabragaomlsp.shop udp
US 172.67.203.218:443 employhabragaomlsp.shop tcp
US 8.8.8.8:53 stalfbaclcalorieeis.shop udp
US 172.67.131.36:443 stalfbaclcalorieeis.shop tcp
US 8.8.8.8:53 202.45.21.104.in-addr.arpa udp
US 8.8.8.8:53 60.62.21.104.in-addr.arpa udp
US 8.8.8.8:53 63.141.67.172.in-addr.arpa udp
US 8.8.8.8:53 218.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 civilianurinedtsraov.shop udp
US 104.21.49.245:443 civilianurinedtsraov.shop tcp
US 8.8.8.8:53 roomabolishsnifftwk.shop udp
US 104.21.55.87:443 roomabolishsnifftwk.shop tcp
US 8.8.8.8:53 245.49.21.104.in-addr.arpa udp
US 8.8.8.8:53 36.131.67.172.in-addr.arpa udp
US 8.8.8.8:53 87.55.21.104.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Respiratory

MD5 28a32da63bcaa0f28261d6693d1cf0bd
SHA1 0acc082d401ddcd462e1f10e5b5b013b986e85bd
SHA256 69a87a5d3a96ca7695d8176bdbe52329a79174793e7a3b53fe65ca4965297dae
SHA512 04d129e0515dd1feb3364003f8148b0717484ed65bc69154c8033cd84ca285c8801079d6fc536d7a71c9893ed539c74a9b66e0393758b855e21b9a3c8c4dafb4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\During

MD5 5e2f9a5d71031e5af5ee1982ec122385
SHA1 264c3509c957136f55ccdc7884f893455e09480b
SHA256 9205db3f3386e0fa7588d6035786206d6e6b9ab60682df1a4a7306dacd6e9099
SHA512 0284a9157babae7b7977323ddb0c1d9e91837dcd71a5bbd11a6acf490407d2febf66fc041b436b156987f0ea5db1f6e19746ab0b62514ef97665ad7c9747b10f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Simplified

MD5 5623833ba5e2e365474b50e574b61e09
SHA1 d27a4d0a32b189c1da716ee43ffd32796994a1c7
SHA256 5ee0f0c77156fd012867d48d599dea4af80274667184502ddbfe144c7ea4caac
SHA512 559d87505e89954ecf594fc4e1093cace164f426cc44478e16667598a2d26e1e3835d684639eb8037f261802f5233584dfdaf2eb5580bb1434b9b149c45bb5cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Most

MD5 ce82a72d4f27fa54cde08d6a7de023ea
SHA1 aa3cd0ce7eb810dff50eb268561d40088855d967
SHA256 8461569d69ae18e7e6d38878515ebdca73819ec958668a079cb151334048bfb5
SHA512 e17e6f1e13bca672fbfd412251f236288d37c4404f72e2adc1264b2837752bce0c5f563f0b8d57562550f7fd695f10f8527204cb430f1874ea46c0a88aa6afcd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Injuries

MD5 20e964022656bb60eefce6b8fc5f019d
SHA1 bb79fa886732357689f48224756612fd34018e08
SHA256 1895144876550efb1671c206f1f5ac2d19ff12a87d04c2b067b9b7a666e52f08
SHA512 7ee7e8d7e46677226b812b1b9782e087aabf261cb011b80e3ed22dd6b5cba4c42abbd3f20301d8b8a4f26c45b2cdb657f746f347d3e69eeea169452e974a2da8

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explosion

MD5 d9b65c63a23ea8785038fca4dab8a4cd
SHA1 420d8830448645805256934521bebc1c974a3f8a
SHA256 1a0c2c8c92e81131fb12f3230ea8d1af07d0e19fa97b7d7b36f1a6f2357b4c42
SHA512 2f45d89004b58194d344cfcb847b82b155d4ff93826e502887b20dacd79fa9e3058ef50d5a02ff76081bd618cab200ba20c462376a02515870eeae63992aac60

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Wang

MD5 77b7324cc8feb4c47b47bc7d286734cb
SHA1 6238e454e9e58fbac8b313249bd1b13d9a5bc4e3
SHA256 7e1a43e7847002230ef430cabcfcfd8ff9dca802ebfbc1418a65dadd5911ca71
SHA512 c2b10b969a170dff4bdd9644caa5b56288b1544ca4c331af74c2681162bdd7a5e6d2a35da99134cde3f0396e6570eea818a7ed3429880cacb0e8a5d3969b8ce8

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Performances

MD5 a2ea22ae85c45c3f4689b048dde7ca55
SHA1 3a13e93d4946fb22247fdffeb7e75d0f70abc08d
SHA256 889ebea27ea2fcbe7f1fa089bd0ba557d4803fca709e24878b6ab94dbdb8beed
SHA512 49ad088c70eae5bcc37fbac000830a251cbb789e3bf78143767407769247aae43d7585638840c0bcc1e4cefa7b6160c59351b06346c48b7080f8f0d18c3bed0d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ic

MD5 5a9e0657cc95cec7266e2a3de5e1c2f2
SHA1 7deb2d008de04abb82635ae70484e7a52c499dbd
SHA256 6ae82e6c6e98758148fe1d1c96d6e2a95b0380a53508c8cfb3fa20ad533f6b40
SHA512 ca896c43f21ecbb84d2547821bf00e9e52fb7c4c64b59402e0bdf15bd083f19fc73f36e2746f9f78178323fd47afb5e67a92c15e29e491b51e1d3eaab71f27ea

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Waiting

MD5 a7df329dd255b2c80bceee92df472210
SHA1 1714c8ce7244f66dd5cda0834c44a7df82ba8e57
SHA256 34962fb69dc17f470ff5a4c3213820959474c207c06bc775f244fe78f66a7ba6
SHA512 564c6dc70f0a6bd220db0f6dc9037fead99f4e4017e53ab2ba67e023f57be8fbdee8fd3cc789ccdf497baeb22d5ea3a55b963cec4d491d8f2c4af12d535dcb87

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Changing

MD5 dd6ecb24734c87548ec4de5a793d0c88
SHA1 ebe7f894bc46cb73fa98bef6a437bf2a75110dda
SHA256 b07130b67007fe4f67741622414345b2bf14dd4d39f78358dab5fb5cf2d90421
SHA512 125834d49b4a2c21e02bbaf9fbf327357fa8de751857a2c76b77df6d901a9a1b98fb3ab78a7ded4641f886d60e5fe6a2e60b0520b4ecf33606b4a13f9b99abd5

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mongolia

MD5 2b5fb210a74518d2e86bcae9042a8d5c
SHA1 c3f9b187d75d00d4e01cceb03a4efb23da303b03
SHA256 1be1017e615283be7067f2072a1813a938fa5658e42c9480cfd36c5ac406967d
SHA512 b330eaa894445eea9501bf93c7e56c1a74a8bafe8673b79e84d6aaf8c60a7cb8247e3617d93f5887f866b2aca2085c1a01d388b62082d3b378ea0f8d0c76bf60

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Php

MD5 d8b75fc54451c85d14d74259065e5da4
SHA1 2420587cb41ec4730e74d311318b250128981f15
SHA256 082947db684b3b46092ed50334374635df7f3744ee0610b98062c10e262fe549
SHA512 10c09f8c224df991605e5d2e0f1b79e5239e2aa57f10bda0a1f749c0539986d43a1609b330a1e05e65978dc4d7d97f4abb17dae79a780f0f511ff5b292395fb0

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Whats

MD5 888bad733c3271ceaf810887f5b40f8e
SHA1 97168d394c8b6f6fe16fd9c7d635864de168d078
SHA256 840db24d9f6c2978a3d81afee47f207aff56b1fb7f943d9c2e2d4ce30a2bee03
SHA512 1a200029046a4acd62e6cbff1e1dfa2ee56323706cdf5ccb9aeee407d6d2e0f95d3bc03a52842983b75bfd1e9d7dc2447b84af55cf6cca45d7beecd52c37e461

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Advocacy

MD5 e26a559dde37f92271827ec4ed2adb13
SHA1 37f4c674d82d3460fcc24554f5d11a8a4544aa0d
SHA256 527c08426c6e685cdc21a19de0a7fc2d7786f6c56a91ff6523887c10c4bb1d8d
SHA512 ad89ffb0470107adf10ccd2e90ff51c7423f31c407f05010a2cab07c257d49a409ba1058de9f75ec5f4805ff2bce4f1dc7e3b47c1770f40b36b28ab3c5f1b31b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cameras

MD5 6b571766b51b70f0249280b0fc92fbb4
SHA1 80963aa0dfadb9d56471d80441c042dfa0918087
SHA256 bf18164c379b2528a0386df84c01d9bd42ca63d04d1abb063c157910a35a4a92
SHA512 e1329c7f16e12ccc9a1bdb09d683ae589173e02d541e33c87b9de6c8af5761d782adf751cf287a5eb1694babc599c1763beaf52e27aa23753d8b3335fd4b9167

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ef

MD5 2f6de9debc85a1372017f1d53b514847
SHA1 84cef7bce5d3be1875a58a98a277b1ee9efa38e1
SHA256 2e0ce43509bcdc4f80c4c52bc93720057e90f111cdb8c93500bf1a4c42effbe8
SHA512 f1042dcb829ff1dd34b4f2379251511da037f6b8c93905c6235d31fcc2d08b1ce8393bcbe3406caf5916c63417df3e10bf50834aa9e20d40c4609f6a4e52572e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Gonna

MD5 ecd5d4a92ab8b6566b8eff353f3b3a52
SHA1 9142ded6c17161fa5ed75d5cb762580cff2f4d04
SHA256 df034187cd05fcca080deef2246163dc3262b6489790c24972f0c2ac673973d5
SHA512 663deb88b285e639e77a74e74d5b6429e794b08d57ae3cc381bafd611ed4765b0e8b7ecd9ad4da682f703c0e23c5e8006e09a6199c6b5fad1a7ebfda3fa2a6db

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mixture

MD5 04cbed56a83520535b4a35ceaa0891e1
SHA1 e30340ba2ab5be93effd7983f512206de89cef45
SHA256 212d1a2858e27afe0dbdbe56a2f905b5dd62010e60b9a7c46e07b85ab7e36b1e
SHA512 914b3adf4565f8a846389cb81bcf74cf275adb906e131a0b3ae27765f8381bc48313d685e588c7f87fd512423c75a9396b44c25e65c5eccefd246ad68f45aa1a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Intelligence

MD5 15552fbc3180c803818e6bb207b85700
SHA1 1a0af952c19c11a312a330a6c12906cb0ea14735
SHA256 174c65afa32c8c5b4b886203bfed99e76b911c8a88a1fbee23d7a34ac0265aef
SHA512 5a17e7eed148267b313cca2f0400b7db4428e1a811f73b66b980079f2e178d782d50334d386ef0c87b5b63dda8673be30fe90be4ff08c676bbe624358f43e9dc

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Feet

MD5 c8ed6a40a768ff35af4884211ff3a8b4
SHA1 a985de77272ca083bc0a84697cc856833dbe97db
SHA256 f00583f79086b4c9042df7c3931757f6c52f4569aa3e81bd43fd7bc4373cfe07
SHA512 7c4b65d3af3f6146d65204dfcde2471e2abb80dd11217df94d47a8b4de07c08bd956d4c4b2034150b07a5867533d91db10c5574fc8227e46986062bc644d4ba6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Contract

MD5 62f016ee6db03edaffacf2fb2ba04443
SHA1 c2b31048fb4a369e32b6b8cd031fb7510f425429
SHA256 c77dd03f7682c6d4fd4ab858a71689acf9f8dec170c619fbe991415ecc04f79c
SHA512 ef53a34251e61341eda99a49eb437819c0474847b119e20dd53ee64b38af4508f086a13787e7cb66724b554845ec449fba5ad5ee7b2c7fc2d7ffa88ade8890c9

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Unlikely

MD5 e8711d99626f2ae5579aa632d279bb5e
SHA1 4c13538d6d78c0b8a4c513b10554bac7f881ee2b
SHA256 a45e5dd7c81a36746bdae34bea9ff0ef565961b7fcfe3025a27cdcde173b4f83
SHA512 35848d209ef429e64fa9c0977a40d7428ade10de6765dbf9b2ab5b867fea6bb03a6fec9a5751f17b251cc938dd93c1e682b901e7645365e89918f78fea234e3e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Libraries

MD5 aac33fa382313bad35ee11afb674c94f
SHA1 3cf10ea74ed3cea5cc5dce301481cc9067b55ced
SHA256 5939c5aa8db9b1d9cc877d848aa62841a322e4d3ec5b7124019340653afdf3e7
SHA512 c0469e2fc25eff9564b86e00213df3aecc10c9b25d64baa997465d2d0068e4fcf0909718a70cce92c7609fba0afba829425e11e19efe76ea68a7a7644bb483a1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Aa

MD5 fb9095392691fe46b68c700d50c4baba
SHA1 92517b3ef6f8353c8d923eda240011bb842d380e
SHA256 5995416df42c8637e6a7d90cf9c2afa2945426147c5f7bd52ad2bf71b5359076
SHA512 42e836ec88e8d256c6128adccdcb5d9d2904cb03ffcbd281d9a058984322308bbb218202826f0698b68c42b43ace04fdf0c4878996fca7d5fcd891a54e6691ce

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Jewellery

MD5 f513340a4547a8e731dfe86986969820
SHA1 6f6a15d3baa032e2aa29d00e4aaa2a3db802962d
SHA256 a28a2969510302da63eaa9cbff53bf2d0c1fb0c7f87326c70666d3d191ddf622
SHA512 149e54f9fba9240a00ddb2959b7cde5f6d4ce4261c6a4d69d45141da6ccd0fbed9e830532874b7ffa8b85cb37e584fc775e04e7acba77354feb21eb7a0c7a3cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Governance

MD5 f400f0fc5e1d4b0e1eb6a7fcae0c6ff6
SHA1 b04fdc6ad7ce69345edcd37b4c5d64ac57681317
SHA256 a7eabb41e493a8eda7e819ff0a566165d331e4529efe8c30a02656fa705d114f
SHA512 c2e7be4a50299bbed912d427046a6ec3d29a11f4db048b03152e143e286ca5dcf94b35d28dd92dc1c6754cfe2c242bec68bc0e59afe4b8b53056fd80c7eb7118

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\With

MD5 d60caf4c9c0a8529d01dcad128b0874a
SHA1 34e5a795b05afc57ffdc1b5951aabfdc0d47caeb
SHA256 b7874126ec5c92b48d1106303efe7e0f5dc21cf14e8410fb247f6521930a69e7
SHA512 4dbabc0f45bcc447760fe2c4daddaca0c6d1143670f75341980c8741a5a5bb13455c352c212cf9d16830df251952430d9ddae110dafd5c5b5e54d1a7f40a008b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Associated

MD5 1934da70e0369ff239aeadcad9a93e77
SHA1 ef04acd1095cea42f616ec6955e659873b4555eb
SHA256 3bb205bdba68f1ade823e795dd345431b1fd94fa9adad95689795fd20ca2bad6
SHA512 1971e8ae1da32870f72f3562cf8db8565be8634d5384f3b931a9f4b90a60cc942915852ebdc4bf57b9a2477ec8830ab3eb8a76afb8d35db19806b000311a189d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Applicants

MD5 6cc470c103bc3db5998d4e7b7d88256d
SHA1 8a951ad26262fb29e8a244d823ec235abbba215e
SHA256 29618cdc3196dce7c2253eacb18ef0a092355a3d3e1fb0169637a7a3a34cfb43
SHA512 356dae535f69441ea7d5457e65f98eb62e9cae28718cd64b8cba4a5784f2a4934030ed3106e26362ca1a96fc7d21461477c8ceaf18495dd98f9f10e0c19a457d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\758307\Justice.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\758307\J

MD5 da985bc25aac16cb99c881f1e787c9d2
SHA1 d9d2993e8fcf8ec387ebe70d7bcf6a61d8c964b9
SHA256 c8bed52df50f12d72b9d3f675fc96c09ca2f40181c77758f63c71f85a55ac3d1
SHA512 a5b2e1ab8db5b2ed14ea2ae8a5d41b9ec107cc612405ee88abf0dbf53090bc642f044e66d3adba0a0e733545605c9f550ee3cda03380910510ff3852cbad3b53

memory/4784-534-0x0000000004520000-0x0000000004577000-memory.dmp

memory/4784-535-0x0000000004520000-0x0000000004577000-memory.dmp

memory/4784-536-0x0000000004520000-0x0000000004577000-memory.dmp

memory/4784-537-0x0000000004520000-0x0000000004577000-memory.dmp

memory/4784-538-0x0000000004520000-0x0000000004577000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win10v2004-20240508-en

Max time kernel

135s

Max time network

132s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Applicants

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Applicants

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3404,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240221-en

Max time kernel

119s

Max time network

126s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Ef

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Ef

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-25 09:37

Reported

2024-05-25 09:40

Platform

win7-20240221-en

Max time kernel

121s

Max time network

128s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Feet

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Feet

Network

N/A

Files

N/A