Malware Analysis Report

2024-11-30 05:25

Sample ID 240710-vjprjsygpn
Target modest-menu.exe
SHA256 9a36d26b871a2de4d30f8c70c27afadf739093eb00bdb54e43d1be0dd311514b
Tags
lumma stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9a36d26b871a2de4d30f8c70c27afadf739093eb00bdb54e43d1be0dd311514b

Threat Level: Known bad

The file modest-menu.exe was found to be: Known bad.

Malicious Activity Summary

lumma stealer

Suspicious use of NtCreateUserProcessOtherParentProcess

Lumma Stealer

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: GetForegroundWindowSpam

Enumerates processes with tasklist

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious behavior: LoadsDriver

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-10 17:01

Signatures

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:04

Platform

win7-20240708-en

Max time kernel

119s

Max time network

120s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Concord

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Concord

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240708-en

Max time kernel

122s

Max time network

123s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Flow

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Flow

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240704-en

Max time kernel

120s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Eco

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Eco

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240705-en

Max time kernel

118s

Max time network

119s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Believe

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Believe

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240708-en

Max time kernel

117s

Max time network

119s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Dynamics

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Dynamics

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240708-en

Max time kernel

119s

Max time network

120s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Lobby

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Lobby

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240704-en

Max time kernel

121s

Max time network

127s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Maple

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Maple

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

93s

Max time network

205s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Maple

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Maple

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 18.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 20.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

93s

Max time network

203s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Flow

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Flow

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

276s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Lobby

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Lobby

Network

Country Destination Domain Proto
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:04

Platform

win7-20240705-en

Max time kernel

118s

Max time network

119s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1712 created 1192 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Windows\Explorer.EXE

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1712 set thread context of 2500 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2688 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\modest-menu.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\modest-menu.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\modest-menu.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\modest-menu.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2788 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2788 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2788 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2788 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 1512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2788 wrote to memory of 1512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2788 wrote to memory of 1512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2788 wrote to memory of 1512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2788 wrote to memory of 704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2788 wrote to memory of 1276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 1276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 1276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 1276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 2788 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 2788 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 2788 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 2788 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2788 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2788 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2788 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1712 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 1712 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 1712 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 1712 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 1712 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 1712 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\modest-menu.exe

"C:\Users\Admin\AppData\Local\Temp\modest-menu.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Staff Staff.cmd & Staff.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 459607

C:\Windows\SysWOW64\findstr.exe

findstr /V "sisterswebsitebelongsnake" Ui

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Eco + Fax + Maple + Arrangements + Potentially 459607\V

C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

459607\Democrats.pif 459607\V

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

Network

Country Destination Domain Proto
US 8.8.8.8:53 vapVKMkZkfKexxBSScX.vapVKMkZkfKexxBSScX udp

Files

C:\Users\Admin\AppData\Local\Temp\Staff

MD5 030cb602fe0c165a78582d2626a58b07
SHA1 41b9fc49b8c6d1c1a14d92c46eb47bd531184b81
SHA256 54ba9e357ff48e4d314967a8fdc933688b6e7f3746cd15aa474543a1d0d1f68a
SHA512 3c663c8cf8cf6f4bad03c2c130b5cbf3aa5b09ccf06546074fa37642d7f2486f5095d16a7b2c46c768bccc4907f974086d73ffe21e9e6a88408d69ac1cea05a8

C:\Users\Admin\AppData\Local\Temp\Ui

MD5 59676312c613f581a99d4475fc458413
SHA1 a17e8becf3263d56565a0084d7825a73ffab5afb
SHA256 56ae5ea5c0cb79f3a06e8266a57ef78c9b5edafaf0ea144c9583284eb7c6806d
SHA512 d5d429c543fd91f2cd67c9b1f86ee044c28849dd76bb0a16c834c64774a9fe8014337cd2b31e4a75792f261a1d3f9c6f4fbbea1d3f6847d1e7d675f98f1de065

C:\Users\Admin\AppData\Local\Temp\Lobby

MD5 9cc46881959800f39ad3fa31fddc5e9b
SHA1 99af6c1a963382061014ae0c8e0057e75227c19b
SHA256 3e4f9cf22f35fb57cc0d98ed3f396c72bebfe64c645c670ff74d96ae5b4ba6e0
SHA512 96084f42f0d35211516c92ffea4f1095412e25e672fa2218d767186e77519dd1965bb21ddb3b06823a3c1578ac84e3df7a53094e49a498591bfea8875d8e4db4

C:\Users\Admin\AppData\Local\Temp\Preparing

MD5 70a2c2fcd745ec21f83383f9c6f2023f
SHA1 cdcc777f8e0755aed1696dafde819ab832e1a0a0
SHA256 62b1f942ae302a9ed8db8681a72be8d86ad1ffc5731ff14c1ce38c09954ed79f
SHA512 4191f70f718287f2ba95a69d949a69c00a24471dff35647eb5ceecdee162e685e52fb5c744c0f3e99375b7ce1e1fdd946fc8b0a5e5394ee367f3f175c56e0e99

C:\Users\Admin\AppData\Local\Temp\Advantage

MD5 f3583eb1e2b24f22b18f952ad2523c49
SHA1 760c4d12bf291c1415415f588d9ec2304fb80568
SHA256 808b624226e9d768b3a41ea917bfb099a069d71697ed51d347eedb173d3db6d7
SHA512 ef3b7dc30d939a5e5c04a60f454c76527d13009d5df669d926912bb521b81740a9a71eceb14b619d615b371583e87d93617400dad79bdc6a0ae14cf6b82a39f9

C:\Users\Admin\AppData\Local\Temp\Seq

MD5 502896b3873a6451232d89b34ab41fbc
SHA1 d2d6357558a02c8279c9e7c061da4bba86defd48
SHA256 a850c0358d25d740504b07ac311186f5bb07d01f75fab80ca021e9dd2c831651
SHA512 2dac294b39c0031d4d30a156e54acbc8c51358f31029400726f341ddc3d0e89cfbe40d16ccebc3aca7f6507aa83fcd0e68046ae4a7e1da66dde8520e9b9b705c

C:\Users\Admin\AppData\Local\Temp\Shaw

MD5 da04347cf02edc1eeb3e0b79d2621326
SHA1 fe3543daa7442739886307799ad2aba15135663a
SHA256 bea3f2ef6612ecb5b4d31316dbc637d89e0401f3e8c3f59fcca3e1ceef420e71
SHA512 c5db4cf897e674fafbf01a5a41eafe66c1e58f797e79a8c83d6e604fefd5102014d2ce6dfab4282064342cfeb6de48e135d76f967aa22925c028a148dcf25479

C:\Users\Admin\AppData\Local\Temp\Believe

MD5 02ead0c9858044ac35199230cb3ab139
SHA1 2ff088e0f73dcf1e1e4d4e1b4acc6b63febb909a
SHA256 d185919875ba821f92e14e46344ae96e343cf41f19d8f46a23589ab78538c8ea
SHA512 eb3008b7019ee3cc66a51abb469dc752aaebc684894b4db975131eb9d793c96c1f841c2d56d6366d1f3e28897c03aeb337838169df96ff37fe91dcc2da4f741f

C:\Users\Admin\AppData\Local\Temp\Titles

MD5 f7f916e0410987ec8f6beb5d0cde0506
SHA1 dc1436cb76812007616ac783a172189488c7d7f9
SHA256 8b6b8cd2a7bf79dcc7a9126d09418fb2d74e1aab3c48b55ebf1635e39c797c66
SHA512 600b84add39f0c3ecf96b3158c6365cd66853494413d82ce1afa806c52248890529cfe35ae0b1e6e72c7d04dbee94ca24ba200524a7862a64285baab97803228

C:\Users\Admin\AppData\Local\Temp\Mo

MD5 9997ac7f1a4d0ab87bdd0500f232af76
SHA1 b054d6caeb5703f5036cc706424571bc15f6e1bf
SHA256 527d35a8cb2f816cd68f6e4f71b1ddca60e01862767167ce3d9110bf27298aab
SHA512 e62c34d2e0583b414451581887f189757466926c817dc70edccd41f26841b65f11fdf0128a43e001db20238da5577a44e11ac80e66514777409d902a6eb134db

C:\Users\Admin\AppData\Local\Temp\F

MD5 14816518caf15aaa457c24cdba7533b4
SHA1 bff3122a80f5d9c60b9d8b6dbc12e8177abd3418
SHA256 7f6b87bec48a8bc8723104f0e7e49a615a57aae92b17c408b89b402530b0b231
SHA512 4b8480052ac524085f8d0e75c7b4b6071b36772df14519ee7e1b77562913472c926cdd34845754665609506972ff25401eeb9d1b905ad9ec9fb1965c1cef894c

C:\Users\Admin\AppData\Local\Temp\Auto

MD5 3be4b5a402fea1d46b93cc10075bddd2
SHA1 9dad39e5e5f7309cb68d39bd9f14b18101b15d88
SHA256 6e8f655876670322b0acf1a1b2868de0636908fcfd8823c02d738d13519a1d12
SHA512 d8b437b9f7a383034efd0fccee841f4ac2291ca0df2016143d1786d09943c12e5bf63a8c735f88a7ed52baed4d40be90013021f635e9ac93c8d996a93b2c5d51

C:\Users\Admin\AppData\Local\Temp\Mapping

MD5 2338ac12202339694680461161eecbe7
SHA1 937ee67d8c8b664aad82de70b07eb57faad99085
SHA256 6747fa62ac1dc8f1796c41c6b70ca267615de125af466ff0e63afa0a57241dbd
SHA512 ab63ebf8bb951aadce08f0be238324eb25760a6e06807c9738806489e713bc5186dce62e13e1f7803d551dee597b4d3abc8daa606b780ef0775ebf1dc07792c2

C:\Users\Admin\AppData\Local\Temp\Dynamics

MD5 a55fe7301a8331c3e202bbb350837c51
SHA1 a55c84023ff48af7ffdc229db28f45334d5f36a5
SHA256 bc8c60c912824deba76b5815c73272bf15b5a1a625a65a31015a03fb2b921f7d
SHA512 5d34b2b029e2d22ffdc90f56d561823e3eeeecb910b5742add387b78a438797c005177ce04718ec7c46d3558d56e8bf5a7129f995aa1d8eef94f300632b0f312

C:\Users\Admin\AppData\Local\Temp\Inappropriate

MD5 7e83454195c83b0961b1741fa29369b5
SHA1 3d85e2d801065a81dfcca89c6a1b10dd84e83de1
SHA256 4e1750b70791ca81d57049a3cedc97cc7a843c5de5f5d9ed156dbdd516e45675
SHA512 8cf03c11d946ce298dfe76901387a6a43da09c01f97d9895c708ff3cfd241bd274094b41be3dcc2bf56aefa3b22446ec3b9f06a169fc9b553a58bc6259e56d8e

C:\Users\Admin\AppData\Local\Temp\Date

MD5 691d085c47ae40840542b9d4796ec6de
SHA1 edef6c2afdfd011a8a856d046f9c2b56c14f24d5
SHA256 a4deefffa64a55b9ea4aaec7193f08adcaf634de875b725d63923cb8afdc8533
SHA512 55c9618d4cf477f84f165852e70c0d7a37f635345a826c456f912221d394cf6b4bf42e40f8c492272dbf1dd48d6977b239af6dde02539856877d481704f16188

C:\Users\Admin\AppData\Local\Temp\Concord

MD5 9e54cd35059c72e43735836dda986f5d
SHA1 617554bb3ff29716b67caf1284d819866b82af86
SHA256 cb8165bc704dbbd8532b8fc8e39d8902e421640229134853316dddd27304440f
SHA512 0f6cd020025c437e6692e350c5645446a528a17f60f1376cc5943d594fe34a16dc3b06e11528c57aae8d89f49168e0a26f0f263c693e52d4b82fc3048dda6ce5

C:\Users\Admin\AppData\Local\Temp\Needle

MD5 5e1d6d2322ce1474eb35585c5961d147
SHA1 74a0eb83ec28d6a40fb113caa445d672fe67de93
SHA256 04602ca78764dcdc7454d17d2e26fb71ba36414bd84d82d7b8a7778e42c47ae5
SHA512 5c9dea0f196d009c27e0826df148dde3bc611e03bfd7effd8297c625387f5590d91a66b4a5f313c3dd2f43a9e51cc596d4c48a1faeda867deeaadf28b76080ac

C:\Users\Admin\AppData\Local\Temp\Ver

MD5 c297d6446e5a63c2dab0ba7d03a52f63
SHA1 149357efe45598a0aa684c614e84ea27a39ec1ae
SHA256 e3e3a8bf01aa9dee5321058322b9f6ead5c9d433dacc3aacb366c93648f46552
SHA512 306c640a40704a954e057e834d667f186d9b2a742f93d44abe2209aa64ed397eca64c6ae2d36a05a48586dd24e9795533ed82fec9d86c9e47cfb68300c27e6bd

C:\Users\Admin\AppData\Local\Temp\Quality

MD5 e685193637d4beb11fae01332913e8d4
SHA1 dcdea1009a893bc13eb9e8633c36d5e755cbd967
SHA256 abe71774600e3d54332ab20f32b8ab4630fac973547e050a5fc0fe5080e82995
SHA512 f3d5850bf77293802d7fb71af6f5abec2a1c3f982f9c96157efca519a9dc3182db39efa25ab2e425e3e53d77a5ed881f3ef61f7cfbcbcb113c04aecc887350d0

C:\Users\Admin\AppData\Local\Temp\Rw

MD5 76e58b07f3902703111432acad665172
SHA1 2b9e2c05e1c0a3726c9072caaf0271e6c2ab9f24
SHA256 b65d4e36ce1ec40bf20cd17515bb19cbd256dcbcc3a36546643be3923d4e14be
SHA512 466e61cbbbd58fc1eca2748dbb04da8ab411c5c29ac7cf788bb8fec7b4f6444ef0821b4e9ff78ceeb45a7de4ad173ec8693a63e057ba8109d3b713fcb2fc53b5

C:\Users\Admin\AppData\Local\Temp\Enabling

MD5 b8eeb773052aa634fcda25c6a74633de
SHA1 576f435cadcd3ae2d366a32e562e7a64ec0e7d8b
SHA256 98687cff8ff2bf7de91bf8ba6d59906590e95451b6d178e61020bb1320217924
SHA512 32de3b2412540841f021d214dc6c2106dcb71b4c876625423cecd6d7f522ebb42b4c570364385c5dcacfffdce6c45536e131bfcf1119e459219e5413a99f871d

C:\Users\Admin\AppData\Local\Temp\Theme

MD5 6a01b437ec91e223e2ddd5f2e3cc4a27
SHA1 4aec9c05e200f534ec675cf004c84e0e4381d1bd
SHA256 ff63db81885a2748beb0f871f42328ad64f41120a028b3cce8e69a969ff840ff
SHA512 63ecb1f90e561ce45a5b2d599a39492f6c757b945b0c6e85acac09204017a6ac92b6dd188aa9ef825e4c25d5a17923569ef98789af6e7d3877e5697896a8072a

C:\Users\Admin\AppData\Local\Temp\Flow

MD5 4d208ce6b834f65cfbd5003a33eb0885
SHA1 1aaa9d411b90df88b7606784485897985ddbb25c
SHA256 c3479095c5afe1d7c66a07f386d2c498f8b7faacad022dd24d8b6c15cf0af0a4
SHA512 e1a31eae919358ba1fbbfe6a0af7b5fc9bff2e81ed38d02747a81e120fb16a85318f3dee15f6c5152a3e43d8745daeb5d260e590909c262017ef472269dc2acd

C:\Users\Admin\AppData\Local\Temp\Payable

MD5 b741124cff6e9c1db9ab0f6a33ac75d7
SHA1 dd009b9d1e021b8bacffd3c5f18b480a2818b526
SHA256 fbc15d78997b479259a274b424af2cf82b3cdcffd98921045121a138312b7dd0
SHA512 d755f8b8ba5904f9811f9822a9f59a7bd5216b80c56cb1f50d1d8008cadd4ef3157e157d9cf3ce1b6214cd818447d77f68c5ebdb436e0a22262cbda21bc77927

C:\Users\Admin\AppData\Local\Temp\Models

MD5 e85fc8d8241d3e01a264a0665da3e3fd
SHA1 ce495efdb324673bb677d89ebf4460ead9655076
SHA256 4c27993e83f7057a4aeb672a8c76b98c60c42be982c377ef12caab54ffeb1bfc
SHA512 25c3545ea169c63439e9e0ae2fddb5022235b74bb686a23cb353412c99f4e9190804641a53ea49ff9dec3b3d57473effe2a5faad7acd85f5fea4bbf0ed6d1362

C:\Users\Admin\AppData\Local\Temp\Eco

MD5 d52d093c2ad11a7fa8caa82118312324
SHA1 ead4b9d075e88e48a1de94b69b19e113476be660
SHA256 073569dd893fae4c511183289f63a86364d404eb9203f9f0520c604590808c06
SHA512 b311bb24344dd9829139c6784595c898e9abef230a3b965d0127e84c7c4d25e880df3e1cc6030c406da84a5ea2e806ffe6cbfb6f75563a4ea077c2fa4c5f207e

C:\Users\Admin\AppData\Local\Temp\Fax

MD5 10c3f393a193fc3a75571e32bc9a7af4
SHA1 1df5d1158c697b1f519cfac40b9c0279c82b5605
SHA256 5d26906575ef47159261b4272255a707ed22a48a85a93a1a139d2b485af66e67
SHA512 490b8b5cd6a43de1627af4e6cd02032315cf8123c3d6f43f2c188e7e0bfc3bb3caeeb016e08ab9e21ef592e9d8150a0e0140d2159e556c5f13f53e658f4c0afb

C:\Users\Admin\AppData\Local\Temp\Maple

MD5 d99951681ca785e10c3dcf0eda9289a2
SHA1 3014fa710fbf5b0c0f11f744a5767958fa09d379
SHA256 02016b08121445b1138c60d0cb7b4624dc5ffad5986349c00fc28963b4a1c29a
SHA512 eac57095aa4f8cccf076d39735a2e4a0d695fcc3ea344d941809b0080f6df1c01cc7f36eb2070de91460a176e5aeb194009fdb08a773572221c47087d80be9ac

C:\Users\Admin\AppData\Local\Temp\Arrangements

MD5 2fed43e71c00e8ba4e4812ede092a3ad
SHA1 91406ad8199c99047f0ff81886f16d3f96f82543
SHA256 f86f0c7901d3768d0240cac5fadb24ec3a70c478a8e241848d37003046bab22a
SHA512 e198076dd8f1b4c96997892c0b7afe9db23e72d9e376dd552159052e5d6bb3fbc7becf5c997a514652cf1a4b6d7737f197f2ac3227492aa7c436e9997dd04c2d

C:\Users\Admin\AppData\Local\Temp\Potentially

MD5 856169507b46db74fc9bb20bc32564f0
SHA1 8df4c41434ff9b70a74cf34307a6f13339757859
SHA256 ae7bbb6943e2804db035715e24c6ef1243465a6aafa993e908ad06fba40a745d
SHA512 e7d3d2627443c12dbfa2505ed2f190bd48aebb0cf833a3a34e1b86c32e4e76a5ff8ffc8bbcc685d4a41960b8d45f6860dc4ede5e2a2d9d8127d6719cd6cc2714

\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Temp\459607\V

MD5 e0dc987a0ec3230edcb03a012e487725
SHA1 0bd2777f8ab174d9ae9e6d1d068918c8756e050f
SHA256 8bf384c8a524c0578be6055510f6eea7f9583c8b9889b5bc36667925f9cac110
SHA512 94b908904da72d43ba4f2e6ea6a1b31909dca309ff9438a0d3bc8906fe6a7695c9736bea0da478a54dc8f0269a80c7225db8fbcf3d301036e2104fa9e271bd45

memory/2500-636-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/2500-637-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/2500-639-0x0000000000080000-0x00000000000D2000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:05

Platform

win7-20240705-en

Max time kernel

16s

Max time network

17s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Advantage

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Advantage

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:05

Platform

win10v2004-20240709-en

Max time kernel

93s

Max time network

204s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Advantage

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Advantage

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

202s

Max time network

264s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Auto

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Auto

Network

Country Destination Domain Proto
US 8.8.8.8:53 17.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:04

Platform

win10v2004-20240709-en

Max time kernel

92s

Max time network

153s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Concord

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Concord

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:05

Platform

win7-20240705-en

Max time kernel

120s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Arrangements

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Arrangements

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:04

Platform

win7-20240708-en

Max time kernel

118s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Date

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Date

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:04

Platform

win10v2004-20240709-en

Max time kernel

91s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Date

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Date

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240704-en

Max time kernel

241s

Max time network

246s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Enabling

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Enabling

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240708-en

Max time kernel

122s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\F

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\F

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

93s

Max time network

203s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\F

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\F

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

94s

Max time network

208s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Fax

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Fax

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240705-en

Max time kernel

238s

Max time network

240s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Inappropriate

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Inappropriate

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:05

Platform

win10v2004-20240709-en

Max time kernel

210s

Max time network

203s

Command Line

C:\Windows\Explorer.EXE

Signatures

Lumma Stealer

stealer lumma

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2056 created 3436 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Windows\Explorer.EXE

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\modest-menu.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2056 set thread context of 216 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 708 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\modest-menu.exe C:\Windows\SysWOW64\cmd.exe
PID 708 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\modest-menu.exe C:\Windows\SysWOW64\cmd.exe
PID 708 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\modest-menu.exe C:\Windows\SysWOW64\cmd.exe
PID 3284 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3284 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3284 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3284 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 1620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3284 wrote to memory of 1620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3284 wrote to memory of 1620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3284 wrote to memory of 3608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 3608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 3608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3284 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3284 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3284 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3284 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3284 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3284 wrote to memory of 2540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3284 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 3284 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 3284 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 3284 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3284 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3284 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2056 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 2056 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 2056 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 2056 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif
PID 2056 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\modest-menu.exe

"C:\Users\Admin\AppData\Local\Temp\modest-menu.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Staff Staff.cmd & Staff.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 459607

C:\Windows\SysWOW64\findstr.exe

findstr /V "sisterswebsitebelongsnake" Ui

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Eco + Fax + Maple + Arrangements + Potentially 459607\V

C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

459607\Democrats.pif 459607\V

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /7

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 vapVKMkZkfKexxBSScX.vapVKMkZkfKexxBSScX udp
US 8.8.8.8:53 answerrsdo.shop udp
US 104.21.44.192:443 answerrsdo.shop tcp
US 8.8.8.8:53 bouncedgowp.shop udp
US 104.21.93.198:443 bouncedgowp.shop tcp
US 8.8.8.8:53 bannngwko.shop udp
US 172.67.146.61:443 bannngwko.shop tcp
US 8.8.8.8:53 192.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 198.93.21.104.in-addr.arpa udp
US 8.8.8.8:53 bargainnykwo.shop udp
US 172.67.146.97:443 bargainnykwo.shop tcp
US 8.8.8.8:53 affecthorsedpo.shop udp
US 104.21.6.254:443 affecthorsedpo.shop tcp
US 8.8.8.8:53 radiationnopp.shop udp
US 172.67.196.169:443 radiationnopp.shop tcp
US 8.8.8.8:53 97.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 254.6.21.104.in-addr.arpa udp
US 8.8.8.8:53 61.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 publicitttyps.shop udp
US 172.67.134.88:443 publicitttyps.shop tcp
US 8.8.8.8:53 benchillppwo.shop udp
US 104.21.81.128:443 benchillppwo.shop tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 8.8.8.8:53 88.134.67.172.in-addr.arpa udp
US 8.8.8.8:53 169.196.67.172.in-addr.arpa udp
US 8.8.8.8:53 128.81.21.104.in-addr.arpa udp
US 8.8.8.8:53 reinforcedirectorywd.shop udp
US 104.21.83.48:443 reinforcedirectorywd.shop tcp
US 8.8.8.8:53 155.143.214.23.in-addr.arpa udp
US 8.8.8.8:53 48.83.21.104.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Staff

MD5 030cb602fe0c165a78582d2626a58b07
SHA1 41b9fc49b8c6d1c1a14d92c46eb47bd531184b81
SHA256 54ba9e357ff48e4d314967a8fdc933688b6e7f3746cd15aa474543a1d0d1f68a
SHA512 3c663c8cf8cf6f4bad03c2c130b5cbf3aa5b09ccf06546074fa37642d7f2486f5095d16a7b2c46c768bccc4907f974086d73ffe21e9e6a88408d69ac1cea05a8

C:\Users\Admin\AppData\Local\Temp\Ui

MD5 59676312c613f581a99d4475fc458413
SHA1 a17e8becf3263d56565a0084d7825a73ffab5afb
SHA256 56ae5ea5c0cb79f3a06e8266a57ef78c9b5edafaf0ea144c9583284eb7c6806d
SHA512 d5d429c543fd91f2cd67c9b1f86ee044c28849dd76bb0a16c834c64774a9fe8014337cd2b31e4a75792f261a1d3f9c6f4fbbea1d3f6847d1e7d675f98f1de065

C:\Users\Admin\AppData\Local\Temp\Lobby

MD5 9cc46881959800f39ad3fa31fddc5e9b
SHA1 99af6c1a963382061014ae0c8e0057e75227c19b
SHA256 3e4f9cf22f35fb57cc0d98ed3f396c72bebfe64c645c670ff74d96ae5b4ba6e0
SHA512 96084f42f0d35211516c92ffea4f1095412e25e672fa2218d767186e77519dd1965bb21ddb3b06823a3c1578ac84e3df7a53094e49a498591bfea8875d8e4db4

C:\Users\Admin\AppData\Local\Temp\Preparing

MD5 70a2c2fcd745ec21f83383f9c6f2023f
SHA1 cdcc777f8e0755aed1696dafde819ab832e1a0a0
SHA256 62b1f942ae302a9ed8db8681a72be8d86ad1ffc5731ff14c1ce38c09954ed79f
SHA512 4191f70f718287f2ba95a69d949a69c00a24471dff35647eb5ceecdee162e685e52fb5c744c0f3e99375b7ce1e1fdd946fc8b0a5e5394ee367f3f175c56e0e99

C:\Users\Admin\AppData\Local\Temp\Advantage

MD5 f3583eb1e2b24f22b18f952ad2523c49
SHA1 760c4d12bf291c1415415f588d9ec2304fb80568
SHA256 808b624226e9d768b3a41ea917bfb099a069d71697ed51d347eedb173d3db6d7
SHA512 ef3b7dc30d939a5e5c04a60f454c76527d13009d5df669d926912bb521b81740a9a71eceb14b619d615b371583e87d93617400dad79bdc6a0ae14cf6b82a39f9

C:\Users\Admin\AppData\Local\Temp\Seq

MD5 502896b3873a6451232d89b34ab41fbc
SHA1 d2d6357558a02c8279c9e7c061da4bba86defd48
SHA256 a850c0358d25d740504b07ac311186f5bb07d01f75fab80ca021e9dd2c831651
SHA512 2dac294b39c0031d4d30a156e54acbc8c51358f31029400726f341ddc3d0e89cfbe40d16ccebc3aca7f6507aa83fcd0e68046ae4a7e1da66dde8520e9b9b705c

C:\Users\Admin\AppData\Local\Temp\Shaw

MD5 da04347cf02edc1eeb3e0b79d2621326
SHA1 fe3543daa7442739886307799ad2aba15135663a
SHA256 bea3f2ef6612ecb5b4d31316dbc637d89e0401f3e8c3f59fcca3e1ceef420e71
SHA512 c5db4cf897e674fafbf01a5a41eafe66c1e58f797e79a8c83d6e604fefd5102014d2ce6dfab4282064342cfeb6de48e135d76f967aa22925c028a148dcf25479

C:\Users\Admin\AppData\Local\Temp\Believe

MD5 02ead0c9858044ac35199230cb3ab139
SHA1 2ff088e0f73dcf1e1e4d4e1b4acc6b63febb909a
SHA256 d185919875ba821f92e14e46344ae96e343cf41f19d8f46a23589ab78538c8ea
SHA512 eb3008b7019ee3cc66a51abb469dc752aaebc684894b4db975131eb9d793c96c1f841c2d56d6366d1f3e28897c03aeb337838169df96ff37fe91dcc2da4f741f

C:\Users\Admin\AppData\Local\Temp\Titles

MD5 f7f916e0410987ec8f6beb5d0cde0506
SHA1 dc1436cb76812007616ac783a172189488c7d7f9
SHA256 8b6b8cd2a7bf79dcc7a9126d09418fb2d74e1aab3c48b55ebf1635e39c797c66
SHA512 600b84add39f0c3ecf96b3158c6365cd66853494413d82ce1afa806c52248890529cfe35ae0b1e6e72c7d04dbee94ca24ba200524a7862a64285baab97803228

C:\Users\Admin\AppData\Local\Temp\Mo

MD5 9997ac7f1a4d0ab87bdd0500f232af76
SHA1 b054d6caeb5703f5036cc706424571bc15f6e1bf
SHA256 527d35a8cb2f816cd68f6e4f71b1ddca60e01862767167ce3d9110bf27298aab
SHA512 e62c34d2e0583b414451581887f189757466926c817dc70edccd41f26841b65f11fdf0128a43e001db20238da5577a44e11ac80e66514777409d902a6eb134db

C:\Users\Admin\AppData\Local\Temp\F

MD5 14816518caf15aaa457c24cdba7533b4
SHA1 bff3122a80f5d9c60b9d8b6dbc12e8177abd3418
SHA256 7f6b87bec48a8bc8723104f0e7e49a615a57aae92b17c408b89b402530b0b231
SHA512 4b8480052ac524085f8d0e75c7b4b6071b36772df14519ee7e1b77562913472c926cdd34845754665609506972ff25401eeb9d1b905ad9ec9fb1965c1cef894c

C:\Users\Admin\AppData\Local\Temp\Auto

MD5 3be4b5a402fea1d46b93cc10075bddd2
SHA1 9dad39e5e5f7309cb68d39bd9f14b18101b15d88
SHA256 6e8f655876670322b0acf1a1b2868de0636908fcfd8823c02d738d13519a1d12
SHA512 d8b437b9f7a383034efd0fccee841f4ac2291ca0df2016143d1786d09943c12e5bf63a8c735f88a7ed52baed4d40be90013021f635e9ac93c8d996a93b2c5d51

C:\Users\Admin\AppData\Local\Temp\Mapping

MD5 2338ac12202339694680461161eecbe7
SHA1 937ee67d8c8b664aad82de70b07eb57faad99085
SHA256 6747fa62ac1dc8f1796c41c6b70ca267615de125af466ff0e63afa0a57241dbd
SHA512 ab63ebf8bb951aadce08f0be238324eb25760a6e06807c9738806489e713bc5186dce62e13e1f7803d551dee597b4d3abc8daa606b780ef0775ebf1dc07792c2

C:\Users\Admin\AppData\Local\Temp\Dynamics

MD5 a55fe7301a8331c3e202bbb350837c51
SHA1 a55c84023ff48af7ffdc229db28f45334d5f36a5
SHA256 bc8c60c912824deba76b5815c73272bf15b5a1a625a65a31015a03fb2b921f7d
SHA512 5d34b2b029e2d22ffdc90f56d561823e3eeeecb910b5742add387b78a438797c005177ce04718ec7c46d3558d56e8bf5a7129f995aa1d8eef94f300632b0f312

C:\Users\Admin\AppData\Local\Temp\Inappropriate

MD5 7e83454195c83b0961b1741fa29369b5
SHA1 3d85e2d801065a81dfcca89c6a1b10dd84e83de1
SHA256 4e1750b70791ca81d57049a3cedc97cc7a843c5de5f5d9ed156dbdd516e45675
SHA512 8cf03c11d946ce298dfe76901387a6a43da09c01f97d9895c708ff3cfd241bd274094b41be3dcc2bf56aefa3b22446ec3b9f06a169fc9b553a58bc6259e56d8e

C:\Users\Admin\AppData\Local\Temp\Date

MD5 691d085c47ae40840542b9d4796ec6de
SHA1 edef6c2afdfd011a8a856d046f9c2b56c14f24d5
SHA256 a4deefffa64a55b9ea4aaec7193f08adcaf634de875b725d63923cb8afdc8533
SHA512 55c9618d4cf477f84f165852e70c0d7a37f635345a826c456f912221d394cf6b4bf42e40f8c492272dbf1dd48d6977b239af6dde02539856877d481704f16188

C:\Users\Admin\AppData\Local\Temp\Concord

MD5 9e54cd35059c72e43735836dda986f5d
SHA1 617554bb3ff29716b67caf1284d819866b82af86
SHA256 cb8165bc704dbbd8532b8fc8e39d8902e421640229134853316dddd27304440f
SHA512 0f6cd020025c437e6692e350c5645446a528a17f60f1376cc5943d594fe34a16dc3b06e11528c57aae8d89f49168e0a26f0f263c693e52d4b82fc3048dda6ce5

C:\Users\Admin\AppData\Local\Temp\Needle

MD5 5e1d6d2322ce1474eb35585c5961d147
SHA1 74a0eb83ec28d6a40fb113caa445d672fe67de93
SHA256 04602ca78764dcdc7454d17d2e26fb71ba36414bd84d82d7b8a7778e42c47ae5
SHA512 5c9dea0f196d009c27e0826df148dde3bc611e03bfd7effd8297c625387f5590d91a66b4a5f313c3dd2f43a9e51cc596d4c48a1faeda867deeaadf28b76080ac

C:\Users\Admin\AppData\Local\Temp\Ver

MD5 c297d6446e5a63c2dab0ba7d03a52f63
SHA1 149357efe45598a0aa684c614e84ea27a39ec1ae
SHA256 e3e3a8bf01aa9dee5321058322b9f6ead5c9d433dacc3aacb366c93648f46552
SHA512 306c640a40704a954e057e834d667f186d9b2a742f93d44abe2209aa64ed397eca64c6ae2d36a05a48586dd24e9795533ed82fec9d86c9e47cfb68300c27e6bd

C:\Users\Admin\AppData\Local\Temp\Quality

MD5 e685193637d4beb11fae01332913e8d4
SHA1 dcdea1009a893bc13eb9e8633c36d5e755cbd967
SHA256 abe71774600e3d54332ab20f32b8ab4630fac973547e050a5fc0fe5080e82995
SHA512 f3d5850bf77293802d7fb71af6f5abec2a1c3f982f9c96157efca519a9dc3182db39efa25ab2e425e3e53d77a5ed881f3ef61f7cfbcbcb113c04aecc887350d0

C:\Users\Admin\AppData\Local\Temp\Rw

MD5 76e58b07f3902703111432acad665172
SHA1 2b9e2c05e1c0a3726c9072caaf0271e6c2ab9f24
SHA256 b65d4e36ce1ec40bf20cd17515bb19cbd256dcbcc3a36546643be3923d4e14be
SHA512 466e61cbbbd58fc1eca2748dbb04da8ab411c5c29ac7cf788bb8fec7b4f6444ef0821b4e9ff78ceeb45a7de4ad173ec8693a63e057ba8109d3b713fcb2fc53b5

C:\Users\Admin\AppData\Local\Temp\Enabling

MD5 b8eeb773052aa634fcda25c6a74633de
SHA1 576f435cadcd3ae2d366a32e562e7a64ec0e7d8b
SHA256 98687cff8ff2bf7de91bf8ba6d59906590e95451b6d178e61020bb1320217924
SHA512 32de3b2412540841f021d214dc6c2106dcb71b4c876625423cecd6d7f522ebb42b4c570364385c5dcacfffdce6c45536e131bfcf1119e459219e5413a99f871d

C:\Users\Admin\AppData\Local\Temp\Theme

MD5 6a01b437ec91e223e2ddd5f2e3cc4a27
SHA1 4aec9c05e200f534ec675cf004c84e0e4381d1bd
SHA256 ff63db81885a2748beb0f871f42328ad64f41120a028b3cce8e69a969ff840ff
SHA512 63ecb1f90e561ce45a5b2d599a39492f6c757b945b0c6e85acac09204017a6ac92b6dd188aa9ef825e4c25d5a17923569ef98789af6e7d3877e5697896a8072a

C:\Users\Admin\AppData\Local\Temp\Flow

MD5 4d208ce6b834f65cfbd5003a33eb0885
SHA1 1aaa9d411b90df88b7606784485897985ddbb25c
SHA256 c3479095c5afe1d7c66a07f386d2c498f8b7faacad022dd24d8b6c15cf0af0a4
SHA512 e1a31eae919358ba1fbbfe6a0af7b5fc9bff2e81ed38d02747a81e120fb16a85318f3dee15f6c5152a3e43d8745daeb5d260e590909c262017ef472269dc2acd

C:\Users\Admin\AppData\Local\Temp\Payable

MD5 b741124cff6e9c1db9ab0f6a33ac75d7
SHA1 dd009b9d1e021b8bacffd3c5f18b480a2818b526
SHA256 fbc15d78997b479259a274b424af2cf82b3cdcffd98921045121a138312b7dd0
SHA512 d755f8b8ba5904f9811f9822a9f59a7bd5216b80c56cb1f50d1d8008cadd4ef3157e157d9cf3ce1b6214cd818447d77f68c5ebdb436e0a22262cbda21bc77927

C:\Users\Admin\AppData\Local\Temp\Models

MD5 e85fc8d8241d3e01a264a0665da3e3fd
SHA1 ce495efdb324673bb677d89ebf4460ead9655076
SHA256 4c27993e83f7057a4aeb672a8c76b98c60c42be982c377ef12caab54ffeb1bfc
SHA512 25c3545ea169c63439e9e0ae2fddb5022235b74bb686a23cb353412c99f4e9190804641a53ea49ff9dec3b3d57473effe2a5faad7acd85f5fea4bbf0ed6d1362

C:\Users\Admin\AppData\Local\Temp\Eco

MD5 d52d093c2ad11a7fa8caa82118312324
SHA1 ead4b9d075e88e48a1de94b69b19e113476be660
SHA256 073569dd893fae4c511183289f63a86364d404eb9203f9f0520c604590808c06
SHA512 b311bb24344dd9829139c6784595c898e9abef230a3b965d0127e84c7c4d25e880df3e1cc6030c406da84a5ea2e806ffe6cbfb6f75563a4ea077c2fa4c5f207e

C:\Users\Admin\AppData\Local\Temp\Fax

MD5 10c3f393a193fc3a75571e32bc9a7af4
SHA1 1df5d1158c697b1f519cfac40b9c0279c82b5605
SHA256 5d26906575ef47159261b4272255a707ed22a48a85a93a1a139d2b485af66e67
SHA512 490b8b5cd6a43de1627af4e6cd02032315cf8123c3d6f43f2c188e7e0bfc3bb3caeeb016e08ab9e21ef592e9d8150a0e0140d2159e556c5f13f53e658f4c0afb

C:\Users\Admin\AppData\Local\Temp\Maple

MD5 d99951681ca785e10c3dcf0eda9289a2
SHA1 3014fa710fbf5b0c0f11f744a5767958fa09d379
SHA256 02016b08121445b1138c60d0cb7b4624dc5ffad5986349c00fc28963b4a1c29a
SHA512 eac57095aa4f8cccf076d39735a2e4a0d695fcc3ea344d941809b0080f6df1c01cc7f36eb2070de91460a176e5aeb194009fdb08a773572221c47087d80be9ac

C:\Users\Admin\AppData\Local\Temp\Arrangements

MD5 2fed43e71c00e8ba4e4812ede092a3ad
SHA1 91406ad8199c99047f0ff81886f16d3f96f82543
SHA256 f86f0c7901d3768d0240cac5fadb24ec3a70c478a8e241848d37003046bab22a
SHA512 e198076dd8f1b4c96997892c0b7afe9db23e72d9e376dd552159052e5d6bb3fbc7becf5c997a514652cf1a4b6d7737f197f2ac3227492aa7c436e9997dd04c2d

C:\Users\Admin\AppData\Local\Temp\Potentially

MD5 856169507b46db74fc9bb20bc32564f0
SHA1 8df4c41434ff9b70a74cf34307a6f13339757859
SHA256 ae7bbb6943e2804db035715e24c6ef1243465a6aafa993e908ad06fba40a745d
SHA512 e7d3d2627443c12dbfa2505ed2f190bd48aebb0cf833a3a34e1b86c32e4e76a5ff8ffc8bbcc685d4a41960b8d45f6860dc4ede5e2a2d9d8127d6719cd6cc2714

C:\Users\Admin\AppData\Local\Temp\459607\Democrats.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Temp\459607\V

MD5 e0dc987a0ec3230edcb03a012e487725
SHA1 0bd2777f8ab174d9ae9e6d1d068918c8756e050f
SHA256 8bf384c8a524c0578be6055510f6eea7f9583c8b9889b5bc36667925f9cac110
SHA512 94b908904da72d43ba4f2e6ea6a1b31909dca309ff9438a0d3bc8906fe6a7695c9736bea0da478a54dc8f0269a80c7225db8fbcf3d301036e2104fa9e271bd45

memory/216-633-0x0000000000E80000-0x0000000000ED2000-memory.dmp

memory/216-634-0x0000000000E80000-0x0000000000ED2000-memory.dmp

memory/216-636-0x0000000000E80000-0x0000000000ED2000-memory.dmp

memory/3680-638-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-639-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-640-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-645-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-650-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-649-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-648-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-647-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-646-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

memory/3680-644-0x000001B28AAF0000-0x000001B28AAF1000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

275s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Arrangements

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Arrangements

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 20.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 50.192.11.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240704-en

Max time kernel

121s

Max time network

123s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Auto

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Auto

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:04

Platform

win10v2004-20240709-en

Max time kernel

173s

Max time network

175s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Believe

Signatures

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\desktop.ini C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\E: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\J: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\G: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\I: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\K: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\P: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\Y: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\Q: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\A: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\R: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\T: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\O: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\H: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\M: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\S: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\U: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\Z: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\L: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\V: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\unregmp2.exe N/A
File opened (read-only) \??\B: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\N: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\W: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
File opened (read-only) \??\X: C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk C:\Windows\System32\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll C:\Windows\system32\svchost.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings C:\Windows\system32\mspaint.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\unregmp2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\unregmp2.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1536 wrote to memory of 2664 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Windows\SysWOW64\unregmp2.exe
PID 1536 wrote to memory of 2664 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Windows\SysWOW64\unregmp2.exe
PID 1536 wrote to memory of 2664 N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Windows\SysWOW64\unregmp2.exe
PID 2664 wrote to memory of 3308 N/A C:\Windows\SysWOW64\unregmp2.exe C:\Windows\system32\unregmp2.exe
PID 2664 wrote to memory of 3308 N/A C:\Windows\SysWOW64\unregmp2.exe C:\Windows\system32\unregmp2.exe
PID 672 wrote to memory of 3552 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 3552 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 672 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Believe

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /7

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SaveRestart.rtf" /o ""

C:\Windows\system32\mspaint.exe

"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SetEnter.jpeg" /ForceBootstrapPaint3D

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CompressRepair.TTS"

C:\Program Files (x86)\Windows Media Player\wmplayer.exe

"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding

C:\Windows\SysWOW64\unregmp2.exe

"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon

C:\Windows\system32\unregmp2.exe

"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost

C:\Windows\System32\fontview.exe

"C:\Windows\System32\fontview.exe" C:\Users\Admin\Desktop\PopRedo.otf

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xf8,0x12c,0x7ff96ba046f8,0x7ff96ba04708,0x7ff96ba04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17793034408499052571,3657613568484254791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 57.110.18.2.in-addr.arpa udp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

memory/3340-0-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-2-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-1-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-6-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-12-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-11-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-10-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-9-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-8-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/3340-7-0x000001EDD3280000-0x000001EDD3281000-memory.dmp

memory/2196-13-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/2196-14-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/2196-15-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/2196-16-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/2196-17-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/2196-18-0x00007FF948890000-0x00007FF9488A0000-memory.dmp

memory/2196-19-0x00007FF948890000-0x00007FF9488A0000-memory.dmp

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 6fe0390f7fc0f830d9de2472d6a54aad
SHA1 fc6d5d56144139f5f36b58a025b60a307aec201c
SHA256 0faa23d1bfc67c8e83af43fb4e02236150a4db87a94c4783162696c158cf3637
SHA512 d5f6e724bc160660a85488d2e981c35d8767f32953d797d0213c2c3b4ff5c3c5398bf12f4260f44dc3c43d30833a9b7fdb87f22fdb866c45cb15a4a3901095c2

memory/2196-62-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/2196-61-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/2196-64-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/2196-63-0x00007FF94AB70000-0x00007FF94AB80000-memory.dmp

memory/952-65-0x00000226A2160000-0x00000226A2170000-memory.dmp

memory/952-69-0x00000226A21A0000-0x00000226A21B0000-memory.dmp

memory/952-76-0x00000226AACC0000-0x00000226AACC1000-memory.dmp

memory/952-78-0x00000226AAD40000-0x00000226AAD41000-memory.dmp

memory/952-80-0x00000226AAD40000-0x00000226AAD41000-memory.dmp

memory/952-81-0x00000226AADD0000-0x00000226AADD1000-memory.dmp

memory/952-82-0x00000226AADD0000-0x00000226AADD1000-memory.dmp

memory/952-83-0x00000226AADE0000-0x00000226AADE1000-memory.dmp

memory/952-84-0x00000226AADE0000-0x00000226AADE1000-memory.dmp

memory/3660-103-0x00007FF7C9BE0000-0x00007FF7C9CD8000-memory.dmp

memory/3660-104-0x00007FF97C000000-0x00007FF97C034000-memory.dmp

memory/3660-105-0x00007FF96B760000-0x00007FF96BA16000-memory.dmp

memory/3660-106-0x00007FF96A2B0000-0x00007FF96B360000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 5433eab10c6b5c6d55b7cbd302426a39
SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 563088ad0f20fabf9dd62c6ba8ae1636
SHA1 f9cd2fd153afa1a12ff990cf27c32b8c9c44e878
SHA256 eb897bf202d32f067728f1b666eb16e9926557efa8676b72db11411013030184
SHA512 8229dfb1d96b6a34b91b1e5c463833e7859331be880f585c48af1ba0ace0465ac755c7f22a9e6f30284266165f850e8f85af76157eea8136b2d6f79db02d3092

C:\Users\Admin\AppData\Local\Temp\wmsetup.log

MD5 0d95af05b4c0ded3faf785bac511d060
SHA1 f6ac41239dddc23663e0660b5bb6a98e24047311
SHA256 d45829d659e3c710eb163b020ab755ab129cbbe4a20c17895ad057e0260cde85
SHA512 b4890fbc1068e5dd7551151cb29d5344ebe16a7d71d995c8487a31fd92795839db4c7ca09ca41cad6205bc015f167e81b52417699707cb8521911213653898ed

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/1536-143-0x0000000007290000-0x00000000072A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 0321de2a6c11eda56b0971341dec8a2c
SHA1 fd52a47d3fa08e3615178393ad6ca7194d057283
SHA256 6176dd4dffe33419d70e33b2e0f84e786f748e02aaa5d6326927bedce345e6f8
SHA512 b1e78906b806039e3f1b078ab58025db6445a6857e83c2a143cbd225056d27cbd578be27fa12f2ec151e8ee9503379bae8e979747cec79a3d2bf7a219920de4c

memory/1536-145-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-146-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-148-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-150-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-149-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-147-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-151-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-152-0x0000000009C30000-0x0000000009C40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

MD5 0a54c1eaddd84839edc0be6f17a2199e
SHA1 28a02691b9850be8019c05d8cbc50e3d0cbca104
SHA256 051d6161de38b9d55e3c83aa4ab8e79179c41cd217146d3959aafbde023c8157
SHA512 deaa304e15313d266b071bc13a9983a04cff930c8aca010dcd07af138b196bc0563f928dd3f77ab30198027815baf06cba044f480ce88f3d306d1b36c1332764

memory/1536-155-0x0000000007290000-0x00000000072A0000-memory.dmp

memory/1536-156-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-159-0x0000000002B50000-0x0000000002B60000-memory.dmp

memory/1536-158-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-160-0x0000000002B50000-0x0000000002B60000-memory.dmp

memory/1536-161-0x0000000002B50000-0x0000000002B60000-memory.dmp

memory/1536-162-0x0000000002B50000-0x0000000002B60000-memory.dmp

memory/1536-164-0x0000000002B50000-0x0000000002B60000-memory.dmp

memory/1536-163-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-165-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-167-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-166-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-168-0x0000000009C30000-0x0000000009C40000-memory.dmp

memory/1536-169-0x0000000009C30000-0x0000000009C40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 27f3335bf37563e4537db3624ee378da
SHA1 57543abc3d97c2a2b251b446820894f4b0111aeb
SHA256 494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA512 2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6c86c838cf1dc704d2be375f04e1e6c6
SHA1 ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256 dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512 a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e4053ed330790176a403507573b46b13
SHA1 10596dff74aa2ec21548f1396553f7cdec1ab447
SHA256 ca8ca651b0aed191dfa1bae7dd9341b28f9bb3c0d5d5395b4b82fd4193cdf6a1
SHA512 697ab3b3306864ffb87b8ab01e75506dad49c0354bbb29009be27f9a4562209102946028f9625b35254605be112f7f995056ed84e98617664761e12603e15fe0

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 aa92e9fc62a132d422efc472f96c13b4
SHA1 fd9aa828a922d5537ed4cb5654a65f807dc1ea85
SHA256 7e6e065b790d8e09226d4405a1b791a934d5d79a9f7f51cd0d6caaccda8d2c3c
SHA512 311231f136f967d5e4558d6f3a86041e4443558c8b099cfac314a5ec76558c454b904c213685d7b34ba74e12d15a82cae0195ff213d0af1f6044ccdc7f30b115

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 bdd191f999e74faf5cb77a42e06ff96b
SHA1 eb9d61a10559d37c2843f0517175c13cdfa3508a
SHA256 98cb52a68fb61bb1c729c50be6472a16040fa41de91f8f697a51188baf3256c4
SHA512 acae3317f1125111c5f5b2e63a09cb5375a3ff2f9b733a34536720d3254eef5fd123da81e33e0051a7b199cb306d2be7ea32cd3945760245046b19e717a109c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4c5d869cce08361b552a0c7986809b7e
SHA1 d0a2a4c5a3e2a7790141d76452128e03287f913b
SHA256 a8b830ea9aa54208da078367b0f99b28ca1964caa0f7a2b08eea580c77f75d0b
SHA512 0e777fe87d65e087465cc2351d5c627a79167ae2149b0d58874fa8cb1b83bb1cd6856402aeec583e142908e8e568c0fd99dc44f4dfbd30f3653fc19b7a045c4d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8ee99847d9406aa5b7f8ac8fc8315870
SHA1 b15d7b1851163450aca0ea28b9d13f2f50941924
SHA256 373ea0aecca94ba6c82fccc5ccdfb2520d0580c0f05e614b24190bbe63a18898
SHA512 2fe2dd215b3db07f8cd764dc0f3f59e398537124d704e3b1b02c2af3e8b0e09092d65440de38ac5caf559c0d55c840028a6c83241fb235327686c3e30fdb6fc9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Analysis: behavioral16

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

95s

Max time network

203s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Dynamics

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Dynamics

Network

Country Destination Domain Proto
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

145s

Max time network

277s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Inappropriate

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Inappropriate

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 94.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

300s

Max time network

203s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Eco

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Eco

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 udp
N/A 52.168.117.170:443 tcp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win10v2004-20240709-en

Max time kernel

92s

Max time network

203s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Enabling

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Enabling

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 19.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-07-10 17:01

Reported

2024-07-10 17:06

Platform

win7-20240705-en

Max time kernel

120s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Fax

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\Fax

Network

N/A

Files

N/A