Malware Analysis Report

2024-10-18 22:29

Sample ID 240925-1x3hfstble
Target GenesisLoader Setup 1.0.0.exe
SHA256 28834f3eb57c18ad25c9b65a3fb5b242207a1b92e06c6d721a6c16f7009c326a
Tags
discovery zloader execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

28834f3eb57c18ad25c9b65a3fb5b242207a1b92e06c6d721a6c16f7009c326a

Threat Level: Known bad

The file GenesisLoader Setup 1.0.0.exe was found to be: Known bad.

Malicious Activity Summary

discovery zloader execution

Zloader family

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

Drops file in Windows directory

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-25 22:04

Signatures

Zloader family

zloader

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

91s

Max time network

101s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4428 wrote to memory of 1104 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4428 wrote to memory of 1104 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4428 wrote to memory of 1104 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1104 -ip 1104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 536

Network

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

145s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5100 wrote to memory of 1264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5100 wrote to memory of 1264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5100 wrote to memory of 1264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 1264 -ip 1264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 460

Network

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

87s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

147s

Max time network

160s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Network

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

149s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

88s

Max time network

100s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4084 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4084 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4084 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1320 -ip 1320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 476

Network

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall GenesisLoader.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall GenesisLoader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall GenesisLoader.exe"

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GenesisLoader.exe" | %SYSTEMROOT%\System32\find.exe "GenesisLoader.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq GenesisLoader.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "GenesisLoader.exe"

Network

Files

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

MD5 4fff7b059155e4ef42acbb96bf031c01
SHA1 168b219d7e716374af7f71d9f6b31ccd7a5f7613
SHA256 667f3631149bf909af520f1b6250b991d2e9e3cc7e08072027a75f37fc655fff
SHA512 a711c63d9061cfb04e89b1b38cb92425026afeab0594b779e4c43ad7fa5f5e574f402d9ec2f9185f6711d9fc406f9c7925ca99295526f21ea4dd9612e90a4280

C:\Users\Admin\AppData\Local\Temp\nsiB3FF.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsiB3FF.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsiB3FF.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsiB3FF.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

92s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5712 wrote to memory of 5760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5712 wrote to memory of 5760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5712 wrote to memory of 5760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

146s

Max time network

158s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 4992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 4992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 1788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2776 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff6db93cb8,0x7fff6db93cc8,0x7fff6db93cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,16638160169209167642,13096726204519478661,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4940 /prefetch:2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4bf4b59c3deb1688a480f8e56aab059d
SHA1 612c83e7027b3bfb0e9d2c9efad43c5318e731bb
SHA256 867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82
SHA512 2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

\??\pipe\LOCAL\crashpad_2776_JJMKRVLVGFCGXQKK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b4ae6009e2df12ce252d03722e8f4288
SHA1 44de96f65d69cbae416767040f887f68f8035928
SHA256 7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d
SHA512 bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 041acbb9f3e10ef30f3adfc190563322
SHA1 009bdb11cb43ddbb0e7ddef8b313f89f0db9d11a
SHA256 e1a8e55705896553c82105cfa67d05c0083f20ab1a9d5fe120679eeb8612dfdc
SHA512 c399e09886e0672c2f038cdf8f7935c55da7f6bd048e4a62932d57d4ed6070a6c729bef74acab891f1d684f7d38136b25e30ce5582752eb7b811ac67a63e9e07

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e2403c579e2516972a38c193fd5acc05
SHA1 b002d5719f66908e71af0ccc499fc46bf6f15d7f
SHA256 20a4e9abd1fee4d4559694a21fea2c36e8032a73c77941dcc0046effb4c7f1bd
SHA512 9b0e866c3dbff26dacd4a6948495207815e068aa53974107d79b0beb3acd48b8a03760febd0582f756fcee1e70b90a6df1da5b09226b7166b89855636f23b745

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 07b8d4839f78808c5e0af84c2be3b8e7
SHA1 02b5822302266e315a9b4b7634555749a73dc80f
SHA256 e4f02cec03fecd936ab4b40e9a2d09cd9fde3efbd35c8c660b90d2d7dbdb2a46
SHA512 dde00bdcf2bff86a89c5dc4a9dfeb27e0eba09258ebef0b3720e290e8635ca44dba5c6b10c0debc6a9c8a9c69f21ee45c260ef2e4e25a93cd0a876f97c6fa60f

Analysis: behavioral8

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

90s

Max time network

104s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

0s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

146s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5824 wrote to memory of 5368 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5824 wrote to memory of 5368 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5824 wrote to memory of 5368 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5368 -ip 5368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 536

Network

Country Destination Domain Proto
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

91s

Max time network

100s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 2108 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3016 wrote to memory of 2108 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3016 wrote to memory of 2108 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2108 -ip 2108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 460

Network

Country Destination Domain Proto
US 52.111.229.43:443 tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe
PID 640 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe

Processes

C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe"

C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GenesisLoader" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1720,i,1373627082910415813,3085515716717999948,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GenesisLoader" --field-trial-handle=2020,i,1373627082910415813,3085515716717999948,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11

C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GenesisLoader" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2380,i,1373627082910415813,3085515716717999948,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Temp\GenesisLoader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\GenesisLoader" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1580,i,1373627082910415813,3085515716717999948,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:10

Network

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2060-65-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-67-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-66-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-71-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-74-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-77-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-76-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-75-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-73-0x000001FB91940000-0x000001FB91941000-memory.dmp

memory/2060-72-0x000001FB91940000-0x000001FB91941000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

25s

Max time network

145s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

147s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4148 wrote to memory of 2208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4148 wrote to memory of 2208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4148 wrote to memory of 2208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2208 -ip 2208

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 460

Network

Country Destination Domain Proto
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\GenesisLoader Setup 1.0.0.exe"

Signatures

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GenesisLoader Setup 1.0.0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader Setup 1.0.0.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1812 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader Setup 1.0.0.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader Setup 1.0.0.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\GenesisLoader Setup 1.0.0.exe C:\Windows\SysWOW64\cmd.exe
PID 332 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 332 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 332 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 332 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 332 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 332 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe
PID 2220 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe

Processes

C:\Users\Admin\AppData\Local\Temp\GenesisLoader Setup 1.0.0.exe

"C:\Users\Admin\AppData\Local\Temp\GenesisLoader Setup 1.0.0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GenesisLoader.exe" | %SYSTEMROOT%\System32\find.exe "GenesisLoader.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq GenesisLoader.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "GenesisLoader.exe"

C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe"

C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GenesisLoader" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1704,i,484067252219413530,4416280962255887519,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GenesisLoader" --field-trial-handle=2000,i,484067252219413530,4416280962255887519,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:11

C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GenesisLoader" --app-path="C:\Users\Admin\AppData\Local\Programs\GenesisLoader\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2384,i,484067252219413530,4416280962255887519,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:1

C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe

"C:\Users\Admin\AppData\Local\Programs\GenesisLoader\GenesisLoader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\GenesisLoader" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1148,i,484067252219413530,4416280962255887519,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=956 /prefetch:10

Network

Files

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Programs\GenesisLoader\chrome_100_percent.pak

MD5 3c72d78266a90ed10dc0b0da7fdc6790
SHA1 6690eb15b179c8790e13956527ebbf3d274eef9b
SHA256 14a6a393c60f62df9bc1036e98346cd557e0ae73e8c7552d163fa64da77804d7
SHA512 b1babf1c37b566a5f0e5f84156f7ab59872690ba0bdd51850525f86769bfebc245f83988a3508945cf7617d73cd25e8469228974dd2c38415388b6a378552420

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\d3dcompiler_47.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\chrome_200_percent.pak

MD5 3969308aae1dc1c2105bbd25901bcd01
SHA1 a32f3c8341944da75e3eed5ef30602a98ec75b48
SHA256 20c93f2cfd69f3249cdfd46f317b37a9432ecc0de73323d24ecf65ce0f3c1bb6
SHA512 f81ed1890b46f7d9f6096b9ef5daab5b21788952efb5c4dcd6b8fd43e4673a91607c748f31434c84a180d943928d83928037058493e7e9b48c3de1fc8025df7f

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\ffmpeg.dll

MD5 ed10fd2777a030b2895d2f555207f1b3
SHA1 81448e7a72e49eff746abbedea503139b7eadbdd
SHA256 996aed5bb751d70e215bcc3e5be2ed28fb54412af05031c592df101b51232e0c
SHA512 435f33fd11fc25a495726401211ed87771c831eab8916b8bb9520bf0f799646f911b22716f090849bfc85e2372cd28aa1c9de46f9d613929993ef009955173e9

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\icudtl.dat

MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\libEGL.dll

MD5 e3f6c7b1316f7ca06ee178377ce16ff7
SHA1 f546da89ec0d3ef238892be8f2dd697d411518bb
SHA256 ff6d4f18492a704b4b9d853abdcc73a4fa561b0c685619508e25afaf4e4800b9
SHA512 cad4026efc48192c4904a4b0ec583d2e24b94f8a5f91824716eddb32477512799b10a4f9cc7a2976a25ca0d333bb1c68bb98b1d0f9bd7020e0e31be7d950720b

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\libGLESv2.dll

MD5 ac216b22cb7ca21d9803ae6b111792e5
SHA1 f6678626aa522628110315889ca744572549bb73
SHA256 3cd10952ba73ba4a36f5ec92dcbb0893092bfc8d77a381f6f9f3090b0ecfbb50
SHA512 df344f79ff5d4e38b451bea948c234b63af0402565097082a082b44a4efb9e0ed367884875cbc817237b7ae7ac126fc7de0e8615504923b8db553c1a3a985a90

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\LICENSES.chromium.html

MD5 f017c462d59fd22271a2c5e7f38327f9
SHA1 7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
SHA256 40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
SHA512 72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\v8_context_snapshot.bin

MD5 8b8485c02d1fb639085dcb2b1af02c6e
SHA1 fe4e7115aef2c161c5995a621bf614a502f04910
SHA256 98c18470926e12def4c39163c5389f29c5df7d2a41bf7353a75a7cdc41f1a90c
SHA512 c2f24848a75c5330d1be5bde3213064f2b0feb13b8708d795249961605a09913aab1fc78b850f4ea3f7c76c74a8238816f5654a4fad5c11a78ce86b8b9cdd521

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\snapshot_blob.bin

MD5 7ad5356f81d38002220b82f64cebe230
SHA1 11f047ffb7b90a40ca17c796b0a306d4b250ed7f
SHA256 31969e154d3cd857d14e9d8edb98118ad2d5e9e9f1b77f9085626bd500e34ce1
SHA512 862d0027b13ef4527a45b010d35142583c1f02f7691b093774eb5bb066b623ba7b8c0bb65a2e75641381c8ffa6a24c7116d1a9a984143ad13d0a0d61adfa3c0c

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\resources.pak

MD5 d3fef960b0aac7b5d40e37b09f91f9ba
SHA1 dc5093fecf59150877f439a04bdb3912f13ed905
SHA256 c2dad6a9f8bf1b552fa94a51cadb6ed6a4e5a6455bcebf3c2888f0a6a3d6c8c2
SHA512 5be574b28b67ebd13acb764e15aaae6c3fb861a1cf16e4132fec8fe90b4fb70d49314609bd173c8de6299531f5520fe95ae080112efd2f7e89a6e174532bc458

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\vulkan-1.dll

MD5 8f939b8bbffc7e1083e938adc4b5aea7
SHA1 ce03fd0ec3c11fbbc51b6fef044bea7915991aa9
SHA256 7d411fa0a615d0f67099fc3978b3f07e28565b9877cce02ec239eb228fa4d485
SHA512 bed9ac52e82dcf3e8233d90f1f0986ce6371338299a7efc490d89955d869e2b16874cd2258b4217971269f19fb1589530fe2d870d65610a878f2633f0cf4e0af

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\vk_swiftshader.dll

MD5 ed0ffde1854aa8b1dc64835b48833d32
SHA1 5aa09092b982e8ae1ca73f713d6f51a30248b64a
SHA256 1a24356be288e742549a20c62de9259b2e1cf8bd560151ff7a24d4ae1a4652a2
SHA512 59fd3b9153b2d777a707c7f2aedf2b7be701c18fb1b9e79d32381dacca22768c6461c575271aee960d7c41fadeba75f8cde41fc8a229c2e49823bbb5853b69a1

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\af.pak

MD5 09455048c30cecbb17d6e0e95e4c01da
SHA1 6572850b07df45933ed57754f72c44895a7ef662
SHA256 e973763dcc0ffd7a5afe0a62ec9651c4c3db7fe29a23797fafc34b83512d03aa
SHA512 f59b68c213815ad81379c964abe6597b900b9fac5fe17e2cb378d015c4803f96b598ef70333d594599b3283a88a9ca9cb2475afc2590eda2ddf7b041ba2368e3

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\am.pak

MD5 99f01e85f82f70b919f3de6a29bc2255
SHA1 bd229bbb9a15d128d3dafb107533ed2b74e0b778
SHA256 fdbbf59c2f6d4e9d6bf8bc7209511850bb337b0a49a25d39779bdd0e105f1682
SHA512 b3b7199f60af430bc98fc937e12b0a2c67b446f0217e01b543882313336f55def3cc6317cf1ef49766ceb1e171e70cbd78e8acecc3cc1c8409e76f4d98d347a6

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\bn.pak

MD5 ea7cf62cd5373f016ee15773394cc33d
SHA1 582299514e86802707fd6e45a170da7a5b5f3da0
SHA256 dedf3a8c24b13eafd99d9bc44dfc4d7a74f01eda532e05c8d61b4457f348fd09
SHA512 482ce2f374e5bba511e60843736811ab1f8d3aa52a020c78505e95b1ad0a924531a952ff792116ef7ef55cf027640ac88885f13513757c8883b37d7ae57c9a13

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\bg.pak

MD5 78209e3acd074e521b73382ec462e497
SHA1 b112c4ced00c140410a1faf8204772d1fd14abed
SHA256 086e2955bc5dbba52b0ab055bf788bd7852a851a29bf1249dbd134713f04e6f4
SHA512 789f13ba6b98b0b181bbd75f3a099a39d33b43bd6a0172688da570c3087cdbc4975e36e5c40f0f3298648dfb777613b0b2001d6873a2c6bee41e82355d960fd9

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ar.pak

MD5 5fbed215d9555f2be88e8a41407a0a72
SHA1 744bd7b5276cd4e69a6610d35e3c9e5d62dbe49a
SHA256 5f1b06de1f8105ccebb79651781fc219013048951a6e1b15a2c4f567ee45e88f
SHA512 0c0d2d1d3d07528afecf1862011ce2ddd27c9c286b5edeb03cd80a9ffde584bf0a71ba6292c969e3261a958a9bfddd291746253268479c090f54559720dcac36

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ca.pak

MD5 d4f81d8d816d93e8e6ec3f82cd8f12c4
SHA1 2cc552022a6963f6bab97e41ecd78bb945a2ec34
SHA256 50657071f311dc06c746346a25d10642f182519c1eb3ab898421722271bf2c66
SHA512 b344d5b336699f5efa4e235c7f67ea43278b348df9942f7a86ac52e29172794672d71e80501987867900ca075be0e47228f6cb898a39b66c80acbd0d9b14b371

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\cs.pak

MD5 bb1c4ba9859b0a43a42021f39b8b750d
SHA1 02b2505d3955f15b6655bee9c92d7bbfaad6ddc3
SHA256 814990ab6af4acb4acd44b0f07fafd4375724facf4e3080014ce7b8b9e935fb9
SHA512 941cf4d334dbea7cc790cb8ba11e959d5a45381e7efdbae1e659d27540fd80247bb71820a90af6164d76cabbb283dbf3b652c29e0ded3832dcc21e3a88f7d0b6

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\da.pak

MD5 96bbef1eee0b0a197ec834839c00e11c
SHA1 35adba0aafbb4d19015e11dde1f37de87292252d
SHA256 600e02877374dc083b21deb3cc3bf6a4e3e2b2c581a631955494b0591c56289c
SHA512 e1ae7ad30735b6c42f81d30d50162330603753b0ce7705506918d0bf3bf9a52ac60f8fca570cdfe87f0d6dd46cfa3064d5a1526d39d81a053571b434b1cbffe1

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\de.pak

MD5 d847de7e4970ad17615f7a454be60d06
SHA1 e6cd24f4ca42499c12c92f90077977921a66e016
SHA256 41e503b5e5638cccac6b0165d6c2d2b583e3a6190f3b1dd2e8dd25494d3bdf96
SHA512 ab782cdf2fcf20d24cb3cb3c70989901146709610809a3ecb0ba86b312f11c5b1fca3d66b04d6a6ad3f111f2f2c8749da9d1f8d1ead08c8e7635bd6f1f6a00f0

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\el.pak

MD5 14f52763959d29febddbe25c86336e70
SHA1 dbde678a721d4fba97d5bf2703faac230794128c
SHA256 7134776724c07c2df17f6ba0c3c26a2a536d512e913d1d9c5585e600895e695a
SHA512 1f49a299a9fe76ab93a30ac17e1bbf3eddb20c6278740d7739e0044f867f35e65a0cd98654ab0ed60a43e268eb7258768cb8f35a254fbf31bf22ff4af7c3f96d

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\es-419.pak

MD5 76c82bd947c7d32febb2aeed079de39f
SHA1 e4b8238dcb0d3ffdedbb8a4fdc62ada21b03c659
SHA256 89df263a85ccce719cf2b1a5bfb3b2bec5f6f48d0cf1b7ad190b34992aa8309f
SHA512 5179f1cc0be2a4ad441c08102cbabdd3026ae07f430dfeac2f451863235947d9ff1ef78a8c72ef503085c8daf831b401a58ca6e6b077c7584c50b50005c7c868

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\en-US.pak

MD5 d47cded365a28d27906414035c1cb3ca
SHA1 429123c86f6ca48a89bedc9a26027e01508e6db9
SHA256 46958caf9847e33a11593ad024d5a95cc696edcd4620cf07e7b2b78c72b9c00c
SHA512 1a16d784913fead116460c9ff42e21ae482865cfe2d6ed1b1296496e46a05e513f8d048fa4d245e7a82ef61de4c4130696d5b1c647c918995f6877a888bd0853

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\en-GB.pak

MD5 513c735f8821cd5b8beee4f1c9f976d9
SHA1 2552ec0b813aa12b464d813d450e8b6bbc640555
SHA256 d86bc52d844b9706cf9fc50e7c123ab9a6372dd3190a65a88bff7d57f64af362
SHA512 9482f73155c0a838615ddeb4ea5e2db86f12d973c2288922f361de27025f49f714cb6db6eca09a4ef6abaab6b849800850fc72e5bd1314ad3262da66d4dc6b5b

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\fi.pak

MD5 15b4ed60de11e5fb956d624032e8b242
SHA1 94e7f2b7a62c4164511be53d59769299b8a02185
SHA256 f040febcc899b194a6908419b4bc225ed3d53ec478988ed7a50e8438c80d9606
SHA512 c67e22f75820b921f8519ddf064a0fd7d93abf0539b06a62592ad00ba9cc237b1297acf5eba15f7e1444916e90c9dc89e116704866d242d1bdcf0c90cb8c0058

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\kn.pak

MD5 e4865513d7c57bd48171ade28bc4aaa4
SHA1 1791131c3fc654bc0aef00927f41672f700720d7
SHA256 a1b23f794547f06510adf767b23a47df68ae864b059f8657bb78dd8b352de232
SHA512 c7487fb37ebb2108218021b6a93e62d6836248d1602e7847864cc0ebe7fcd87554220bd3fff0c7bd6fa6f7bd200811b8d30e421b76717e37c7e110f88cc40d15

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\sk.pak

MD5 f987110e03dff6a6104d3c9767139439
SHA1 0817884ab9064978de99909e7e376d067019e1b9
SHA256 4fabe714236712d691908751b42e947fb03a4b1a439e7a84335e7f18f87625e3
SHA512 91a609fa129394ae23590c72a6007bb6591e4e08342ff0d6ba184c8eb09413ed294ca15f13b92f7558823523a0272f5af6841d7e426177c803be1062f9842d9b

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\sl.pak

MD5 4072bad3315b78fd05787a9fb97e9af6
SHA1 267209a3bde1b362351ea473874d5d40d9ef30ed
SHA256 10676c91bac7b80d314a1d7a934bebc5104ed730bd4eb78d84c497f7e07b5510
SHA512 9a858d4d11f7476b030f3c9bb852a70ae501f34afa0eae2756f2ad59d8dab9983a4b5dffa11b9b7eb578fd52b3ed72094b807b82b93b4c4536ce59309fc0fab3

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ru.pak

MD5 8243216c5cf42451a8705fdc0a5b8b5c
SHA1 76decf1dfffdc775c5b285436573c8583f214119
SHA256 f6538645321dfa0f2ee3f17284ff72800f6a678df3f5b7d729d02a4496adcce1
SHA512 508c9b4d81b9d09a1306dfe707faaac9072d2c194ccddccbad2bed871c68a78a3e8f527fd8f9ee67d08f6147def43ac2dc43deed9797a98cb5d80c0486fbf8ad

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ro.pak

MD5 5d5a27c52ae905fd85f5d50cb793e7ca
SHA1 b858bba1ef66c4d3943be19a4bf8a508c23e6671
SHA256 9ff47f6890b3f543bc51015f263e791d8a3bc332098f8cd8199852fa131fa579
SHA512 f4754951ff0dd3f1ec2c0859a93422330145f9e4e3407bb7f95863c85227b96d3f8af449c0a051b60f333df3695eea5df70fd5f7fe4916e60eb6f7c4c21aa5e2

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\pt-PT.pak

MD5 62071f5b1b93161b03b66faa3e0ec71a
SHA1 969d82d8d0b2b82e7cb9af7f59825ba211b0ca8f
SHA256 953f8245585ebb637b2d2134b24118f2baa9c28211ea007a8605fa57c7df21f5
SHA512 b463844e7d620076a4cc11d5ad3e9aae52f0375f5eea16f5621a30043ba570baaf3c42050bff7d740eb9bd8274c190787a9d7d57bcffddba62eaaa8b7c4523bb

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\pt-BR.pak

MD5 75d9da45b6a34aed360c0897dc956418
SHA1 90f15ceb5cf0cbaef021de42acaae323c9023cb8
SHA256 77d29b746b4028ae7072d5f74ffe1cbdc66b180a36eeed71e52ef1f7b824cddf
SHA512 df2d0ef49e4f836d5209f53254cb58b76d13a36eee14ae559f6fbe0be6b8421cde4152f48d44997c81ffb32e089ea46bd4a9de85e1bbd12dfcdcb356f1798629

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\pl.pak

MD5 8cea9672f132573e143fc742ff1f7d00
SHA1 2eda91defa08ac7d27c082e4b85120d347dd39ca
SHA256 6257145654f4e47c21ef2b91fe69fc386c1e228a89a658418532a2934433cd7b
SHA512 25579e0535569f0a2855d02df0e2b36dc391a0d3cc54d2ee2b23184836caf8a3ec4c590704a9604666307e1e6e01d72311f76bff7210cecf18ab20d4f3c309f0

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\nl.pak

MD5 f4c35847247ff2c58a68c35718e3f358
SHA1 17f8af1473eb3bf8bdb3d16711bb359b59cbaf4a
SHA256 a400121adbb26c97a95e3f573f370ec2c37fd435132828c04b467dac47352904
SHA512 6179e275c71a9df4a7da517944048a782a2cb3f16c164ead8c788efc5c56e155c9770530a4fea9360ab478b78c233e183ee8afdf17c8cb871848b09a609c1f12

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\nb.pak

MD5 bc18e28f676138795d19d95e73e3f246
SHA1 f4ae51b49a69b4a32f2dd8c09784ebde1e6d018a
SHA256 1df78fd35431f167def5c496e441775a265d3eb1e64a4cc0fb7fe0201c1ce8b8
SHA512 3620554d7e614373038c278a7bc6a9388fb66abbeba28d0935f2a2f7203a8510b264a6df85e70e3b82e08588611e48a64e4e1c91470f72c95c05cfb8649e8c52

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\mr.pak

MD5 af7c7d72a968e1936f26a3c755157f6b
SHA1 2ec71950847f5fb4b85697b6acd05224c28bb092
SHA256 e5702b9578435abbbcc922f1d4ff8c5a345856926c2174c329e228987c3ac7d5
SHA512 d265eeee96adafc3ced76901c9263bc1cb349caf925a02d5deb010c02843fb653a17e1e8a4e942c9912f654316c4a7a1776e6a7eda56ab82ae9d4d077a58a929

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ml.pak

MD5 265d7fbee9a021895d51209dc0181f90
SHA1 30e37013971bacd3ee93ad2fca01cb59a26d6a87
SHA256 682463d4a0221711e565ecf409893536d727650efd2ed0563c722cceab66b1ad
SHA512 028e1ad499b20ff7cda822b91f9b8d1cbb1efe108b7236d817b73a6f8e518b5f4a8ae77d653ae5c9d799842eaee3915250ef56f634f847fc5fc8a3b36eea176c

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\lv.pak

MD5 df9985ecfc958f343ab7e56e71149d71
SHA1 fc0d2c4a194d500a1f4cfafcd9102186016ba5a3
SHA256 7e17246e23ca2d0241d56d91b5d5e6bfb3ff4e08f1a3734f9d032b4191282fa2
SHA512 0dd65eed7a5bccee0ac5e2826f0cceed848dff0d0d41904e00d35cec9d96fc0b91a4eb54fbcf0bbba61f89848562a606f9f7aa827cb180abe7e97a2e77a29309

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\lt.pak

MD5 b02bf54687716b5d5f18aee02411a980
SHA1 4cf766077382c49fb89d59d861de0f482f989798
SHA256 0b0e3fcb82ddca52f9eb1ff9e1ee224639ff81f1c0af6ded4e21944811babc0b
SHA512 aea879ac96a5719e8988011a7b82726bf51a24e170e260182146191f43914cd50991928d2283277d173ad650f7cfb1246fad9445260e9ca0769052079d431f25

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ko.pak

MD5 f0805980b4bba19fd7cecdae6d6ed77d
SHA1 fee432cc162890c5c8d22f6028f9086c8f47267d
SHA256 11f4f99e5f7d04b263f615d9d0716c0852b8c63a07212d14604373853aa78588
SHA512 03a97e36dbcae88b0fa9fec326bd99bf5c454889ca3bcf151b34003fac161001c1e08082b07974b6c8e01cc54f6b20f810c3bbe446494356403288e24e6b46df

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ja.pak

MD5 946afe803f1bd37cac8cefb9892e8387
SHA1 6a5ab4129843129ff926735acc4be53028a8d5bd
SHA256 91084c3d2709fed5c912fd55b2499c394b3a8ebba5032d03056845f88a141ffa
SHA512 4bbc76a738b9639d4a2fda9e1dc87c84bff660c84a01e3a54f544ec2421d20d9eee4c951a59ff8ed5950a00359bfb63ef1afe953b5cf5910923428a4d864ad71

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\it.pak

MD5 d26fd02972984599d1a60ebfce4ee7b0
SHA1 d1767c68628c8b1449b4670fc40c355d367b0a97
SHA256 75e90045cdafecc013f62097e1aabae18362954cf993eb4f78ed1639e3468186
SHA512 06722bae30ade4bae70130918e3d6f99e54d7fca37b3798f8ed3d269cf52c37e1280a08313c9f9dedac80da149446bd0414cd36e345bfea3a1b7409b7d2f3464

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\id.pak

MD5 ee466128c7bd5f01d518d0c3c9202f39
SHA1 74b7cb96c1e495885651e50907efe56d2567955f
SHA256 6f86ea779e49c8eb24ed6ba416ad67d5e08f8a3673c68e4cfad19475e12a2911
SHA512 9d88780e52c1cca9f89ed0ead244a763209848d1315f7177c1db3251214d363e78b32d439328304976804beb781fd07a0cc9f9e300431aca16ae6afaa6f57be6

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\hu.pak

MD5 1744609aa48694daf1058e6da1157696
SHA1 a97ba8118e91bb952c24adf19104ca54d4eb8694
SHA256 89c47beea85d50c88af6f94597f827bfa657ec73570cb4b3ffbc3ff91164ba89
SHA512 f64c8fd18f877283bef39c999f754ddc212fc8ba981d282f66443c6fea51e89a5c4a2aa37aae7b69c35a60bdf9b8f5698d2cc72e28e10d70747ce0f7d665ce8d

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\hr.pak

MD5 62bda7cc99b6dc1503332e752f87423f
SHA1 0187ca29d12971ce201d5513e45648898806d701
SHA256 4171bbd2229ed5a7638b74e32d7aa0e643cbc99051d92a80e7da5a31400ae69c
SHA512 6acdc6618bfb1d2ba7ce912f959c25a48f987dc6c6507c8c5bac22988ddb8b2cbb8aca8fc3d40b2e8b7b6fbd417bde2de34b91b8fc778ba78c182aedb722be06

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\hi.pak

MD5 cbf1e19ed157d39bfe70a17805ea3cc3
SHA1 e37f6f428e8478f50999899ce70f49e60d2fd758
SHA256 00670d07269facbd70e3949f3da5a73f584e08a6e901ac8a3b1767fc439c975a
SHA512 84f8af3ef49c8f970e7ac2ad61ec92fc21057767afb93116fbc11837b6d7130901245bcfcae53f158f6f09f3a8e59900a6444a5ba9364b2c38196631c5244258

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\he.pak

MD5 41227774510c0d2ea4637dbffe500000
SHA1 3d8a20158dee92d5b5ce1a2c852352a50ae62282
SHA256 90f11a1c09fcc4a5fd5d6f753bea04af93ff8ddf4372a5f84a15fc2ccb444c95
SHA512 40e8a5d8c3e1b481074da9bb48ad82a64849386d9512ecee8fd426d6def32a8930fab316e3c5d686d7706b6bc975913d7d75e69a0c150b74dc8bb45620e82140

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\gu.pak

MD5 cd212ed25482d2b5a246440b62c4fbbf
SHA1 197f3616dec4fb308e0ec5a17458ef8a2d027cd1
SHA256 0e8762ac08963088c33b74ee790df95370bbfc298bae8abfb87eb1307ef46d37
SHA512 207d3e9a6bfbd3eb19cf53a0a300eb0172ecb872496d627ac5b55b9ea11d52f24f01393893450fefaa3c42bb481129d54e552679f2f67a2af0e117d12464601d

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\fr.pak

MD5 1904b22bbb5d52255f80c541253971ba
SHA1 0ead9bd15bd115775728a6cada2136367fe34b87
SHA256 25eb9ea0d0007b5d4c5065fb77486c723d718a1496aa52013d1ea098987f44d0
SHA512 6d4f4a9dde7d22624ef3c28e4cf4a8de8255125aca0c5efca0bae69f040aed2651649f415acdf491593634adce0e4d88ee6439705115bfec25caae34a57f1003

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\fil.pak

MD5 4462eeada117fea1198a3a9cc370e8df
SHA1 c8b6f588ab35f485b88480e58db59c7a34c4ef0b
SHA256 db27ebc5b34d14be370e7068b4bab4fe12fdf090bc1a4f0bad81740aee974695
SHA512 8a69a11f33ce1fdccb3aa7b1dac981f9d6c9d64669e3f97265bef5862e20bbc62d568b8e64fa33cae3143096b009ecb904f0f32f6dc593a8702f94d4e3f52d20

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ms.pak

MD5 04f12811567c0f00bb35b488f4579425
SHA1 64f43b7b172e392daf1fe48e22324fd8dc2a3924
SHA256 1af4b9a66ca413dc3a0785f2b1527c237bdd05ba5768fe077aaf8af0f1c50dff
SHA512 a03fd120e9f31aab03fece30032f84b63060d5dd264e0bf04c85eb92a392d36a0c4122817b0d414a266305ad70efb067319aba38e100aa8c37ab65c3604c4ea6

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\fa.pak

MD5 99ce096115521566ffc685703f9cdbfd
SHA1 27cccf6b8f6939d17da4b884998e577392b97221
SHA256 645a43a0101eea39dc6b29ffd71a4836a03ebd7070e61aa962025257aea59375
SHA512 42df640778ae722b82a62e527711a57c883e9d315d54ea7e484d7a8f631abf3f5ea1498d6c5cbd004fe971fd357a0b8d40ab4934fc84e03565da3fb0b23184c8

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\et.pak

MD5 96febc2a296af99758050eef3ed97712
SHA1 26f8751ccfe0b1bed9db532dbac1034a02b7f48a
SHA256 678e50d9785c14f205baff60760decf64f765a98863e000abe44dcc6f22b5d0d
SHA512 bfc8a9051360338c61dc46040b006808b57ee20ce170c4645bf5fd83a643c3107bbc1752fd2486a9ab8250a84ff0cf832f381c523cc49cd08486eae489c4d45e

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\es.pak

MD5 070cbd6f42db1cb9b6a2f74e03d6b124
SHA1 f8830e1c8a601123d85fd75188ed01833f910691
SHA256 91de93a4dc9c9276b9ee3ae498bdafaa55fd464c1f20fdaca84c4b79842327d4
SHA512 2ebee4e289eb2a19a97c86d1abdc1ad53c6a76b8c1dc28fc89cfde236c4abfbb823bf52573cc0848fd76ed9e0ab2d49def542837bc5c474ca1593fb5ed10a390

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\sv.pak

MD5 69fc76751f44f10e32009b09268f2e38
SHA1 66d31349c8f5acedfe384f9525b6db4bed9acd4e
SHA256 a851c7537b895145f45f395c92ca273610f19f109c959b368672a5a92175aa83
SHA512 c9912382da93d3669832a77c66a64232b438eb6fa4ca6bc2243b0c11dbedef940f45d290fc6934312e3a1ce396f7b14821ce433388132e0e8634c1fa7400dad0

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\sr.pak

MD5 6f327ce1d0e7131c483be9ee0c6a1c21
SHA1 26da43c4b16b6b0e2de9a8ed85cd63c202acf00a
SHA256 068c3f92a20c5202b592e26078d6aca908d39e2fc325a605166e7235a73366b2
SHA512 f36b99a76130f08d8c3f2c98add812f6a1a0815d4f895c697486a195bf04b8f43e591c73da34cfb40c07d9153466ea727dc644b9f9424cd4fc4b021d1a98f215

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\te.pak

MD5 352b392c6e074a1b77a833b3534cc710
SHA1 49465bb9bfd3b82ceacda34e81be8e04f20e275e
SHA256 4f565637cf197a38c3f2a650cdfac05995fee8da2b9216998ab3ef7937ce7e74
SHA512 b9115987bef17dc05ff4c434d5dcee3e36c706015cf02592c154b60910bf86de578becf8470967bfcc7a28063155be6934f0d26713bd6f14ae4e3d637b4df69c

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\zh-TW.pak

MD5 fb25eb737df0e863cd83b0472249b64f
SHA1 3f9d0d847bb9eea9bc5c89371fd4665da1a485f0
SHA256 f1bd51245e56bcf324a8a94c4a572be031f2fd0db4d828471e563f64d8ecc79d
SHA512 075bb8edd2743e980cb842ad359a16023a3280c560ccdd17150e7cdc179fbcd0de3415ab591d7877ac3a8dad84fe8defb0059fa0d3468553230d27b7d1bd7c03

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\resources\app.asar

MD5 8df09ddb5b31a8fa0af894f7d42d7422
SHA1 5042c6fdc26392e867cd379c8d2d571d6ba7a4eb
SHA256 56918c11f3c552bdeb664e574e210d80a17838105f669d1769c80f90556f8a08
SHA512 749a13c28b9d7f3675e3e78f45b374d6c1a85df8b851461b9669c1e355842dbf7cf4f2e3f9040f0f04e0537e57efefa00802ac913eef4c912ca184e79e081150

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\zh-CN.pak

MD5 6e7c237143cc765ac3abbe0685fa2afe
SHA1 40166c23aa75b8079ca16db2f5bcc938dfac312a
SHA256 9cda0f5736ab40650d10dd93f35316c45d5db9c596b270a9476cdd19d624c7d1
SHA512 2c2b6c50e52e1613f1976c86670dab5c4a7b06ff1746da0737bcc72271fe7531d8d909de2064cc2086c4b04352325fafb9c8bb181bc074dd62ba0e7a607fe011

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\vi.pak

MD5 8f8a783772b0b3ed9e1858074a3106c4
SHA1 fdfa166ddfc0e9101bdcf5e76d422b29444d4772
SHA256 ad778e5e76648700192dfb6a27c6be743935de00e3a75f208f3c1d3f6d3fd1c9
SHA512 690a006b94cc8a34ac0fa904b2c175688cd1468385537bd3927a91550c137086a8ce75a2794be0126bc0eb44a498b01bf94c05237895a82125016c7463b4f161

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ur.pak

MD5 bb7d36ea38a066f9939b858ca3bba8d8
SHA1 78a18e7d6e82ebe9f99161432ac0363928d2c2d1
SHA256 8ab35f7d357a38922acc42c663089ef4e0ef42ce56e212c26507bd110c8e8967
SHA512 1b4a82c5065170c551de28812f6c99cd47a22209d97cf0723197bad15872d98fffba0cdf4db87440a84fc9cd0d2a3cd771074b254f12fd7658e7f9aad732a854

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\uk.pak

MD5 7d6b378c369e8a132a1134ffb3921d26
SHA1 1c3c9c67613a4798ab2d4bdaaa0fe5ad80eee876
SHA256 e8ffe116ebbdaace51d9e62fe3c119eb354b244a8395f82d61b67dc8e3b3abb7
SHA512 edc526149fef6530c25a13725f33f7a4e9bb56b1b28fb1936609edc4c195153d5276d4ff61d7be9c2cf99835273809502168d7c8b0049c6b670ee226eab8e6ff

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\tr.pak

MD5 d03ea83a0ed60cdd6607d16cfbaadb7a
SHA1 8463e4a4985ce85efb7b7b1b54e384f7043dced9
SHA256 5fba0fce51cc3f9767d2cfdaef1192507f18b83235879aacc8f63b30880c8f00
SHA512 3c7c7e6b98372bff436acbb31f4e0205c8b797221162f969464dad88fcace1d5f445b57beef96526c1610cfb3a589aa5c120fa6cceb06dc6bdaeddefe8de72e2

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\ta.pak

MD5 d23049c7d1e0f829ad88274784927547
SHA1 efaa69205c4811af251d7ccaaa9c7cf81c10d6c2
SHA256 9e3e0c909becc8bdf9c7cc1f9e401c464e7756e30369d40c709ea2dd942660c9
SHA512 839b2323bc02ca605354d7f23474b9de1a9525fdfc9814d5773984090d1dee8dbd925078687bfdfffb416666701e42513e3bdee8aedfc3281194aa18e9e33ad7

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\sw.pak

MD5 b49abf12ae1a019f170dbe514a9341f0
SHA1 a17d7ce05d6e75563d364e8e97be70bbed5b2ab6
SHA256 d85642b0783e1999fadf82aedfcaaf03a35572ca15a9e4f9eb8e1fcaca2ce29c
SHA512 147e80cd5c521bdba44778a6f605e330a589482625d4229bc6b0754edb1b41e8e1ebfa7dffe4c0ffb9d9342a95fef8f9109935a9b9d111e21af1e70b0806fa70

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\7z-out\locales\th.pak

MD5 b60a9df804f0f3b0f1c11f1d6bd9ba7e
SHA1 104970e408e1a138cac373d2938691f82ee8e52b
SHA256 6cf15aee57658d55ea0ff07dae2fbad7981093e7acf54014347307e3bd1aad08
SHA512 ebd852b91b37b53f40f0e7e987d3814a3f7f273a6291ba18b4c6df9def01c9ec879e067bf542f0ad2efb1755af1180ac5a51d772ec61529eddd1d1e80c3c2e82

C:\Users\Admin\AppData\Local\Temp\nst764A.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2596-815-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-814-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-813-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-825-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-824-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-823-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-822-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-821-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-820-0x0000016706D00000-0x0000016706D01000-memory.dmp

memory/2596-819-0x0000016706D00000-0x0000016706D01000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

0s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

90s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

92s

Max time network

98s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3716 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3716 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3716 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2932 -ip 2932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 468

Network

Country Destination Domain Proto
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:08

Platform

win11-20240802-en

Max time kernel

147s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4156 wrote to memory of 2996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4156 wrote to memory of 2996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4156 wrote to memory of 2996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2996 -ip 2996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 476

Network

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-09-25 22:02

Reported

2024-09-25 22:09

Platform

win11-20240802-en

Max time kernel

91s

Max time network

101s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1064 wrote to memory of 1808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1064 wrote to memory of 1808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1064 wrote to memory of 1808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 1808 -ip 1808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 476

Network

Files

N/A