Malware Analysis Report

2024-12-07 20:01

Sample ID 241113-11kf2stmbq
Target Launcher1.0.0.exe
SHA256 a31424f461172d82264973002dbbbc2013b0a54b683a9c108eaa49a3dce8803f
Tags
discovery execution credential_access spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

a31424f461172d82264973002dbbbc2013b0a54b683a9c108eaa49a3dce8803f

Threat Level: Likely malicious

The file Launcher1.0.0.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery execution credential_access spyware stealer

Uses browser remote debugging

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Enumerates processes with tasklist

System Location Discovery: System Language Discovery

Unsigned PE

Browser Information Discovery

Program crash

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 22:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20240903-en

Max time kernel

119s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20241010-en

Max time kernel

119s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

139s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2884 wrote to memory of 3376 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2884 wrote to memory of 3376 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2884 wrote to memory of 3376 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3376 -ip 3376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20240903-en

Max time kernel

133s

Max time network

135s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437697595" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b84db01836db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000001e5fb6eafac87d10f370452e2ffa32d2a3abae2cafd471c1a836e7b1c6830521000000000e8000000002000020000000087a184b3cd4a6f9a76c565721abc7f88f3954155044b1a30a546f77ba52e7d42000000054ce51ae9465ad2c12e860f5b3db3300cdf405bd9a8dfb225cc71c374f9f6d1940000000ffa398f91e96090ecacef94ce402ab063a871b361490084f7bf295e7bc4cf7c070a057722e924e6a972179adb23d6625a1ef29d9fcbd50d4da4530626dd1cb17 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB305AF1-A20B-11EF-98F1-4A174794FC88} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000008561fdf367a868c1f259157b3f28579ded730b59b5b572fd1d2819f695757a65000000000e8000000002000020000000df4ef9cf881b8f8d87e48356f8ce70e77bd3a1defac3d4fb6df3d21fee4e797990000000ea89eb38de5ffc562a9d03269a89cc017ab7fc7e93603363d1c31eb0a92b4a35ec66b07a92789ca06160c3c034bc477bea99e3304816ba89f3d118a2ac1ad178a01aefb0b8297fb4b5bbaf72e92b3e3515d1043d2c1cf9e9c5fba4b970074f40e6ab4652c473cbd46d89a6e12aca513e1b41168b1f42eef5347f5a76c9a6855fd3f95155d5533f65242e91b45188a45640000000707bfdd0ca5d94c35558673e769e834d702045b908051128acc89648a627b604e28600777fb6d254abeef2b7d2a1ad78a53cfcb2bd0dbd5cbcc5493238a55b04 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab8B90.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar8C4E.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b7a5473184f709452fa137b1ad34eaa4
SHA1 f3c6cf036a443b9ce55ce3dd0e512bfe06d06e86
SHA256 704b0e5674f086fdd3e140738946c95f81d03a622a820a29763fa7f26c0159ff
SHA512 e2a2616d760eba8e88b8713f0137ee64afe4875a25110e91dc8621e70422457c4764cb3c989790d9c9d784c8d0c4ebe2dc23340ecfce7eba2c380e0200a86312

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a11ac7bb756a50899915df7dc953ea48
SHA1 33fdef81edff4f3da3018b405126e5675dfc4ced
SHA256 c1f5cfa76049df0e0d28be439c9741c88ebd47ebc9c5586c45a9aebb0a5ae771
SHA512 e3ef7fd53f0d6272ac97711f31771d9eb74a0c2dbc3da393ccbded0af76841e303ca2483d511914d23ee875620e9b16dfe29321f2b6c4206c6e66b60c37554a0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 604336b3171483c785d512096c8e0aaa
SHA1 4b30654e4a860a2bba6ee9a60db7ba514224ab4a
SHA256 522c538be5432dad305badbfec0d7f6648ce60f941252892a0f870e276c5b0ce
SHA512 7cabd7ffa1722358ecb5c0abebfcc4c8382bd3f897151044788868f327350375162d6a7903c8940334e428379ad130657c84d4202688ea96ebc2d01fc5c7d05c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 24d30c58ff30155f6f8fafc1dfd494ca
SHA1 389c0c0105e86c51b647079d73b6eee6b15d4ab1
SHA256 7c957b2ad4bef04d64652ef8c6bf2c1ba6ffac6f7a1de35c62ec564bba193fd1
SHA512 33a33c1ab704db71201d6d46189d8a0a195b86eca739bbbd36ffa3e0d85ee1a5a1d82f2f5809b6bdf04fe6cffbd31bd4136910ec330e9147c9aeee86f7d3f728

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67bcc4ae980f7d5f8aebc7c4160e4673
SHA1 4dd55909d3c21a272dbfe595693e8ad1998d7f2d
SHA256 184324de21c88243b7d413809ffb1404f2458fda97ccd130156739e6940ebffd
SHA512 c210572020bd17b275fd2e7911488f52f99e6a66d76f9c805f1817d001db88b8de465c1251056afb039a28cb557f447ff0dc7ce16cb72dfe69938356fa7b9aa6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51b11ed412c51b81c3dd7f628a26501a
SHA1 c1a277209b0b19ab9927e2d06c87f244233b7970
SHA256 1ab1161f6910995f8a06e575a503aea448c2b05e0977c431bbf320329c7b8690
SHA512 694f1b3d76e9a228926cf80ba3de25679e8adc4dd912535dc748bb7ea94a77983d1edd41b55b03c87a6f76abcf86c481c9642270fd6991365e2ab64b1f24127e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aa00197c3406a1bf70c002668b355d9f
SHA1 7505056f9bfea50110288cc20fab460e33ee3287
SHA256 fa0f1dfb000dabb92f906f0d0e07dd9f3b5581900146e01119f44619022a5b66
SHA512 2d304c3cc2642ee12e237071b6be7101782d9af8f50bba6b40aefaa4cfeda055a9b97433f8b83ef4750d6d475b4ebcb4eba6d1faeb336366922c7ce9c71ebe05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2da5b58014b2b7345a89ef6ca2759009
SHA1 ef0a079216aea855447c8a77e82460808113095d
SHA256 094c97c95808066186228583bd35ef481ba51dc34f62300bef7e29f155bf27bd
SHA512 13a01d72bd4e2078e47218778c2ec9677dd7c810ba39bfb81254e7eb96d58a41bd1805cdb3f957fb06b773192e204b19d185e2c2cf340cedc5f01feb96d47d98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e133436f01f7b3e386ef1f4b07b063d2
SHA1 081caa75d1c7ae10806ce278a395f08168b7bafa
SHA256 431d1c76a4a276885d5e7718ac6452454724f554dd22ac348ccba4a2ad8b968f
SHA512 016b95980eed5f2133d3d95a39b716aeb4c165f90918c6a798e968f201135adb40520a488bc494b527429940bc3e029564c384da03cb2844dd27707e952900ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 591e5b9dbb327cf449b4f35c253b9c93
SHA1 8ae3abddf1b7958cdca17deea69a516d83bf1a12
SHA256 08f2a4bbb82934a529dd78826ff1d25c95de950f4bbe2056dad8267cbf0e0c50
SHA512 3c412d4019f6c58bad2f4b2fe5127bbdf82523e6685a6d57b5ace60b3ed2527910fc9b3b34a15bc77b76aef85ae4343eb325b96601c57ef4d0b1f7ac9e24f0d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5c16153e418a9af8d7ebc03dbbad1d91
SHA1 3d0ea077fe5803200ec07c90c7459cda273b99d8
SHA256 18afa008a4e986daf1ea833dc270dca26348abef5a3dbf88ffa2195c31626bf6
SHA512 5cb08f88c81d45ebf5e6af45d6daad5475cd481f5ec333631febff2b5928ef26079c8db2d5ca5f36412fd53f88c7c72fc27c51e28db62662aaf68a8d4d67f535

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5ee2cd23d813667d1f05215cfff2221d
SHA1 9853f60710949bd93de73e184310a8b3448234d8
SHA256 1dc3e0b2ac75f422e94cc48a0f6d815a8a906326b5c5f529e75fbfdb37f125b2
SHA512 83ec2e68684a3b80de6c665c3bff229df01b1dbfd3125fcafccd8d54e6e9aad1e88ed4e4cab539159016c44b7694ef4de27bafb1622ac3ab0908d7fc94245ff0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4475b309bf880c93d464b91adb208765
SHA1 b31fa719330deda387dff47fe9e39ef042157ec5
SHA256 b5895f94817947977b18809cbda484124984ff28e86ff3697afde8e5f3e4b59a
SHA512 77de6f4bfade9d1799b1bfa3fa342f0f2aaea8700699f4ad3dfcca54e816f3bc83276e9a2536daaa2cb6a8b8ffe962320c829761d7ebd36f692db514982e7092

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e07fb4723b442258246db1cddc402453
SHA1 1d6bceb2b17c48d48406c89e3c5c9a99ad8e6c71
SHA256 ccfa5248cf6994f1cce9a33228e1e401766ae75075699dd74834f479033ebe6b
SHA512 e0526e4a3c27736ca5e328e740e0c35325979dd4839e14375ec77e294aeab44c862a4f07e9d43167920b9b36000f9b770fc6021ff43c221eeac6ab362d569aea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 618518bb24f4b1a494284071d8983ba4
SHA1 3220d8184bbe827ce699ce6bee6b409f3d931e47
SHA256 4d2df6a79656a3bfcccc84f656e6c7fe4fde60bc2a29aaa7bec763f01e257151
SHA512 cf7f677c474f032b29a5790cca1f07c34c2916f43173ef324382dbff0026fa900f975296bf51db630df7a9f431feff161fdcc863100dd7e2e53725dec92481b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0a74df8acafda3f00b87f958173cd47f
SHA1 106622edd4f90e85787df806b45fc63839878039
SHA256 ea8aa9af3da199966e2064701f4b0ff7f160adf3496af0045a91a6cc41fa47ff
SHA512 f5c20b94502d96d2bc96594b156e4801e43d84ff0ebdc40b5dd8832ccf613b1b89b9f1babe4d1ae41c5320e722143c216ef0ada43853de45802d12b91b71f21f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d0015aaab793512fa7b4795e75e4e7ab
SHA1 a62b52dfdfacd45aea93524479e67abec41a3e4d
SHA256 e11c580c88a048f9703b7510fdce845dcb546a54d3d13b3334a53480a93c3e41
SHA512 b1d030a9ac2827e84f96e8abb90d61312ccd7d7a831da36f34bfc14d2474f2d5b5f41da910d50a2dc796a040e1ff3afc20740ba7827e1d3338f306c6793e7dbe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3dae9ac3afca65d2f9327ab4e394fc8
SHA1 b78fabed7fd29e687de02160c435776b01360293
SHA256 9b883c69c15c5464123ccc0ddf7ac896db09835df1f7da3c348d9c3ed209e83a
SHA512 812dfbff4b5bd306af539eeff1c73ce0a9892f622e496edb585678e61a4913f63aed24b8f6681364b4cdfea57fdc422b23c5a24c35eebebdc764f5967293e5be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 904938700431df1b097d41d61d989fdd
SHA1 ed17e4c606cbc4d1ddf279f8aa5897a4e5ec957d
SHA256 0089a34358f92cbe5781ce6cc16fb1b9dc3d840d5b970d169d26d0305f259bcb
SHA512 40111ff4ea5d49957c9afa087c27b363682ad8488deeafea6b65fe8d660bfa9351b7ac43c17c3df84e9e476a4ddd46c61bd639bb72225d89b4ef1f1c3515bd17

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11af4abf36b56807c4a0ab4c518e8b0d
SHA1 ea1ddca02bea0673c9262b15acb0e2c9289041d8
SHA256 ab1395b0cd8a28b3842fb4be02b84f7a1f6c56dde2fce3e04343c766084c71c8
SHA512 1ecafb656093ba3fec1f61cbe67fc493d2126357f72ef771f576d08495ddfb017d7f78caa8c644a22d3e6e03ea8324980f505df7932aba9b940b2b23fcddebf0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ae962d089a805f0b3690b16ac0f9395
SHA1 5e468788d99540ca2a32bbcd50f0aeb6e3636c69
SHA256 16def2068067a7d00afd3c36ac3c06f96050ac64faafb8acf4b516479490448f
SHA512 8946fad77bd15e0dcde06e3337ad494c9cb0c501494e0f465eca800b71d1d91c8839fce46276fdf1e832371b667707dea86f2ed16acd372073a86ae36c2dc74e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d4e67d63d57b84f4599f5c0a76b2f7b
SHA1 d79b57f25df3c07d03ba47e51b858e749cb788e3
SHA256 e7d8376a3b81d66693a614344d2fc8439da0afd674216a4ea155deb42052ac1e
SHA512 565035715d173566910b8f4cf1dc415dfdcdde4dd9d1d6920def9aaba6ac31d4f5fd28ef6a4d08a1385b1bf11a9d622d58ad238c2d96a9ee2d498a71792194f5

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:12

Platform

win7-20240903-en

Max time kernel

122s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2236 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2236 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2236 wrote to memory of 1692 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2236 -s 80

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20240903-en

Max time kernel

119s

Max time network

134s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2360 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2360 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2360 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2360 -s 88

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 428 wrote to memory of 2012 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 428 wrote to memory of 2012 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 428 wrote to memory of 2012 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2012 -ip 2012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20240903-en

Max time kernel

121s

Max time network

140s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20240903-en

Max time kernel

122s

Max time network

133s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 220

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20240903-en

Max time kernel

122s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 220

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20241010-en

Max time kernel

119s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 220

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

167s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20240729-en

Max time kernel

9s

Max time network

17s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1744 wrote to memory of 1688 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1744 wrote to memory of 1688 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1744 wrote to memory of 1688 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1744 -s 88

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

164s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/3208-0-0x00007FFC4A353000-0x00007FFC4A355000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otf1tgmf.vn4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3208-6-0x0000017571470000-0x0000017571492000-memory.dmp

memory/3208-11-0x00007FFC4A350000-0x00007FFC4AE11000-memory.dmp

memory/3208-12-0x00007FFC4A350000-0x00007FFC4AE11000-memory.dmp

memory/3208-15-0x00007FFC4A350000-0x00007FFC4AE11000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20241023-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe"

C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe

C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nstB06C.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nstB06C.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\chrome_100_percent.pak

MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\chrome_200_percent.pak

MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\ffmpeg.dll

MD5 a007299c49fa50aeff594655859780ae
SHA1 d202f1f617023763a0e9418878e8ecac96be9fd4
SHA256 b78f0036621ad1d5833289f2ad509963ef78f1a89a3c7df0f1370fd2d35a2804
SHA512 444c4baa1e1d941bd04f78184cec519c6eb53a83fbc3aa3ea30522bffc9ecde73ebe7b910c1a37c345429298ada3c0ffcb3e3849e21b2009487b5cd1a02cb2a9

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\libEGL.dll

MD5 ca5bb0794b7700601e9438283d458665
SHA1 7fcf090b19820b9450937be800575c526448b581
SHA256 4a8be3b4d9fe790efdce38cff8f312a2f8276908d6703e0c6c37818e217cf1e3
SHA512 36ebab858fe7e014837548575389e7df2e86676888e4a9039c736d0f2e6463102e68989b794d949ddb16d9bcce43ce55737fcf2a4b09b1667bf968a9540e9f32

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\libGLESv2.dll

MD5 05b585464f18fe0e3bddb20527697d66
SHA1 8bcec2f0b409afa9ff054e25f3ce85eb9bd50010
SHA256 0bb7c6c08b569c1d2de90a40e6c142591e160a7c6cb15d21807f3404a48c4287
SHA512 f680ab9c3070f443c7359bb3f0c2032f5c58c88c7823e4592e8212ce8815ea5f463c86df113f5320944c62d3cb4e8d45b9b4dcaadccc1ac9bf203ae4bb52083c

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\LICENSES.chromium.html

MD5 8303b3a19888f41062a614cd95b2e2d2
SHA1 a112ee5559c27b01e3114cf10050531cab3d98a6
SHA256 9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
SHA512 281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\resources.pak

MD5 31c7d4b11ad95dfe539dd098e0fab736
SHA1 5418682d939ce8485ecc9125b872c14ffec662c2
SHA256 a251019eb08f1e695e935d224544bda37c5ae092ba68a89fa1fe3bd19bde4f5c
SHA512 f868a4afa4e0d5c561873d2a728e267f98da2df3fb90966e5736d496b6a24e71769a02b0346b27b7dcce11cbe07248e309f50a89977dc8e5bbc06d6cc31bf738

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\snapshot_blob.bin

MD5 4ebd06bdf6cf8dacf6597586fd1704b5
SHA1 e6819ef37f99f91468f4b94370a4ab467a075a6d
SHA256 148e4b85983f0d27adecd9c6431b66379ac5538688f320e89d74ff6d48bb740b
SHA512 17ed5abe702748b4626b3ee6de4d0916738f095c913c2700eee06b65a2bbcaf72afc1f87af7ce0fcce8bd15fe6881508255d397a346c45a82c7791b9b9833ddf

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\v8_context_snapshot.bin

MD5 146e284750735ef4798527dc1cd0e741
SHA1 6408985b7d05c768a62bcb912234f14e1898ffdb
SHA256 3820e8fa1077d02606fea8e1b3a9ca4bf7f4a71d0569d9a8ea9ee7a009d0ce80
SHA512 46824df5d20e02fb72c3efd07bee6d832b1ab78c0163688fa84edb831cbfbef2dde12ba9da01f9dd49c4008bd3862a95699a2f6d55b8d4b3165976d3851c7278

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\vulkan-1.dll

MD5 6c70aab071c4febc5921e0d39811937a
SHA1 20d87b3a5333ea3f6d0d7b0333f2c30a281937aa
SHA256 2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
SHA512 7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\vk_swiftshader.dll

MD5 750cbdfb01943e28e08708183ec208b5
SHA1 1bee0cd3d0970834b2a47daf384354f243fd1ee0
SHA256 a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
SHA512 dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ar.pak

MD5 56f6dc44cc50fc98314d0f88fcc2a962
SHA1 b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256 7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512 594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\cs.pak

MD5 a934431d469d19a274243f88bb5ac6fb
SHA1 146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256 51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512 562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\es.pak

MD5 e9fa4cada447b507878a568f82266353
SHA1 4a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256 186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA512 1e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\id.pak

MD5 bd9636e9c7dc7be4c7f53fb0b886be04
SHA1 55421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA256 5761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA512 7c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ml.pak

MD5 3b1305ecca60fb5a7b3224a70398ead9
SHA1 04e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256 c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA512 68fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ru.pak

MD5 fc0e2fc09aa9089c5db75bab7a0754a7
SHA1 f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256 188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512 377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\sr.pak

MD5 cf160983a86b51ec42845f4e60ac9123
SHA1 4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256 ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512 b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\zh-TW.pak

MD5 8f67a9f38ad36d7d4a6b48e63852208d
SHA1 f087c85c51bdbdef5998cfc3790835da95da982a
SHA256 92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512 623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\zh-CN.pak

MD5 9d4f54eb5a12cf4c2f34f5f538dff90b
SHA1 c31b892ce78c733bde0571b6236170103cc9fe7a
SHA256 58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA512 46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\vi.pak

MD5 9274866d7c6314f43dd63ed293293e25
SHA1 4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256 dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512 3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ur.pak

MD5 d7ec7d551dee1e1ef11be3e2820052f9
SHA1 d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA256 05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA512 92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\uk.pak

MD5 e4c4e3700469704b936460ca1a90fcc0
SHA1 e809990fc07a1d39fe623046382699e648e343c0
SHA256 29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA512 68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\tr.pak

MD5 9f24f44cac0997e1d0a6a419520f3bfe
SHA1 edb61859cbb5d77c666aac98379d4155188f4ff5
SHA256 3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA512 65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\th.pak

MD5 293ad7c20c22d744e4db0fb001ec45bb
SHA1 486c9e0732306a45aceb633da2b3ded281197620
SHA256 d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512 ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\te.pak

MD5 02415ded02cc7ac25e8f8d0e83365061
SHA1 5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA256 97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA512 54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ta.pak

MD5 a8beab6896018a6d37f9b2e5bdd7a78c
SHA1 64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256 c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512 73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\sw.pak

MD5 ee8da42ffe40fbb916c56390e2cd99e8
SHA1 6d824f56afe6b3605a881d2c26e69a46e6675347
SHA256 192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA512 7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\sv.pak

MD5 bbe0785c5f9591e8a1e7c4830fe949d6
SHA1 da4f3286079d50e1c04e923529e03e7d334c7fff
SHA256 0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA512 38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\sl.pak

MD5 4d9d56ef0b176e7f7aa14270e964ec77
SHA1 515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA256 6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512 740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\sk.pak

MD5 793c442420f27d54410cdb8d8ecce5ff
SHA1 8995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA256 5a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512 291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ro.pak

MD5 19cfc7c8f1a2e4a2de1f9f64475469bc
SHA1 bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA256 3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512 ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\pt-PT.pak

MD5 acffa29064f40a014bc7fe13e5ff58a9
SHA1 5a0890c94084075446264469818753f699a3d154
SHA256 423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512 d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\pt-BR.pak

MD5 a23c805ee4d3d67c811b50826ca25a51
SHA1 c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA256 62be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512 c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\pl.pak

MD5 61c093fac4021062e1838a32d79399c2
SHA1 84a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA256 58067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512 475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\nl.pak

MD5 bc41967b2ff493e7f151c7721245739d
SHA1 7606133ddbb58492dbbf02c03a975fb48da1e26f
SHA256 3dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA512 9e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\nb.pak

MD5 7576c2fa9199a4121bc4a50ff6c439c3
SHA1 55e3e2e651353e7566ed4dbe082ffc834363752b
SHA256 2a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA512 86c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ms.pak

MD5 9b3e2f3c49897228d51a324ab625eb45
SHA1 8f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA256 61a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512 409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\mr.pak

MD5 25f2b9842e2c4c026e0fc4bc191a6915
SHA1 7de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256 771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512 ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\lv.pak

MD5 e4f7d9e385cb525e762ece1aa243e818
SHA1 689d784379bac189742b74cd8700c687feeeded1
SHA256 523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512 e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\lt.pak

MD5 96602a3f3b59faa997a4d337889fa02b
SHA1 94593a270b0d84c006e0959bc136b6c4987dfd3f
SHA256 51db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512 dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ko.pak

MD5 b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1 050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256 ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512 b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\kn.pak

MD5 a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1 f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA256 3c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512 f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ja.pak

MD5 f47efaa76f5200a6c0c23c33684d7bad
SHA1 9b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA256 5b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA512 67d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\it.pak

MD5 7c981a25be0e02fba150e17d9669a536
SHA1 3af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256 ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512 445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\hu.pak

MD5 b338dcb0e672fb7b2910ce2f561a8e38
SHA1 cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256 bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512 f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\hr.pak

MD5 105472bc766a30bb71f13d86081de68d
SHA1 d014103ad930889239efd92ecfdfcc669312af6c
SHA256 a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512 ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\hi.pak

MD5 b7e4892b2030e4f916364856b6cc470a
SHA1 b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256 093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512 ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\he.pak

MD5 93d9261f91bcd80d7f33f87bad35dda4
SHA1 a498434fd2339c5d6465a28d8babb80607db1b65
SHA256 31661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512 f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\gu.pak

MD5 7b5f52f72d3a93f76337d5cf3168ebd1
SHA1 00d444b5a7f73f566e98abadf867e6bb27433091
SHA256 798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA512 10c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\fr.pak

MD5 0445700799de14382201f2b8b840c639
SHA1 b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA256 9a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512 423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\fil.pak

MD5 3165351c55e3408eaa7b661fa9dc8924
SHA1 181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA256 2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA512 3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\fi.pak

MD5 5518b51d4af7f1b9d686cbea28b69e71
SHA1 df7f70846f059826c792a831e32247b2294c8e52
SHA256 8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512 b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\fa.pak

MD5 dcd3b982a52cdf8510a54830f270e391
SHA1 3e0802460950512b98cd124ff9f1f53827e3437e
SHA256 e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA512 3d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\et.pak

MD5 a94e1775f91ea8622f82ae5ab5ba6765
SHA1 ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA256 1606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512 a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\es-419.pak

MD5 5321c1e88c5c6fa20bdbc16043c6d0f6
SHA1 07b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256 f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512 121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\en-US.pak

MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\en-GB.pak

MD5 0db7f3a3ba228aa7f2457db1aa58d002
SHA1 bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256 cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA512 9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\el.pak

MD5 6922aaa87431699787c1489e89af17b9
SHA1 6fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256 800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512 367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\de.pak

MD5 ed329b35d10e81f55d611fe8748876f8
SHA1 0d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA256 6facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512 bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\da.pak

MD5 bb5252dc6f0f3c01ce3638138bf946c8
SHA1 bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256 c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512 e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\ca.pak

MD5 01acd6f7a4ea85d8e63099ce1262fbad
SHA1 f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256 b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA512 2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\bn.pak

MD5 8feb4092426a0c2c167c0674114b014d
SHA1 6fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256 fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA512 3de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\bg.pak

MD5 945de8a62865092b8100e93ea3e9828d
SHA1 18d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256 f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA512 5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\am.pak

MD5 c6ef9c40b48a069b70ed3335b52a9a9c
SHA1 d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA256 73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA512 33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\7z-out\locales\af.pak

MD5 7e51349edc7e6aed122bfa00970fab80
SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

153s

Max time network

169s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5112 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 2980 wrote to memory of 4776 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2980 wrote to memory of 4776 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Users\Admin\AppData\Local\Temp\Launcher.exe
PID 5112 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 2148 wrote to memory of 4916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2148 wrote to memory of 4916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 5112 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 960 wrote to memory of 1132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 960 wrote to memory of 1132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 5112 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 4880 wrote to memory of 3428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4880 wrote to memory of 3428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 5112 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Windows\system32\cmd.exe
PID 2680 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2680 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 5112 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5112 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\Launcher.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 4144 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 4144 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 32 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 --field-trial-handle=1844,i,15960222462714337512,1063788633402680351,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1936 --field-trial-handle=1844,i,15960222462714337512,1063788633402680351,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb26facc40,0x7ffb26facc4c,0x7ffb26facc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2052,i,16182068849256306970,14081821546736389451,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2036 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1676,i,16182068849256306970,14081821546736389451,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2508 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2116,i,16182068849256306970,14081821546736389451,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2512 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,16182068849256306970,14081821546736389451,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,16182068849256306970,14081821546736389451,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3488 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4620,i,16182068849256306970,14081821546736389451,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb23dd46f8,0x7ffb23dd4708,0x7ffb23dd4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,17923210637292865222,4326695144636575615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,17923210637292865222,4326695144636575615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1776,17923210637292865222,4326695144636575615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1776,17923210637292865222,4326695144636575615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1776,17923210637292865222,4326695144636575615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1776,17923210637292865222,4326695144636575615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1776,17923210637292865222,4326695144636575615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"

C:\Windows\system32\where.exe

where /r . *.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM EpicGamesLauncher.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM javaw.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM Steam.exe /F

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=784 --field-trial-handle=1844,i,15960222462714337512,1063788633402680351,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 72.145.3.21:443 tcp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 21.3.145.72.in-addr.arpa udp
US 8.8.8.8:53 catbox.moe udp
US 108.181.20.35:443 catbox.moe tcp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 35.20.181.108.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
GB 216.58.201.100:443 www.google.com tcp
GB 216.58.201.100:443 www.google.com udp
US 8.8.8.8:53 100.201.58.216.in-addr.arpa udp
US 108.181.20.35:443 catbox.moe tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 72.145.3.21:443 tcp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp

Files

C:\Users\Admin\AppData\Local\Temp\3bb8a8dd-b93a-402e-916f-0bf6a9a67bdc.tmp.node

MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

C:\Users\Admin\AppData\Local\Temp\96cdc43f-14a0-47af-8317-a6cc0956a88f.tmp.node

MD5 50cebda432abf00d6094f2ed8f746125
SHA1 d4184f21252100e2dac2c791556f417ab1e63352
SHA256 b1a4028599bea6a7201f20c88854729f4a0c7e1422b8fef9d18cf1842a499101
SHA512 934d8ed7dbada1a1c0be0fd1cd8daa4c56829fbba65ee04bb1271fbeaf1b8662d757ef3adc1eb0fb39d0e9d7f77b3f7eeb6b71215455911c5439506deca6397b

\??\pipe\crashpad_32_NJIRYJEMDHDFVPJL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9647e7eb72f5e56bd3af0afec410ee0c
SHA1 35ad358b90d199ada26299d8f856aa152c5dc682
SHA256 2de080ea033d4216a90de11275d6f1178a8bbd3b4363abe22b6234b7d9a5d155
SHA512 b2163fb5306baf8d82e12ff0e954ee9e8a8b542165c0ef2cf745a31e46e309b214dea5147414da28fb375d49288dc20c90fd5c6d3e6b1a2aa9b867d4fa6cefef

memory/228-129-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-128-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-127-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-138-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-139-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-136-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-137-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-135-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-134-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

memory/228-133-0x0000019FB0390000-0x0000019FB0391000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

169s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4568 wrote to memory of 2356 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4568 wrote to memory of 2356 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4568 wrote to memory of 2356 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2356 -ip 2356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

165s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3356 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 3280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 3280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3356 wrote to memory of 2540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4ed846f8,0x7ffd4ed84708,0x7ffd4ed84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,16263387756305593271,2566151609818700191,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

\??\pipe\LOCAL\crashpad_3356_FZYZVJNRCKWVTPWN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3c07f3bee5cbb657c5a1d3dd101d2909
SHA1 dc39809fcdc3e3d8ee776c78ec0d2d9a909248e1
SHA256 6c13109799b5eff3e6112c47ba4ba6a9c7c41fb305a4090289be8300aa9be469
SHA512 430ac48abc4865d7f16f333ef68f34adcdd65f5a239583d64289c3839af9f1a7feacfa4566968d23d3848dba14975c76b7e9f6a4f63bb592cd199d35b7397215

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e455929d20fbdf00fe415165a99026d0
SHA1 f4150b33355eab387583bcad66cdd164c651aa36
SHA256 21527a049055d4d9561fff68e6f156f5667aab71073847b640308eeb5eb57480
SHA512 22f65c01f2e7b8c11b4b059deb667b6f08b9f90f0ede1dbea136f045630511e9e6222e2ef0537c81667258104727a3f1185b3e074672fd2bd4488f9d99612ef2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f519878fd0270609b3dd8fcebc4b2c6d
SHA1 00d51495c6a39494ded4971d3a01a86b66ab5dc7
SHA256 bc156671646e0e16db2fa3dd6dd111272f35e23ca754582ac7b926d09298c5a6
SHA512 370c6a33b94a014f1bf77ed155f862b11021ca910aa6a54c831397315984ce7af03b90a01153b7d34be8c0272dde8acb456d5b6112dab1510d3d3ebdc22d3563

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20241010-en

Max time kernel

8s

Max time network

21s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20241023-en

Max time kernel

117s

Max time network

126s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\af.ps1

Network

N/A

Files

memory/1988-4-0x000007FEF56AE000-0x000007FEF56AF000-memory.dmp

memory/1988-5-0x000000001B690000-0x000000001B972000-memory.dmp

memory/1988-7-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

memory/1988-6-0x0000000002390000-0x0000000002398000-memory.dmp

memory/1988-8-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

memory/1988-9-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

memory/1988-10-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

memory/1988-11-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win7-20240903-en

Max time kernel

122s

Max time network

139s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Network

N/A

Files

memory/2636-4-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

memory/2636-5-0x000000001B760000-0x000000001BA42000-memory.dmp

memory/2636-6-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

memory/2636-7-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2636-8-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2636-9-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2636-11-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2636-10-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

memory/2636-12-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

142s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3516 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 3516 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 4100 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 2808 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2808 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe
PID 4100 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 4100 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 1360 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1360 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4100 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 4100 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 2040 wrote to memory of 876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 2040 wrote to memory of 876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 4100 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 4100 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 4284 wrote to memory of 4308 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4284 wrote to memory of 4308 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4100 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 4100 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Windows\system32\cmd.exe
PID 4908 wrote to memory of 1520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4908 wrote to memory of 1520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4100 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4100 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4232 wrote to memory of 2712 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4232 wrote to memory of 2712 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4232 wrote to memory of 2000 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4232 wrote to memory of 2000 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4232 wrote to memory of 2000 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4232 wrote to memory of 2000 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4232 wrote to memory of 2000 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe

"C:\Users\Admin\AppData\Local\Temp\Launcher1.0.0.exe"

C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe

C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 --field-trial-handle=1848,i,7015047908794923120,1180970254855270241,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2264 --field-trial-handle=1848,i,7015047908794923120,1180970254855270241,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc30decc40,0x7ffc30decc4c,0x7ffc30decc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2020,i,13169517935882941202,12392339060285749840,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2012 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1904,i,13169517935882941202,12392339060285749840,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2140 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,13169517935882941202,12392339060285749840,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2276 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,13169517935882941202,12392339060285749840,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,13169517935882941202,12392339060285749840,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4508,i,13169517935882941202,12392339060285749840,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2f6146f8,0x7ffc2f614708,0x7ffc2f614718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5857001739369874212,7776837024015738511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5857001739369874212,7776837024015738511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5857001739369874212,7776837024015738511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2108,5857001739369874212,7776837024015738511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2108,5857001739369874212,7776837024015738511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2108,5857001739369874212,7776837024015738511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2108,5857001739369874212,7776837024015738511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"

C:\Windows\system32\where.exe

where /r . *.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\taskkill.exe

taskkill /f /im msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM EpicGamesLauncher.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM javaw.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM Steam.exe /F

C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe

"C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1848,i,7015047908794923120,1180970254855270241,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 21.3.145.72.in-addr.arpa udp
US 72.145.3.21:443 tcp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 catbox.moe udp
US 108.181.20.35:443 catbox.moe tcp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 35.20.181.108.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 216.58.201.100:443 www.google.com tcp
GB 216.58.201.100:443 www.google.com udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 100.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 108.181.20.35:443 catbox.moe tcp
US 72.145.3.21:443 tcp
US 72.145.3.21:443 tcp
US 72.145.3.21:443 tcp
US 72.145.3.21:443 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp

Files

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\2ooUBWmm3a88pO7S5x8Oo4NZbKm\chrome_100_percent.pak

MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\chrome_200_percent.pak

MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\ffmpeg.dll

MD5 a007299c49fa50aeff594655859780ae
SHA1 d202f1f617023763a0e9418878e8ecac96be9fd4
SHA256 b78f0036621ad1d5833289f2ad509963ef78f1a89a3c7df0f1370fd2d35a2804
SHA512 444c4baa1e1d941bd04f78184cec519c6eb53a83fbc3aa3ea30522bffc9ecde73ebe7b910c1a37c345429298ada3c0ffcb3e3849e21b2009487b5cd1a02cb2a9

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\libEGL.dll

MD5 ca5bb0794b7700601e9438283d458665
SHA1 7fcf090b19820b9450937be800575c526448b581
SHA256 4a8be3b4d9fe790efdce38cff8f312a2f8276908d6703e0c6c37818e217cf1e3
SHA512 36ebab858fe7e014837548575389e7df2e86676888e4a9039c736d0f2e6463102e68989b794d949ddb16d9bcce43ce55737fcf2a4b09b1667bf968a9540e9f32

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\libGLESv2.dll

MD5 05b585464f18fe0e3bddb20527697d66
SHA1 8bcec2f0b409afa9ff054e25f3ce85eb9bd50010
SHA256 0bb7c6c08b569c1d2de90a40e6c142591e160a7c6cb15d21807f3404a48c4287
SHA512 f680ab9c3070f443c7359bb3f0c2032f5c58c88c7823e4592e8212ce8815ea5f463c86df113f5320944c62d3cb4e8d45b9b4dcaadccc1ac9bf203ae4bb52083c

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\LICENSES.chromium.html

MD5 8303b3a19888f41062a614cd95b2e2d2
SHA1 a112ee5559c27b01e3114cf10050531cab3d98a6
SHA256 9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
SHA512 281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\resources.pak

MD5 31c7d4b11ad95dfe539dd098e0fab736
SHA1 5418682d939ce8485ecc9125b872c14ffec662c2
SHA256 a251019eb08f1e695e935d224544bda37c5ae092ba68a89fa1fe3bd19bde4f5c
SHA512 f868a4afa4e0d5c561873d2a728e267f98da2df3fb90966e5736d496b6a24e71769a02b0346b27b7dcce11cbe07248e309f50a89977dc8e5bbc06d6cc31bf738

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\vk_swiftshader.dll

MD5 750cbdfb01943e28e08708183ec208b5
SHA1 1bee0cd3d0970834b2a47daf384354f243fd1ee0
SHA256 a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
SHA512 dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\vulkan-1.dll

MD5 6c70aab071c4febc5921e0d39811937a
SHA1 20d87b3a5333ea3f6d0d7b0333f2c30a281937aa
SHA256 2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
SHA512 7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\v8_context_snapshot.bin

MD5 146e284750735ef4798527dc1cd0e741
SHA1 6408985b7d05c768a62bcb912234f14e1898ffdb
SHA256 3820e8fa1077d02606fea8e1b3a9ca4bf7f4a71d0569d9a8ea9ee7a009d0ce80
SHA512 46824df5d20e02fb72c3efd07bee6d832b1ab78c0163688fa84edb831cbfbef2dde12ba9da01f9dd49c4008bd3862a95699a2f6d55b8d4b3165976d3851c7278

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\snapshot_blob.bin

MD5 4ebd06bdf6cf8dacf6597586fd1704b5
SHA1 e6819ef37f99f91468f4b94370a4ab467a075a6d
SHA256 148e4b85983f0d27adecd9c6431b66379ac5538688f320e89d74ff6d48bb740b
SHA512 17ed5abe702748b4626b3ee6de4d0916738f095c913c2700eee06b65a2bbcaf72afc1f87af7ce0fcce8bd15fe6881508255d397a346c45a82c7791b9b9833ddf

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\am.pak

MD5 c6ef9c40b48a069b70ed3335b52a9a9c
SHA1 d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA256 73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA512 33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\af.pak

MD5 7e51349edc7e6aed122bfa00970fab80
SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ar.pak

MD5 56f6dc44cc50fc98314d0f88fcc2a962
SHA1 b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256 7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512 594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\bg.pak

MD5 945de8a62865092b8100e93ea3e9828d
SHA1 18d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256 f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA512 5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\cs.pak

MD5 a934431d469d19a274243f88bb5ac6fb
SHA1 146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256 51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512 562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ca.pak

MD5 01acd6f7a4ea85d8e63099ce1262fbad
SHA1 f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256 b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA512 2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\bn.pak

MD5 8feb4092426a0c2c167c0674114b014d
SHA1 6fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256 fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA512 3de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\da.pak

MD5 bb5252dc6f0f3c01ce3638138bf946c8
SHA1 bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256 c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512 e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\de.pak

MD5 ed329b35d10e81f55d611fe8748876f8
SHA1 0d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA256 6facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512 bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\fr.pak

MD5 0445700799de14382201f2b8b840c639
SHA1 b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA256 9a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512 423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ja.pak

MD5 f47efaa76f5200a6c0c23c33684d7bad
SHA1 9b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA256 5b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA512 67d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\pl.pak

MD5 61c093fac4021062e1838a32d79399c2
SHA1 84a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA256 58067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512 475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\nl.pak

MD5 bc41967b2ff493e7f151c7721245739d
SHA1 7606133ddbb58492dbbf02c03a975fb48da1e26f
SHA256 3dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA512 9e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\nb.pak

MD5 7576c2fa9199a4121bc4a50ff6c439c3
SHA1 55e3e2e651353e7566ed4dbe082ffc834363752b
SHA256 2a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA512 86c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ms.pak

MD5 9b3e2f3c49897228d51a324ab625eb45
SHA1 8f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA256 61a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512 409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\mr.pak

MD5 25f2b9842e2c4c026e0fc4bc191a6915
SHA1 7de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256 771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512 ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ml.pak

MD5 3b1305ecca60fb5a7b3224a70398ead9
SHA1 04e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256 c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA512 68fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\lv.pak

MD5 e4f7d9e385cb525e762ece1aa243e818
SHA1 689d784379bac189742b74cd8700c687feeeded1
SHA256 523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512 e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\zh-TW.pak

MD5 8f67a9f38ad36d7d4a6b48e63852208d
SHA1 f087c85c51bdbdef5998cfc3790835da95da982a
SHA256 92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512 623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\zh-CN.pak

MD5 9d4f54eb5a12cf4c2f34f5f538dff90b
SHA1 c31b892ce78c733bde0571b6236170103cc9fe7a
SHA256 58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA512 46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\vi.pak

MD5 9274866d7c6314f43dd63ed293293e25
SHA1 4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256 dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512 3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ur.pak

MD5 d7ec7d551dee1e1ef11be3e2820052f9
SHA1 d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA256 05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA512 92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\uk.pak

MD5 e4c4e3700469704b936460ca1a90fcc0
SHA1 e809990fc07a1d39fe623046382699e648e343c0
SHA256 29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA512 68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\tr.pak

MD5 9f24f44cac0997e1d0a6a419520f3bfe
SHA1 edb61859cbb5d77c666aac98379d4155188f4ff5
SHA256 3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA512 65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\th.pak

MD5 293ad7c20c22d744e4db0fb001ec45bb
SHA1 486c9e0732306a45aceb633da2b3ded281197620
SHA256 d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512 ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\te.pak

MD5 02415ded02cc7ac25e8f8d0e83365061
SHA1 5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA256 97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA512 54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ta.pak

MD5 a8beab6896018a6d37f9b2e5bdd7a78c
SHA1 64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256 c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512 73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\sw.pak

MD5 ee8da42ffe40fbb916c56390e2cd99e8
SHA1 6d824f56afe6b3605a881d2c26e69a46e6675347
SHA256 192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA512 7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\sv.pak

MD5 bbe0785c5f9591e8a1e7c4830fe949d6
SHA1 da4f3286079d50e1c04e923529e03e7d334c7fff
SHA256 0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA512 38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\sr.pak

MD5 cf160983a86b51ec42845f4e60ac9123
SHA1 4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256 ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512 b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\sl.pak

MD5 4d9d56ef0b176e7f7aa14270e964ec77
SHA1 515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA256 6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512 740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\sk.pak

MD5 793c442420f27d54410cdb8d8ecce5ff
SHA1 8995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA256 5a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512 291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ru.pak

MD5 fc0e2fc09aa9089c5db75bab7a0754a7
SHA1 f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256 188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512 377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ro.pak

MD5 19cfc7c8f1a2e4a2de1f9f64475469bc
SHA1 bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA256 3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512 ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\pt-PT.pak

MD5 acffa29064f40a014bc7fe13e5ff58a9
SHA1 5a0890c94084075446264469818753f699a3d154
SHA256 423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512 d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\pt-BR.pak

MD5 a23c805ee4d3d67c811b50826ca25a51
SHA1 c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA256 62be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512 c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\lt.pak

MD5 96602a3f3b59faa997a4d337889fa02b
SHA1 94593a270b0d84c006e0959bc136b6c4987dfd3f
SHA256 51db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512 dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\ko.pak

MD5 b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1 050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256 ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512 b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\kn.pak

MD5 a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1 f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA256 3c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512 f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\it.pak

MD5 7c981a25be0e02fba150e17d9669a536
SHA1 3af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256 ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512 445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\id.pak

MD5 bd9636e9c7dc7be4c7f53fb0b886be04
SHA1 55421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA256 5761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA512 7c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\hu.pak

MD5 b338dcb0e672fb7b2910ce2f561a8e38
SHA1 cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256 bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512 f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\hr.pak

MD5 105472bc766a30bb71f13d86081de68d
SHA1 d014103ad930889239efd92ecfdfcc669312af6c
SHA256 a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512 ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\hi.pak

MD5 b7e4892b2030e4f916364856b6cc470a
SHA1 b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256 093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512 ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\he.pak

MD5 93d9261f91bcd80d7f33f87bad35dda4
SHA1 a498434fd2339c5d6465a28d8babb80607db1b65
SHA256 31661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512 f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\gu.pak

MD5 7b5f52f72d3a93f76337d5cf3168ebd1
SHA1 00d444b5a7f73f566e98abadf867e6bb27433091
SHA256 798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA512 10c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\fil.pak

MD5 3165351c55e3408eaa7b661fa9dc8924
SHA1 181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA256 2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA512 3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\fi.pak

MD5 5518b51d4af7f1b9d686cbea28b69e71
SHA1 df7f70846f059826c792a831e32247b2294c8e52
SHA256 8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512 b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\fa.pak

MD5 dcd3b982a52cdf8510a54830f270e391
SHA1 3e0802460950512b98cd124ff9f1f53827e3437e
SHA256 e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA512 3d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\et.pak

MD5 a94e1775f91ea8622f82ae5ab5ba6765
SHA1 ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA256 1606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512 a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\es.pak

MD5 e9fa4cada447b507878a568f82266353
SHA1 4a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256 186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA512 1e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\es-419.pak

MD5 5321c1e88c5c6fa20bdbc16043c6d0f6
SHA1 07b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256 f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512 121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\en-US.pak

MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\en-GB.pak

MD5 0db7f3a3ba228aa7f2457db1aa58d002
SHA1 bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256 cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA512 9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

C:\Users\Admin\AppData\Local\Temp\nszC41C.tmp\7z-out\locales\el.pak

MD5 6922aaa87431699787c1489e89af17b9
SHA1 6fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256 800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512 367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6

C:\Users\Admin\AppData\Local\Temp\da52a096-ba27-4f50-8747-1cbe4661c509.tmp.node

MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

C:\Users\Admin\AppData\Local\Temp\774a7e14-f060-4a24-8186-1a8d88404586.tmp.node

MD5 50cebda432abf00d6094f2ed8f746125
SHA1 d4184f21252100e2dac2c791556f417ab1e63352
SHA256 b1a4028599bea6a7201f20c88854729f4a0c7e1422b8fef9d18cf1842a499101
SHA512 934d8ed7dbada1a1c0be0fd1cd8daa4c56829fbba65ee04bb1271fbeaf1b8662d757ef3adc1eb0fb39d0e9d7f77b3f7eeb6b71215455911c5439506deca6397b

\??\pipe\crashpad_4232_RWPFAAJGRHEJKDCO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 69752f9bd5e3c8085dd2223571f2b81d
SHA1 91a8d9a3b57184c3143302b5313238dfbb750581
SHA256 ea2362b4e88d47700ff835858b93253bded86c57f1996c220e9f0f342d8e9aa4
SHA512 4df0c7391055826d83448bf51c4385ca1663e52db65c4f6415ba431d9a2f6165c9635d589110fca791f8fd6aa1c5883bc58cf6faac5a40dd2fdde45277d82dd3

memory/4588-688-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-687-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-686-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-698-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-697-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-696-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-695-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-694-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-693-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

memory/4588-692-0x0000016DC7CC0000-0x0000016DC7CC1000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

126s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

162s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-11-13 22:06

Reported

2024-11-13 22:11

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

158s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4f4 0x2fc

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/4372-0-0x00007FF886B03000-0x00007FF886B05000-memory.dmp

memory/4372-1-0x000001992B190000-0x000001992B1B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g3rsygf0.w2r.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4372-11-0x00007FF886B00000-0x00007FF8875C1000-memory.dmp

memory/4372-12-0x00007FF886B00000-0x00007FF8875C1000-memory.dmp

memory/4372-13-0x00007FF886B00000-0x00007FF8875C1000-memory.dmp

memory/4372-16-0x00007FF886B00000-0x00007FF8875C1000-memory.dmp