Malware Analysis Report

2024-11-30 02:24

Sample ID 241115-h1hcks1ard
Target ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe
SHA256 ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426
Tags
discovery rhadamanthys dave ransomware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426

Threat Level: Known bad

The file ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe was found to be: Known bad.

Malicious Activity Summary

discovery rhadamanthys dave ransomware stealer

Rhadamanthys family

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Dave packer

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

Sets desktop wallpaper using registry

Browser Information Discovery

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Enumerates system info in registry

Modifies Control Panel

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-15 07:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240903-en

Max time kernel

120s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 220

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

158s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4796 wrote to memory of 5084 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5084 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 5060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 1172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ff94c9b46f8,0x7ff94c9b4708,0x7ff94c9b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,645759486821112523,1584825856646559066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5356 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 180.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

\??\pipe\LOCAL\crashpad_4796_EOUQCEOOUWNSRION

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 58a889818032e4279e25171a67d7a3a9
SHA1 9fc3460b3d1f2d0a0d7aed5d22ae21d94d443f65
SHA256 527b06ecd5138fc7093eccf63a724e1ca60ea40d538b71291f0f61656e982ab8
SHA512 8053446470c8c8f0daa84c1ec0cdfd5d62976026182fb0d0cc41a07c8ad4e3dc6efb245189ef86c2b224753ff30cc21d8b41c46fcf4fa9b58da9ba0852173ae0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c976298cb8241224a627cbbb8306fc29
SHA1 dc26baa55616a970401266cec06719c1c69002d1
SHA256 f37f6105f8cea5b6ab82d88aa5f24c33ca106b1f587836ec1e3ce303b46e0839
SHA512 9ff98bccbbcecde3986b5193f892cde8bcffb6396757544a4fb3209f60f553a0cc0df78a830ee9ba6c707eb289b970c019421680f659036781b430e747b5e9e7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1581a4b95ed3f9069803a80c244921c4
SHA1 c63e20ae1878b539eb353a323642d0826a606c0a
SHA256 b71f58e421e7eea492b822ad573c20a89eb0b616669a41b2be07132096576076
SHA512 4de50408454e669f84034d80e02dc8c5c67477c0ec2e34b5ec193a2d49c1878286167f3a90b13c662501f149d38f151ce1225b920612e7544c059b0919ddc6ef

Analysis: behavioral21

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240708-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 220

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

MD5 3fe065f3111d58d008fb8eb403a11a7c
SHA1 74ee9374e92cec677f39326d58b5f740b438cf10
SHA256 3866f85e7e0524bc2b5b43315da8e721b0e031ece4462329cab4892756abcebf
SHA512 e314110fba7203dca4ca71e75330c578889e3a01288be0dc1b04eba311b231199ffbe89a4cbbe58531b52c042b801dcb12fbe9e9f19e1427228007dfd6cd7ee7

C:\Users\Admin\AppData\Local\Temp\nssD831.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nssD831.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nssD831.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nssD831.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Analysis: behavioral28

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240903-en

Max time kernel

121s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 220

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240729-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 220

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20241023-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 220

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240708-en

Max time kernel

133s

Max time network

133s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ea69dfbbe90be4491fb9963b91b0f23000000000200000000001066000000010000200000007f40ea4511b85c0b84101c43553f80b9bf01e2769654163dd9454e45848dcc95000000000e800000000200002000000003d8aecaa3681102ee3664036af181d365deac1b845f993697886e7cc6a9a22d200000001ff07c67cae15471cac33696ee423a04fb5bee2f3ec01a2d6a5441ce1a54102440000000ef2cdee98edb4a949cc376acffbcccd7cb77e003cd4d673b8034d37faeb60da3966505ff693eceb87200fb8f8b412556298f1a6ba00ca64f51e7556566f0ed1b C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0566a052e37db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ea69dfbbe90be4491fb9963b91b0f230000000002000000000010660000000100002000000086ed409184d1f2e98d5b64c6b85b2fac39176a02af28ee79f1ab6c54c46e0b22000000000e80000000020000200000000656dc2221c0449cce1b875080014df254fd99a9757479f6258da689c5afc58e90000000d5aafbf7373d92cbb10ea439b510b974ec91f3a886464886453f74e412c74bc1ebea9aa461021053f2bb878cf0a5ed942531ad0b7fefe7f15970ebe46d7ae8a3874440b6f3c39ddbec61a2ed7d136f6c989e7fafb4cfb6a8785fe483d6fc89be5c282c6666d3edfbc44cd3fd8bbcfbe518bd31cbbb2c4a651b81cbbeadc916f7b95b20495b805cbb998eb9a6ca61696440000000f5f5e3c7fa65d6e2e7945866acf69ed06e526aae4c4b6bbf492195f33cecd5a1db90b749b388568a8b9743c79253bee4af7c97bd1a3fc8b8344f0ac125ef75c8 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{309B96B1-A321-11EF-B557-C20DC8CB8E9E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437816709" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab5EC6.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar5F65.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e742ced2d1588e4d4f139dc6a2b707a
SHA1 069b07a8962b7b835d81fa4b70fddb91461682bd
SHA256 b66bb7ac1bb5606c499737747be3dcf914e83ab4ef76a43cd62b0f28d1a26fb3
SHA512 6327e0790f3d08b54c0adc26405b4a53bebdd356d1fa201a2def1b567441f25d1e5300a5cd70f985fdea21b3d23dd308cb2405a497d14a7839b7bb8079be775d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 45cfbd3d5dc5889f541378cbe88dae0e
SHA1 fd330f2a28e65c836b13f06e9f6254027b381697
SHA256 97cd1d2eda825b7327a8221c19b52d571500a436a6d9fc32a33aeed90db661d8
SHA512 5a6a26e4920430f71b364eb5a0d4f51f675aa3f097ccf06df14eae64c64c40241cb42362154bb1bf84d45e97f144aa3b79ebb6501a55471a7ddc717e183ef8a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd7ac631e68115140e422ed40fd5f777
SHA1 9b25d26d01cc45176c04c291b772f830f82890df
SHA256 faccbf0b10675f8b26bae7057c5c070b84d956e0250b672398aaba5941a66396
SHA512 8e1fa9f6a1dbfcace4cc837d2823d21c91a2f23c0b48b4b0f05fd075f67332daba7730b1315db568391b914c01a64865c6d24d8227234df7e733319a7bb0d5b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b25036dfb9c84fdee7701c1e0586579
SHA1 5d4b0134cce75ae09c472b41b40f6ec0641e9822
SHA256 f8da706616c36c837a441ef240e7f40923fff7de6238b075b763a49952d9400e
SHA512 687633468eba185cda22435ad5ad1f58cefed094b162bb341f6c56e07c130ffd723d003d5dc522f98d426c2adbdc42d8187e5022a4fc16368770164ab3c891fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5428a8e2b1aef2d342bfcaabdfb0b0e4
SHA1 e6bc75cbb243357deaddf61ea1118c77b7786c0f
SHA256 cbc1d2313737e2f2acb15e24031deac47a15864e6a1ce719a47bd731c200d870
SHA512 681b8f432e82f30105e693358fd1d4307e575490f782a23c266de81eecfc6b2da506883aa77a910e682815a07c743b63c228cc9b436a884f2fee4763460b1b7b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 88799ae848b62817d6c9f57cd15baabf
SHA1 207efd01a7d06b83fd9ff7a0874a932a562f8740
SHA256 c199b6ca47d414875ad16e2d00bf3220eb3cd1bb5954a62ebf749b567f886d12
SHA512 dfa96f54ce2dfc672ea57cc94749a57a2a19a04673cfbb5e6ecd74737ca5b662b925a280418204d62d9e55d897ac92b17d5717d6ae62567ac9cd40670ceeb9cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef7eeef881e95324aad7e7859da16f2d
SHA1 62b7c870b3210a7b8b5575f4918c48948b2d8fac
SHA256 d5cfddbdaa3f862b2392fce929c6c2c081c9373a3b271bd52a606cb4b73c0ae0
SHA512 a9b3d0d94c3be3ec8d4f0778c0103ae5e496b1104eaa2681d972055ee38492778685d0c7a83f634bf9205ae726af68965670b06c76718c23ec373e93f220c36c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 74338399f899c8c587a52add803a4420
SHA1 a96f701586f5beab808d0d6d48adf51bed36b5af
SHA256 aa068701cdb0312f8d2cf4068f768296e763e503e6778b59fbed3a9568aa76f2
SHA512 cae47d18a30a9b102e7f9f3f615e1dde3409349d1428a42a700bfebc7d20d84afd33effc56b07e06bfc06164a5c2ae4dfb611ad446e9dea6373929897ef79dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87d36131ded7f61cdd7abfab0766dab0
SHA1 d0a48da10d78c59a886472b3c455fdc26403dbca
SHA256 167dd0a30c425c495abd34a76aaad17151eddc721b9edcd5055561b6fab423de
SHA512 f8582872813a587ffabbd9c174247d9a9620ca0fcfbbb95053f16f37725d01787067b1e1f26050974f3808539493035a4a615ca057f92a051707264828440340

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6028347dc98df440ff7e77d11a6e8b9
SHA1 69ae03f0d91783de390871f181a0b0489adcb7b9
SHA256 13809e4a9b94ba83992594e345f796f984598320ec6f2a852dfc804762c5b421
SHA512 b623895ccc03eb5fce7d807fa448c49b5ee7d8f8c6d4b6e3966d2f0e23a52f0fff30c5c428b70d9108f7cb15834469ac50fbe28372b80ec100abcc33edfc026d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5e4151cac9602a669cbaa6a31f40e0d
SHA1 44c44a191894932a8bb9ab9b7ad293e521edb200
SHA256 524fc060627abdf7b0eb046b09b130b90408f0f743b5e463b4cea8ae095c8a1c
SHA512 0cd708ac358098a87b332e3449b361ef90fb3f76711023b6cd55f411c7dada41da97eab153b0ea57dfe88a90ae343f6548decd9cb43962c51358f635a6d572d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2adb5d026203d721b61c13265ef7965
SHA1 1a55a71bae97288995e3b8ddb794c39fed9dc198
SHA256 90333b156e85aa78bae765eab8b37d056ab149c309b0b06a0f0813f2e595c6f7
SHA512 c2c35c1aedc461aa2e756254a4ba354adf7d03724be90be2a59cd0656fb9d133679f104182aab81600093c25cce5973cb02419100dd999a83c6726b34588a5c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6b0d278d84ee0ddfed710a11d35b070
SHA1 df55fa0d96967146bdd5e31f31af6f8d533ef51f
SHA256 65350a3056ef9df40a94dca38a1b8e693fc2133fffa9fcfafd0cfab90d262ec8
SHA512 b47de8c40ae72c146222aa4331d95bbe108b27aa7618c736b726da9dfe9e1ed18036dd5e7b1d0e562484bc6531a4e56bab2469f5e42c42f6243b38f9f7cdd9bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e82a15ae559f80135310e83e69972a4
SHA1 add3593a7e3fe7eb7cd3a00ac89cec80436e7b27
SHA256 100037ef5b4eaacddff5504c268fc32ab164da6a08b070ce1211f207322db355
SHA512 e33246608f585d178b33607f38b2a126695d65ac0ea1a464fecbdbdeba6454c203c69e4cbf3ba3388b18d645fa0b72521d9101c7e4182f3bf659086120bd845d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 02db5ac21ba84dfe8dc59102f041bb1e
SHA1 681e6ad2d47e238f48aabb04638a02244743e7d9
SHA256 13e464d7124e312376753ffb14d296de2ad345eda6a62e4e3e8b5d6dc9c05ca1
SHA512 a1492d08e1d509755f787341551c9f2d78c9ae7cd757c3401f58b826201f5a712d64ba4bac787e6a45f663310e50b7dad2a84d125544eff5f941c572bc406c77

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e8c618004861c44a7bc81e5fac857ba3
SHA1 b8fffa70692392af93f686b9ca28ad7c53b718c3
SHA256 98da67a289b6260bdefd7f4770f64c061e0979a88fd77c9cb430893d2135b7e6
SHA512 6e622dae62bbdf508cd9f318df0b58c389004c1aa37cbbfb2fc5fd513aecbfd37718f7d62fcbb0ab49bfe9ab3888435dabf77bda3a7fa56a253d0142d1a9a1bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4223a09b1ccbc98b55398da4fd67aa8c
SHA1 b8895607b7e29dadd6a2a4cb05dbd1595b97a4c2
SHA256 4f744de1ad6899429ae0bee1b950a0726d9af31911479abc18961da6bde3d5fd
SHA512 794268cf37f6a03b02abf5ef453bf5833113189a72818dd57cfac8caed98a1252f95ca10d65a2c7bd81016dbf5ba22e816426a3d08519878d61276a239a96d8d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d9964c8f830935c124e8ae690ca493e
SHA1 c0062d1eef8053aa3b2c4ed339d45710e6302097
SHA256 a66836680772c2dd521950f859c5a21779d3923076a68f002cfb99106f509e81
SHA512 a902b6b60414321cc86db1c5cb6d66d6cec8acf44e84c5a910007690ca57b1aede08145ee009d8b51a05b8c0da9e2b0d6bc81bf1d26cbb2a0adb879026639334

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240903-en

Max time kernel

117s

Max time network

117s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 220

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 104.116.69.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

139s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 180.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

150s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Rhadamanthys family

rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1492 created 2940 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\system32\sihost.exe

Dave packer

dave
Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BGInfo.bmp" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\openwith.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\WallpaperStyle = "0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Colors\Background = "0 0 0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\TileWallpaper = "1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\ = "BGInfo Configuration File" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\shell\open\command C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\",0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\.bgi C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\.bgi\ = "BGInfo.Config.1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\shell C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\shell\open C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4384 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2924 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2924 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2924 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2924 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2924 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 1376 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 1376 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1376 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 1032 wrote to memory of 1492 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 1032 wrote to memory of 1492 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 1032 wrote to memory of 1492 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 1492 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 1492 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 1492 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 1492 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 1492 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1792,i,9270168608823720941,1720591150741300502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --field-trial-handle=2004,i,9270168608823720941,1720591150741300502,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe

"C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar

C:\Windows\SysWOW64\openwith.exe

"C:\Windows\system32\openwith.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\chrome_100_percent.pak

MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\chrome_200_percent.pak

MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\d3dcompiler_47.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\ffmpeg.dll

MD5 5a168cb3ea9d0e7400baabf60f6ab933
SHA1 82a86cb7f42294ab4ad6669c19b92605d960b676
SHA256 af5f1bc9f6a73750fa0c7bf17439700cfb3ab23e1393f0c9899825417e319b54
SHA512 7c1441ecd049543e38297a7b6929e9f3eb978422d0ce508fbe6350ffebd297f947b8d9ec75bd2054142dcd8461eef1bf110e040d0830da977fde8944bece843d

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\LICENSES.chromium.html

MD5 6ff57c0aeccdf44c39c95dee9ecea805
SHA1 c76669a1354067a1c3ddbc032e66c323286a8d43
SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
SHA512 d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\libGLESv2.dll

MD5 f055a130c79bd517bdb53b1f8a38bd3b
SHA1 9fba0ad4ba973bb285b23cc125004baf61a98b5a
SHA256 45b53759392b81ce7d916b3f1cf02be30289809bd31d09fc1524ef2609183b17
SHA512 d9dcb217f268862c577cacf4e9f84c63e02b647113d484338a74eb0b24fadd6d87b4e7a551dd1ef692bb38e44562bff848982acb62840d4f49f91a7751320e34

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\libEGL.dll

MD5 39ccf402a62f068a8c573b45ea96154d
SHA1 57ceb915ea6f88c7fcca35339bf951659c0338ab
SHA256 8649d77ace8e5753b9a10e7ae3349aafa9d8e3406ba9c8c36a59633a84b3c41b
SHA512 c4f9225c54d413176cb3dd2b26d429493fd056c7c283bc7a1c52b4a2059dbb11380daf5d847be1ff29f058ba0ef44d4bf66a3d9e9a600000dc8f6d20dfb2ed03

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\icudtl.dat

MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\vk_swiftshader.dll

MD5 6720d5dcda6737eb0cc5a352a47414dc
SHA1 03d9a8e350f485dd955f7dee06bfc46371753032
SHA256 d8f36b089d83157abc271d9fe125919c3237943fa9789a511ac5ef1d41e2e3af
SHA512 de5ade6ce14b14957fce669c4181af1e6a6f540798d1c6720b56ff281f813a6ce4446bde33a8f175d2484e07f4911f93a773cac1d372cbe3b26be634b3fa1686

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\v8_context_snapshot.bin

MD5 bf2976da5086b48d74eb36f56f5deb83
SHA1 5aa7669a3e2166fdd7534241a0e7a9bd3ff5748b
SHA256 9f1614328e18becb4adf96de98bc91ce2a69274abe6621327cc0fc8503a1ab20
SHA512 c44deeb96597b4498604ecf2060ee0520e84a00308ca1f47ffdf8e3ed3e676b27b622ff7dbd4b6f1a14ce60b05cc2ad9b8d7562bb362c1b12a885ea7fbe50e0a

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\snapshot_blob.bin

MD5 c8950b01f336b05609976546b1a007e6
SHA1 f04d0b0369007bbe6a7fe129b31b19dd1822f32f
SHA256 9b3a75a713e41bc73f219858fcac8e3031ba22732285ed3a64dc48074c725cc2
SHA512 b7db4277290e849a52ad5d31ff65ab5d2b75c2125d67eeee02b09e4e7001aa46d10bf89429c65695c7560d1c45b898c20275eb9e36cd8b259707ffb8b298f103

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\resources.pak

MD5 6772b597bf68622d934f207570e771b1
SHA1 f2a80fbfa034cb1fa07dc9aa37bf9f5b2280ff13
SHA256 268de4d99ab7c4f4ee32c8e8cb2b058a2c8d0d839f468ae8e8c0605feaa736ea
SHA512 a2be67df09951c9ef9200dcccbdff13736921522191f0001da539d5c7f26b5b26a6b810be6963908f216768c98d21e52486c7e00538cc0730e8c78e78811b85b

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\vulkan-1.dll

MD5 b6d3af84e8be0027741aa6077768789e
SHA1 e525f2434dc56f79644695f5841e91dd5f80eec4
SHA256 376ff6892ec7b406acd8c455ac82f8541e59e3757195488ff04cd9f20d554562
SHA512 f03b8792a740679c8a1a8ce0615b7876cc811130085f3ffb42182e0cb846519603804da97fc93a8abebee01e03fd257df289c54575da8faaad018f4f4bae606a

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\am.pak

MD5 e3933de22dc7fb98215b083d8a379f40
SHA1 68ddbd9bcc931f0d4a172fa65af35b823c7c9e37
SHA256 eaa747075e5a62be8b7df5908e167ccc5314c9c6a8b890059d00284a3c496fef
SHA512 7beb80fa029f41cb21536b15c604e2ae9dfc20b4a3ec4f5cc04e2b105d4b2c251830624957197084761f9686f95d332e25d4f6178509ad58257af90d96a9e7d5

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\af.pak

MD5 d9bec09b6c523dc3bca9a81264b1beed
SHA1 ea4ae9dff554c59994632f85af25b36c049fb5b2
SHA256 0b5a45de223ce8522cc296af1e93477540eaa74867428307cc3a5cd21921b022
SHA512 6e7677f86f73edffb5d6162ca19bb7464465f0f485ce2971fb20ad3f57d9fac56b7a21d378701f80e85fb185c3af6a238f8c8707f5874bffffd79d881a54dd6e

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\da.pak

MD5 43029018648d558f9bbf7a74c59eb281
SHA1 90c6618cccb4db85d7485ae8d809ec3af4763e70
SHA256 4bd88f6ab82842358987aad384775b35198dd75c2cce4cae783208ed69296a7e
SHA512 9e8ef9d4367ad01f2f4e7dd6f9884e463729ee5a0f678fd16a3ce093c21efc1d78041d5c6e45037f37bfd732e4833744485b00acfda2313a1d1e947993129a3d

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\cs.pak

MD5 92e3fd1eb47767a0cb5f6e734de4eec1
SHA1 33053bfead1fa67160b6a3c417ec4559bfdcdcfb
SHA256 d269e16fbd9b2afe95b148ece22b2ac803768fb53ee42e1fad0181f9dec84544
SHA512 916d73d9b28b0600878418a06388c2ed61bfaf17807a16e1c157a30e5da136c6b6f194e99d151c43b9aa35d101de755caa6da69e1c8a50dd134f27a7f2adc016

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ca.pak

MD5 e1ac7f4c28177f68fac3be2375a9368c
SHA1 3d7738699087468a748f9b1189d2f7621187d03b
SHA256 efa1ba906f8abce91ebb9d6442b64e0d5ae7dab78dda8a49a6fed1a342c71b9b
SHA512 aee8cb28eb02e2fb2155c8d093cf678284e3571f46b913f743de3c6d0215c18b80866ff446f46ada160860ed9c18ae9a4209424e7e0f0ba97c78a3fe9815ca5a

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\bn.pak

MD5 fc66adf3deac72fd39105540dd2daeff
SHA1 a53b54efcc1285a226d605116f87d12f69942482
SHA256 ef50cfebaf9e32edeec25d30197ac5899b3db8a0676671f639d32bc48f3b3bd8
SHA512 0b77daa056451d01a8cfb3ff1acc08d34e64e0a32bb119c8837ae3d6e3d5195311427c6101efd7e7bc9104aa369832bb12aab3d4080c00dc39edc98b6c0b949e

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\bg.pak

MD5 7c37c8c9b4215089b6c16d22838d256b
SHA1 8f2afdc21353685353a0562452f4a79180e58829
SHA256 2ebd582dfaa3139cd6a03e9892a94a3d9bb6936e0b04085b8f2d27e1dec0bc8a
SHA512 beadd70e9d706576bfb6725617385f776e9f68c84d116b01187354d377e2c860899da34f8c5a054c4bde41a57e9aac56445f6ac0b8da8c75a424641a86fdd718

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ar.pak

MD5 ac865ff462f341b4317c3d16eeb40460
SHA1 1e971d97f09884b23595f17534227ea43cf99090
SHA256 0557bc17eb1d134bd52f203836551b55579114708e2df51f653972951567513d
SHA512 a935b91a2c053303e941866cfc151f28053faf364aeece98d61fcd68fef6c6f1d3b73de01cd602c8a4a081cce452d1ce87f8166ba3c0e8b81e91d932f84737f2

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\de.pak

MD5 3a8de004b3a610271e1d1913b6d4b53b
SHA1 236893c3f7b450e6ad8b4d54e1a62b2e635b42d6
SHA256 43c060182c92caf4aebf8fd7b913dfe017beea71e796e862ebf8746575948364
SHA512 b70f849ccf7dd9e72d71522591420e0baa03ff74763b44563b0b3800ba3a88cb8b973fabb90bbb6653819947eca47f70e347958e3c31ab226957f7313bc03554

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\en-GB.pak

MD5 985558de03bf486aec1daadd39cb508d
SHA1 b693ddef983e8af212936202ddca92d908378404
SHA256 1956d448a4d333638f3601d0da976710cbe0a795504eb694ba18311fe586d195
SHA512 13d1c82b797ad4ff25a94a996f9fb52b530643a0e735f96e32b9e0698962770148d95db7beb91343d781fb84378a3e334ac0c1c913d8dbae20f425bf0dc364d3

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\en-US.pak

MD5 752a3feed3ab6c127767c8fabc9a40b6
SHA1 4af9f9c19904d3bef154b469858dc44b1e630a75
SHA256 c6a6c5d7ab6119bba712d6fe45fd385506d4d0dd8e4156cca3925062f4502ac5
SHA512 ae96d4f391e36f8f741671b72ebd4b1ab2d049b2a99b95737fb9f81743b9e414b46022b65194af5616eb354056addf0e46ef090f56b7d945ef2cb5f4d100d64f

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\el.pak

MD5 58d6eaf71b9b73f5f7f057c73d0d92ec
SHA1 16e0587753e7d2834f4cbb24fed45e7bd2f8f2f4
SHA256 8474879de21c414d34c44cf0a8c91356a66dbd647308a4f994be25bd1f93a89f
SHA512 ab24c9655bd68e4a64e257914a35dc84b5f791c58b396ae004bf5da61df19c02ef9ca572b8e63f15baf3694ae1e540adf74586f10d28d7ef90edeec982bcf28d

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\es.pak

MD5 3db06ea954c83343bd333c15947f521a
SHA1 ddde6ab9f9085e83ec8bf7a37df3389040acea42
SHA256 45df7340fe3c8560b11ffba2219de1b5c45dbfe57b6db90bd6c246244fae338a
SHA512 cc29f1075c119daddaa108c17abb6d572925cac1ed2237ed2fd45364bfb2a00c1144fccdd22c6728c954af2cdd1b9477f39968ba25354bca2b9dca07f5c53dde

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\es-419.pak

MD5 85e9b056e3ac3f6a5b113ed9f460e202
SHA1 dcceef6ea85d71a85dd24d17ec65371dce76f480
SHA256 16fe83762ed578c49685868418325920a72cd457907bc4e5264f2c172d53b27b
SHA512 e4dfde9c1260df1f77b7ec1797658f8cfeaab98142a8d512ed3bfac054933a4583f20091b97985b4ba9cf93f9faca3e7b0986cb4a3eb12fe0bc04ee1c45d3e0f

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\et.pak

MD5 8e2c2cc8c516d8b7181c0c712ca24513
SHA1 e0ccd9ed8de6640379f822a067dcf97d4bbe44a7
SHA256 c96937f46fb1b1182b201f5c48fe1da4d3f94a68a0e6e0699ccc0944cd0a5a33
SHA512 339bc655f22068f2ee9352a670325865265e4279197430214f7e3fba575415318110cccb03aed2c0e7ac673d4629bd495dc34a56cefbcaab62e1c4a1a87ed8c2

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\fa.pak

MD5 caee902136579f4bac72a6f0f75d171b
SHA1 cbbaf988a499005e21fd86652e1f48af8bce2c35
SHA256 e86f677e9654f6a16a7738e85a5a5d467a09cb18e47654f079506a00affad70c
SHA512 c0f2e8457f71789da8ce207aaae2f83196daac868fcaa7a84de04dd38730f8831b9643b8a404a7aa59c5b726da02090bba414529019f5eb9c94ac5a5af61bc9d

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\gu.pak

MD5 6c949199eaaad8fcb12c38ec6c02d758
SHA1 ce4dbd5e6a37f25354ec6849f7008956ef3568ba
SHA256 966591a74e44c75c7f0114bb8e36b0e9f5502aebdc96c714c8a8f6d45bc863c8
SHA512 3344e0083969de6f4913893a14586b441f65cb5d45f913f1cea61b8d5abbdb3b1c18a48731870282174263c1f306ed6b99c279627bd269e89cd4e15dc3d88313

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ko.pak

MD5 4b563eb612d4fadc6bd8a4c918006ab1
SHA1 4b9e414af0c044c4487d1439d23ef11b0169d308
SHA256 e0d4461452607e0f4a619efe653ec9ec39f7d34a742ae98374b2bce0b821adc9
SHA512 b8c56d69fa41ad14f7197acab1ba987ebb06c5b15748e21cec27861721545e30fb20f76f2c3a752c8ea94cca1e6b4fab7fb0727b679a8fb8e94db2d5c028e7a6

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\kn.pak

MD5 52a0707a70b939bcd75b0838a5dc5357
SHA1 eb9e1350d9d217580b1939302d008dc07c3b781c
SHA256 b177eda102b1be8c53127e3bb47970a3c1e2032be24900d8a126c5f0f077ef3d
SHA512 d5fe69035338c4308f661fa0ac25c4a811a6014f6bd85ccc7ad947f76aecf76f67208512e1266e249ec067a5fb22fb74a3550b0f3aeb1bc50fadb3a9d3cc67e4

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ja.pak

MD5 5a69547f56dc61e482dcda1ce704c5ac
SHA1 5b7bbc8e9b14d78f2105136afb7728050128c02e
SHA256 a286a5faf9021927ec09fd8cbf30ed14ad59c3baa36d29e5491ad27b957915e5
SHA512 2b9d020544201e2d0b0b44b0977fcbab858563969ce02be65689c5f5b780adc4560df523589293cd66f42903322ed61d781da093adfa44aa0681a28d97de4556

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\nb.pak

MD5 2a0ec73d03d4d7fcec71ad66cc0d4b30
SHA1 bb8df6e11b02086726ecede97d5f729f4197323c
SHA256 d44ef5e644b1b8f7c056d5e20651515fcc8565befec575091735fb39c6d63554
SHA512 cdcb4e436270156e263d731ce243d821c5361b18b6d7b8259875c9d895301d478a87feb7cafc3376d09d18d27f32dc403fd2cbd034d68736cb968bbefebd642b

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\sw.pak

MD5 a63ef2c4676dfbee98e29a84a7ad9d27
SHA1 2f0f4b33acf5e63f3159c62c74deaa9a361203f4
SHA256 7b8c51b247dea72d68cb0ef4292800c13209da6f859a9ad289c996582f19e65c
SHA512 cd65fd2c49d35757de648f21dec748fb4a1d13d2308552774fe9c859ad5748b21f5db449f8b380520f27dc868a3ebaafd58d4c45aba34033785777d342e17e6f

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\zh-TW.pak

MD5 0be25a48eecee48f428fe56fbfa683fd
SHA1 94c0e8c99beb592ebab9ea5b8758aa414bbe7048
SHA256 a5e276bdfe4cf87832eee153596ccde9cf9193e81f29a4295c8335525da64295
SHA512 423033e67654820ab9f9773f45f70908511aeb8228c59126757885e0bbe0bd960257324d405d27526d61b541b1e6323de16bef29d4dcb94f39fd5e92fa811cc8

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\resources\app.asar

MD5 f22ecb4d9ec69c266ed713cad8ea378d
SHA1 54317e92cd72895cec70a6c7a05a1a84ff692940
SHA256 e6950dcb3c57a32d89049fd7df783acf64b858c45f9bded621781977d55d7c96
SHA512 85ff75ac585da3e5565be38932ec03269af7db93084f8d8d1c45fcd298a26371841cb61c66e36062011728538514b1e42bfb7e35dea513cd82102db45854bcc9

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\zh-CN.pak

MD5 798bc7d8b63906c5b1c67e89ad17dc58
SHA1 b39c86d6d3fd9d8b8da90d86f827a0c0803fba8c
SHA256 1c05280d8dcdfe99619695b76dd054292a90c1a93a5cfb92cdc4a5b0068a7092
SHA512 7a21af438823d562b889d7c99f639421e01f0536e95f3206dd53d2c8ded82b7a4ab74bb9b4262b2fa27e50efd8dd7719827ad2e6b6d4c2e0d0811930027ed982

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\vi.pak

MD5 045241a62232bae57f1d57c6c3af7c55
SHA1 5c2a1a677a8bdfa20f3577335131bd4b89a46355
SHA256 56758c918bbfe6a9d5b20e8b4a7248bdf2d43e0bf5f98e85a9892ff03dbc2d99
SHA512 8e30af44a53a36a194da16a756dff0f90efbef164277bdcde683c89a3cdc04ae5e1298475e8a098d19dab73eb0a71637f676d49d237c5480e1f7aca1765166bb

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ur.pak

MD5 cb228cc41981e8bcbd2768da20026912
SHA1 c55bb999c4c1fbee5e38b6c986fbce2b128f3880
SHA256 a7d825fe348700528800ef9ea7940ee8027373e9c05a4e51e526d0a213c05429
SHA512 85308806be53494683f32520e181dd9c8c9abac0b92bc439d4e30eef22d4af993794a9719dd9a4eeed0bbcaf61c0e2342e7d4ed5d30b504572bd2bc269100e2e

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\uk.pak

MD5 ec3aa18a9d9c989b1025dddb0fa52b55
SHA1 ab3b0834cabee34bc2f9fd04104b10e5f9c102ca
SHA256 ee67744c26e0c69fbed8b102add339070aabc70c2d8ca9ea037c6c9d23b66d3b
SHA512 90d40424b050c6c7ace113e85b0b0a58472967c50a14fbc6637cd3b2db8ff3f521cc94dcd256fa017684256e8a9c19b158aaa57f6d3094fab970578d3b1c6847

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\tr.pak

MD5 82c6a14ba1b28f947bee67bc3feab091
SHA1 25023b22eaed29d0817ec95d5bcb4ad3d724f5ad
SHA256 099507f6f2a2c98ecce275f8ad956eeeeaada65b7788356301af04a0cd7d431e
SHA512 988a9275b7a05d100ca9242dd05969d2363a42938d47db37a1f62ec1874e96b640c14b272f1829ab5c6e0d2763c22fbf0af99894d4d9d32726925eabbc02c05e

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\th.pak

MD5 b18e4574db917920eccfb8e6900d0662
SHA1 554206b9e639135074b0946fb28b6ffe2d934159
SHA256 c14fa1bb30c880216d6cfea6fb738235cf72a3fe8be919c3d61321d5a5883211
SHA512 5f427f9ed85bb368b45bafd523c634e18596e430fdc380563878d2ca897cf2580d0405f7c0d8e10abba389bb7125978a81d335263bb777e0ee0bfe3d47c8c65f

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\te.pak

MD5 a4accc25dd8a00bc57df4fca12e41295
SHA1 9466888034c9e6ecf4113ddda63d363ed20e3156
SHA256 157d646525f6a9ac267466631671e65e9b5c3e55b008b564186e64c6853e52aa
SHA512 f19116655b6c2bb5c572b45f1d712fa1f9d57d9e8963fb3d654ed3781bd34a4e937b590bcc1119a318e28632da12a0ef8b36f6426791de833898cf7f30189567

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ta.pak

MD5 aa06ead1200f01c9460399f0abe2d54f
SHA1 9b852c4691209c0ae9edf94a5dec4b902fec7b3e
SHA256 1946d903918c57836d2f898ef93cd1d575da1a464e358c399dfde73ea2ef057e
SHA512 6e556b962c16aee22695d93b62b308d95b0695873fb33d13a147b3d8b6791c9599daa6e3bf424a1897212a018ab36dd8c8214c2eb03457048c6931686be40e04

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\sv.pak

MD5 cc0806219798e3ade0437219457a37ab
SHA1 dd6ba47e14b7b0d08159fbca2409b013dc2e17de
SHA256 79a7260c8651ff3024e21f9263543bf4e9d5f3574e81cf96edf6388f8da85cd1
SHA512 df3da02bb2fecbbaf1ab80af8ef8b1a7ae9f6c7ed01f94c5a502720376924132c344dd716fc5b4ddc03733a6c3581ed8d8a577154c619ba85c527dc67f4a48c2

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\sr.pak

MD5 abdd9eb966d915c1896b31cba0b2656b
SHA1 cb0080e5f2c168cd0f3edc6ed6c47734ffd67790
SHA256 3913d3be5016ce873ac68af376d5fcf558bb5f5f29a9bc56df0099ba47e52486
SHA512 bcb258d6da766bb6f00dfdbb03bc878000d9cf28b2b707375ce52485db9c530a34d1528a1473f09b5765bc57abd847f191bde55646eb707443cd0e40509b70e1

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\sl.pak

MD5 aa7c0f35b61a230d65e498daab67388c
SHA1 f60cb1c7128a1fb1cfd9aa029f96df36033777d0
SHA256 03afc83cdba98c08af169c8ae111aa916f3ee6d5a2fee4954ef35ecc063f2b21
SHA512 048d03c490f18d22f4900363f9c4abee037a2029f226c90806064ffedc85b07a1d86225b9c534311b08f588632a84221d7e4fa355e7b768cfdfd6102c5ffe705

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\sk.pak

MD5 b0bbb6661370d27b6600ebe98cadb9ac
SHA1 1139852da47048f15c16eb101dac86dfc8f652ba
SHA256 e0fe4130e668ac659d5334c5bc8cde70bba8742273b5965836860b5a8b1b016a
SHA512 c8eac323552f873ec088f77b8c46522387b0298b6d566cf8aa173fa9b2d66389068bb26e46044af2faa4224b39dc748164843b58b99e9dde093fcb32afb5fed0

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ru.pak

MD5 e9af20a6226511cd535888846a2bb16f
SHA1 739a46269f334ecc291bae6777f0b7c8e271e4c0
SHA256 5db640c6c288d9fc79012a7670301a3bc463359c17ba200aedaa56260ef8d955
SHA512 7897c500718382f08d55f3cddd96d1451524b5c2b8febc65e1700a645598b622c819ec66e4a21c119f044faaa525a2abdddf66d0c9800af6ecea9ceb217a88bb

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ro.pak

MD5 5db10edf772656c0808dd8da698334bf
SHA1 3caf7c9d5a3b44e06e0588daba698b6970ea06f5
SHA256 73b6a63352906d77196f38a1df937ec0770160fb7a93321867c7994ed3e7967b
SHA512 eb253b548c7f574943136764a23818f9dedea17ff42f92dc8591f4b7c297accdde9f6b2c0ad96f1fd0815c53940c0102a90c603f9f4d6d9c8fb053b559cc7a62

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\pt-PT.pak

MD5 cbe5e35f844f5f1400df3685cc847694
SHA1 e60cdb0a813a97c8548c878276bfae155350bb42
SHA256 6b9bd714d217d596183894ffed3174a617e1c8cfae292231d4b967183b589c6b
SHA512 96046c97436a3dbf5aac479b9eaa9dfdcfc81f1edcaee9cd65d59beb0ce6b6b42828e0d170aaef2ef1d68988f7916ac1dbac0d84218de83fedcca8592de4c1f1

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\pt-BR.pak

MD5 b1ab7d7aa67a7b61bfa9aebad0b812af
SHA1 95eff4be517c0a25c34578def10d48c77021de1a
SHA256 5bd503c413aaf8fa87fd47c341d437accc25397a50b082068bcf2f3bb4fb27c7
SHA512 8498fe7727771df3c1eb34560c1e25b0c30690c7c921104b4adcf04cc5753462bac513a60a5833cb6f57733201d4883605f8a4ec4a457f3ebc7c952090b1a9e1

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\pl.pak

MD5 8a4354163ff3b0978a568f781bdac289
SHA1 45de421f35af79adf962809cf8d0e6d2adbcb553
SHA256 2f6de0f9a46ae0b75beb67e09ffeee12483842a7cd6f2a2382ccbe36fbfc17e3
SHA512 5760f20228afe74e9ff2a916a168e8cc2d4a64d8e76065e61a7a60616a473c7dc3da4805125b270f179b7a0f291071e81d761d82eec3b130d552b57abd76c127

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\nl.pak

MD5 e8b790166d701f63a60c3b322fcce234
SHA1 61ec318aa8030f7d29c3258126b156d1d3eefa2c
SHA256 3d73b0110e5832b6a7c7b7e64018368464ef8552d6a98592d0adbf713eb9755e
SHA512 4e4b299cb55cbb5906ff974bb5e5078d2018298b5ee6d9ca0e40aab8db542aaedc4bd7a5db242a2c5194bc90c07631f627043dcc1a9f2d095a28c3e35f212dd9

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ms.pak

MD5 6149507c3aa99c4012d9d7cfe4bc30c8
SHA1 51a2bb5cbae64f3877afc342ea0f43915702f8f4
SHA256 dd75481d67d9be36ecb2e421117395fbb75b7623164f13a09be1cf3ce76d588f
SHA512 71f8dc03618d46be7b036353526bf20a61e648ef50adeeec057d314e9a4536899c37ef691164bf9de9e10a3867749f8d3d6f4038e16c82cf6122e7ab4a1c7732

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\mr.pak

MD5 0e5b29b6ae74a1f94ca4f880f131a79f
SHA1 6ac5089ace05847480d2aeec89954124caa781aa
SHA256 25bf8e86f7c9e88f68d4c40c4f124c16f60daf22e7a87f55ba2c560a0f640bc9
SHA512 30717c0aef4458bbcf7472316727981829edada8be3003afd9d65cb01d4cf309f601b1c41539343d6239cb2e9157554c95cf966a4156458a2fd78d2464075c98

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\ml.pak

MD5 d32a29a61e8afaba6b42d236257d9929
SHA1 9664f50ea7590a47c2eb8eb4a3e49be556d08f7a
SHA256 a59fd15c969ee8ffd7e72f5a2245c6a5a4fc048f7899fca489d78c8f6394ca1e
SHA512 2668976853b26b22859f8c20afaeb4d641845e94779b8994b49f240302420279e3f9a99666b8f551495b7d5a8c3c83609b7ecf276fabd8345cc8c787319ea3d2

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\lv.pak

MD5 00b517ce675a3089823708776c6f9302
SHA1 2bc24f150adaafd2604c5d95bbaaf8dc983d7da2
SHA256 0adedd1eaaf902feebb208220d9f21ae1b0175e74f6a966cd7ed226146d86ae8
SHA512 6c19a0d779185141fb050369f9fbfe60d0b838e55e2674e3f14a67e1a6970727e329656e458ca8516a41c97b20e67eb1789587af957129b3d32c94a3536ab12e

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\lt.pak

MD5 7cef6e31d76861db4d7d622fdd89e5aa
SHA1 31fa45c3b7666259d4d8a13518ece423a97edcca
SHA256 2f1e1c69da5cad8f47e45af0ac47cec90c20fe2897a43cb496c7feed1ec5d1ab
SHA512 df66a739f3a8da62a942b56b23f71a2b68469e87dc44eb8ce1a9a859a609f1db4bee2497defef06fa48e14cf461e61410668a5216459c94c79f4b69a3cf092f6

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\it.pak

MD5 6aa3bc3ee4999c324b82e50940e62c74
SHA1 10af8030fc2f875e133c9417e0221528160ad8b5
SHA256 73cc8422643a65753b2c3672c8f8331ee92c9bddc912576554e95b0986cf990d
SHA512 f039ef32002e55d09a4f567cc81fe2b3b329d517c985436a5da121ff0e6ac7e258b5d1fdda81e6c1578daf7078b91abcfb7da98cdba6693d4fbe7f28115e6971

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\id.pak

MD5 cfc848689a25f5e2e6ba9a06e09b6ee0
SHA1 35131e775d98a57ffcbd6a75e69f6f67437636c3
SHA256 ec1d7bbe064656dc53f70e3a612a582f5d5d0af5f0c2d6a783796cffa5bf7f57
SHA512 d5a027e35dd3846f5255b81eed36a3498ac9d809367692b2da216b5771c2d54fad35fc15c15705a2bbb4a7b35dd2245661882734998f9bc3ad8d62d2273b6577

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\hu.pak

MD5 7add28fbbba1ce87972f6433862dcbaa
SHA1 8b4b0053663c0b69beca59faca79854a89ab9c97
SHA256 dd86976d72f3cb644b90c1863e29e2f8616b09ac4acfe9301fb346fa0d87bd78
SHA512 efed0891b0202bae9396df54f141a73bb6ccadd7947330fd9e6a3a8911e9e037454238c4bd2bb9075af3218230c9e4e394f83a70878396911faa282d99fdd884

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\hr.pak

MD5 fda338824b4171b10dcc3395a549fa9f
SHA1 ea42c8b18228e0ca57b8ed7ed48e3a2aebe08486
SHA256 43f370368b322cd1236632c82aa0e231965dc58fdd497f8aeae6b40eef9ee611
SHA512 9115f805f51f45839e0a87cf44c1cce311cecaf717c0da7db3b6da85cea95f24638af29da43bc01056994b22049daa0387cd4371c13b8e5399fe8f4e38771d57

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\hi.pak

MD5 6aa92c296ed09fe2aa94dc060b25774a
SHA1 7619ed3dc5b1e04c55b0ee7280ac2d0135eb9c80
SHA256 0c771c66db4f80a62912564944c4e239f8dac8381a06483ecab512e0d75744a1
SHA512 9255a4ffef7be07ceab5dd8f46365b9a52d621ae175c1022bb4685fe4f3ea63425f45aa9ef824b467b9c33c51a7104258e888e8ec15c88fea126bf0b5337ff14

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\he.pak

MD5 16562c59fba469e1dd2f3b0b87a64645
SHA1 9a6863205fca8ea6d09a98b8e8dab543ff6198a1
SHA256 64fa2e98a9056e23c3a934ff39fef81c306cec5844d56dda17ec6c25fcdb1b5a
SHA512 dbb6e1a5e52a005386007f88b53109037792bc7b65fb95ace3e8cc5ae3ebd8320c7e406381c375bf751a9265ace84e0bbe1301d4bf3aa79200ec789dc3b3bc0b

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\fr.pak

MD5 651e4cb14c4f784d36d0a1715c52dcf3
SHA1 540f6090e3223ad8e6424a9db78305f2db9974bf
SHA256 6d547cbc3304627d14aeb138aebd40786c30a4192e071d80bcecdb77a13ac80a
SHA512 1fe93058ec434c06ef4aa1519333ebd831311971b06d7279ddc4d86dfa860bbd6ea6d127b2a07425c3e78bd6d41c11eb2a76cf25b20c6a7de74d1f0ceec87079

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\fi.pak

MD5 125a121c22dfc2b1a1c759cad9123e42
SHA1 d0282af9ec311c406ecccdfdd7216b7d883e94c3
SHA256 b733460f039dcb3795077ba91dafa3b9b8163dfd0f15168b250630f7de21ed0a
SHA512 c6e0ea8fab8115a632d4c74141efc46ea546f43e0b806d5bd95a1ecd3b8fe37a44565a2f79c43e0bc50dbdadc5d16054e07485fad83c99bd3550a907c852e724

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\7z-out\locales\fil.pak

MD5 eaf43729e9bbd8004ef1ff56a3d85a48
SHA1 34b31ab8ea2ce6bd263f00acc50d5af8d0222d9a
SHA256 8559cc35335bb2c249297f4c7506df95cef899ef5f7ad942d2d511ae074d41b0
SHA512 010f8e5c3b969be0db4baec3acffdd69be25662387968e15e11af0da68ec2f45dc9edb83cafe7c92234e1e4e4aae1682223235af04d99e8b5238379e022e3d35

C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\a235b041-df89-4372-a0ff-153adbd2c0ac.tmp.exe

MD5 3aef228fb7ee187160482084d36c9726
SHA1 8b76990c5061890c94f81f504c5782912a58d8a6
SHA256 c885df88693496d5c28ad16a1ecde259e191f54ad76428857742af843b846c53
SHA512 e659a7cf12c6b41879e4ce987e4cd1cefce2ffc74e06817667fa833764f36f25cc5f8374dbc844b68b787acac011c7b8c8f2b74563bf8a96f623ebb110a593da

memory/1492-852-0x0000000001780000-0x0000000001B80000-memory.dmp

memory/1492-851-0x0000000000DF0000-0x0000000000DF9000-memory.dmp

memory/1492-854-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

memory/4816-857-0x0000000000B70000-0x0000000000B79000-memory.dmp

memory/1492-856-0x0000000075980000-0x0000000075B95000-memory.dmp

memory/1492-853-0x0000000001780000-0x0000000001B80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\encrypted_shellcode.bin

MD5 9827ae88a9588b26de69046117d21c81
SHA1 c591b24672b8509dbdc087fc245a1f7fea3b1d9b
SHA256 3560f325b7a2c0918910bddd6462adef786270959e765069fc6dc3320f3180a6
SHA512 66c1f90a4a9dd2b31f9ee3e1049620bcec5bfc644546d4e18b651bc79b45e58a73e82d676dcb34819e59735b3d92163e80b9b1311285f6f452f97020439497c6

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\version.dll

MD5 f8e8df746881bb6c15c61fee344b12ff
SHA1 6f5d6bbea6b3ef8f931fc18b51d0fdffa6367430
SHA256 4ec7e1ee6c2080e341c2a94d90af71d17d1f8f38bab8fc556219d11a79fabf85
SHA512 dc231aacd9e754192ca160823b465c9cb9ea3c9bbe35cf485428c2266c8112a292d05db7942d1ced210c072d71036a42777533359e7f34881bf0038940bfe309

memory/4816-859-0x0000000002940000-0x0000000002D40000-memory.dmp

memory/4816-860-0x00007FFC14C10000-0x00007FFC14E05000-memory.dmp

memory/4816-862-0x0000000075980000-0x0000000075B95000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

157s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Rhadamanthys family

rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3968 created 2552 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\system32\sihost.exe

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BGInfo.bmp" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\openwith.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\TileWallpaper = "1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Colors\Background = "0 0 0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\BGInfo.Config.1 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\BGInfo.Config.1\shell\open\command C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\BGInfo.Config.1\shell\open C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\BGInfo.Config.1\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\BGInfo.Config.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\",0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.bgi C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.bgi\ = "BGInfo.Config.1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\BGInfo.Config.1\ = "BGInfo Configuration File" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\BGInfo.Config.1\shell C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\BGInfo.Config.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2692 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 4068 wrote to memory of 3968 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 4068 wrote to memory of 3968 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 4068 wrote to memory of 3968 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 3968 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3968 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3968 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3968 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3968 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1756,i,10513368513173435155,16614304210336362562,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar"

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --field-trial-handle=1960,i,10513368513173435155,16614304210336362562,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe

"C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar

C:\Windows\SysWOW64\openwith.exe

"C:\Windows\system32\openwith.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\c56d3e49-79e8-4355-ad8f-9e902ed7a5f0.tmp.exe

MD5 3aef228fb7ee187160482084d36c9726
SHA1 8b76990c5061890c94f81f504c5782912a58d8a6
SHA256 c885df88693496d5c28ad16a1ecde259e191f54ad76428857742af843b846c53
SHA512 e659a7cf12c6b41879e4ce987e4cd1cefce2ffc74e06817667fa833764f36f25cc5f8374dbc844b68b787acac011c7b8c8f2b74563bf8a96f623ebb110a593da

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\VERSION.dll

MD5 f8e8df746881bb6c15c61fee344b12ff
SHA1 6f5d6bbea6b3ef8f931fc18b51d0fdffa6367430
SHA256 4ec7e1ee6c2080e341c2a94d90af71d17d1f8f38bab8fc556219d11a79fabf85
SHA512 dc231aacd9e754192ca160823b465c9cb9ea3c9bbe35cf485428c2266c8112a292d05db7942d1ced210c072d71036a42777533359e7f34881bf0038940bfe309

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\encrypted_shellcode.bin

MD5 9827ae88a9588b26de69046117d21c81
SHA1 c591b24672b8509dbdc087fc245a1f7fea3b1d9b
SHA256 3560f325b7a2c0918910bddd6462adef786270959e765069fc6dc3320f3180a6
SHA512 66c1f90a4a9dd2b31f9ee3e1049620bcec5bfc644546d4e18b651bc79b45e58a73e82d676dcb34819e59735b3d92163e80b9b1311285f6f452f97020439497c6

memory/3968-112-0x0000000000DD0000-0x0000000000DD9000-memory.dmp

memory/3968-113-0x00000000011F0000-0x00000000015F0000-memory.dmp

memory/3968-114-0x00000000011F0000-0x00000000015F0000-memory.dmp

memory/3968-115-0x00007FFFCA430000-0x00007FFFCA625000-memory.dmp

memory/3968-117-0x00000000773F0000-0x0000000077605000-memory.dmp

memory/1028-118-0x00000000006A0000-0x00000000006A9000-memory.dmp

memory/1028-120-0x0000000002340000-0x0000000002740000-memory.dmp

memory/1028-123-0x00000000773F0000-0x0000000077605000-memory.dmp

memory/1028-121-0x00007FFFCA430000-0x00007FFFCA625000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240903-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 220

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1936 wrote to memory of 4924 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1936 wrote to memory of 4924 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1936 wrote to memory of 4924 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4924 -ip 4924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240903-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3504 wrote to memory of 1504 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3504 wrote to memory of 1504 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3504 wrote to memory of 1504 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1504 -ip 1504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20241010-en

Max time kernel

119s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 220

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240903-en

Max time kernel

120s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2540 wrote to memory of 2132 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2540 wrote to memory of 2132 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2540 wrote to memory of 2132 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2540 wrote to memory of 2132 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2540 wrote to memory of 2132 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2540 wrote to memory of 2132 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2540 wrote to memory of 2132 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

136s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4980 wrote to memory of 712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4980 wrote to memory of 712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4980 wrote to memory of 712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1556 wrote to memory of 1576 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1556 wrote to memory of 1576 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1556 wrote to memory of 1576 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1576 -ip 1576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 640

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

141s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2684 wrote to memory of 1348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2684 wrote to memory of 1348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2684 wrote to memory of 1348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1348 -ip 1348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2076 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2076 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2076 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2076 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2344 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2680 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2680 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2680 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2680 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2680 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2680 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2680 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2680 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

MD5 3fe065f3111d58d008fb8eb403a11a7c
SHA1 74ee9374e92cec677f39326d58b5f740b438cf10
SHA256 3866f85e7e0524bc2b5b43315da8e721b0e031ece4462329cab4892756abcebf
SHA512 e314110fba7203dca4ca71e75330c578889e3a01288be0dc1b04eba311b231199ffbe89a4cbbe58531b52c042b801dcb12fbe9e9f19e1427228007dfd6cd7ee7

\Users\Admin\AppData\Local\Temp\nsy871B.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsy871B.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nsy871B.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nsy871B.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Analysis: behavioral29

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 996 wrote to memory of 3936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 996 wrote to memory of 3936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 996 wrote to memory of 3936 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3936 -ip 3936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1016 wrote to memory of 4912 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1016 wrote to memory of 4912 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1016 wrote to memory of 4912 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4912 -ip 4912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

Signatures

Dave packer

dave
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe N/A

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2316 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2316 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2316 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2316 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2760 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2760 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2760 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2760 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2760 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2760 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2760 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nst954E.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nst954E.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nst954E.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nst954E.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nst954E.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\chrome_100_percent.pak

MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\chrome_200_percent.pak

MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\d3dcompiler_47.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\ffmpeg.dll

MD5 5a168cb3ea9d0e7400baabf60f6ab933
SHA1 82a86cb7f42294ab4ad6669c19b92605d960b676
SHA256 af5f1bc9f6a73750fa0c7bf17439700cfb3ab23e1393f0c9899825417e319b54
SHA512 7c1441ecd049543e38297a7b6929e9f3eb978422d0ce508fbe6350ffebd297f947b8d9ec75bd2054142dcd8461eef1bf110e040d0830da977fde8944bece843d

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\icudtl.dat

MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\libEGL.dll

MD5 39ccf402a62f068a8c573b45ea96154d
SHA1 57ceb915ea6f88c7fcca35339bf951659c0338ab
SHA256 8649d77ace8e5753b9a10e7ae3349aafa9d8e3406ba9c8c36a59633a84b3c41b
SHA512 c4f9225c54d413176cb3dd2b26d429493fd056c7c283bc7a1c52b4a2059dbb11380daf5d847be1ff29f058ba0ef44d4bf66a3d9e9a600000dc8f6d20dfb2ed03

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\libGLESv2.dll

MD5 f055a130c79bd517bdb53b1f8a38bd3b
SHA1 9fba0ad4ba973bb285b23cc125004baf61a98b5a
SHA256 45b53759392b81ce7d916b3f1cf02be30289809bd31d09fc1524ef2609183b17
SHA512 d9dcb217f268862c577cacf4e9f84c63e02b647113d484338a74eb0b24fadd6d87b4e7a551dd1ef692bb38e44562bff848982acb62840d4f49f91a7751320e34

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\LICENSES.chromium.html

MD5 6ff57c0aeccdf44c39c95dee9ecea805
SHA1 c76669a1354067a1c3ddbc032e66c323286a8d43
SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
SHA512 d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\resources.pak

MD5 6772b597bf68622d934f207570e771b1
SHA1 f2a80fbfa034cb1fa07dc9aa37bf9f5b2280ff13
SHA256 268de4d99ab7c4f4ee32c8e8cb2b058a2c8d0d839f468ae8e8c0605feaa736ea
SHA512 a2be67df09951c9ef9200dcccbdff13736921522191f0001da539d5c7f26b5b26a6b810be6963908f216768c98d21e52486c7e00538cc0730e8c78e78811b85b

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\snapshot_blob.bin

MD5 c8950b01f336b05609976546b1a007e6
SHA1 f04d0b0369007bbe6a7fe129b31b19dd1822f32f
SHA256 9b3a75a713e41bc73f219858fcac8e3031ba22732285ed3a64dc48074c725cc2
SHA512 b7db4277290e849a52ad5d31ff65ab5d2b75c2125d67eeee02b09e4e7001aa46d10bf89429c65695c7560d1c45b898c20275eb9e36cd8b259707ffb8b298f103

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\v8_context_snapshot.bin

MD5 bf2976da5086b48d74eb36f56f5deb83
SHA1 5aa7669a3e2166fdd7534241a0e7a9bd3ff5748b
SHA256 9f1614328e18becb4adf96de98bc91ce2a69274abe6621327cc0fc8503a1ab20
SHA512 c44deeb96597b4498604ecf2060ee0520e84a00308ca1f47ffdf8e3ed3e676b27b622ff7dbd4b6f1a14ce60b05cc2ad9b8d7562bb362c1b12a885ea7fbe50e0a

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\vulkan-1.dll

MD5 b6d3af84e8be0027741aa6077768789e
SHA1 e525f2434dc56f79644695f5841e91dd5f80eec4
SHA256 376ff6892ec7b406acd8c455ac82f8541e59e3757195488ff04cd9f20d554562
SHA512 f03b8792a740679c8a1a8ce0615b7876cc811130085f3ffb42182e0cb846519603804da97fc93a8abebee01e03fd257df289c54575da8faaad018f4f4bae606a

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\vk_swiftshader.dll

MD5 6720d5dcda6737eb0cc5a352a47414dc
SHA1 03d9a8e350f485dd955f7dee06bfc46371753032
SHA256 d8f36b089d83157abc271d9fe125919c3237943fa9789a511ac5ef1d41e2e3af
SHA512 de5ade6ce14b14957fce669c4181af1e6a6f540798d1c6720b56ff281f813a6ce4446bde33a8f175d2484e07f4911f93a773cac1d372cbe3b26be634b3fa1686

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\am.pak

MD5 e3933de22dc7fb98215b083d8a379f40
SHA1 68ddbd9bcc931f0d4a172fa65af35b823c7c9e37
SHA256 eaa747075e5a62be8b7df5908e167ccc5314c9c6a8b890059d00284a3c496fef
SHA512 7beb80fa029f41cb21536b15c604e2ae9dfc20b4a3ec4f5cc04e2b105d4b2c251830624957197084761f9686f95d332e25d4f6178509ad58257af90d96a9e7d5

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\af.pak

MD5 d9bec09b6c523dc3bca9a81264b1beed
SHA1 ea4ae9dff554c59994632f85af25b36c049fb5b2
SHA256 0b5a45de223ce8522cc296af1e93477540eaa74867428307cc3a5cd21921b022
SHA512 6e7677f86f73edffb5d6162ca19bb7464465f0f485ce2971fb20ad3f57d9fac56b7a21d378701f80e85fb185c3af6a238f8c8707f5874bffffd79d881a54dd6e

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ar.pak

MD5 ac865ff462f341b4317c3d16eeb40460
SHA1 1e971d97f09884b23595f17534227ea43cf99090
SHA256 0557bc17eb1d134bd52f203836551b55579114708e2df51f653972951567513d
SHA512 a935b91a2c053303e941866cfc151f28053faf364aeece98d61fcd68fef6c6f1d3b73de01cd602c8a4a081cce452d1ce87f8166ba3c0e8b81e91d932f84737f2

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\bg.pak

MD5 7c37c8c9b4215089b6c16d22838d256b
SHA1 8f2afdc21353685353a0562452f4a79180e58829
SHA256 2ebd582dfaa3139cd6a03e9892a94a3d9bb6936e0b04085b8f2d27e1dec0bc8a
SHA512 beadd70e9d706576bfb6725617385f776e9f68c84d116b01187354d377e2c860899da34f8c5a054c4bde41a57e9aac56445f6ac0b8da8c75a424641a86fdd718

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ca.pak

MD5 e1ac7f4c28177f68fac3be2375a9368c
SHA1 3d7738699087468a748f9b1189d2f7621187d03b
SHA256 efa1ba906f8abce91ebb9d6442b64e0d5ae7dab78dda8a49a6fed1a342c71b9b
SHA512 aee8cb28eb02e2fb2155c8d093cf678284e3571f46b913f743de3c6d0215c18b80866ff446f46ada160860ed9c18ae9a4209424e7e0f0ba97c78a3fe9815ca5a

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\cs.pak

MD5 92e3fd1eb47767a0cb5f6e734de4eec1
SHA1 33053bfead1fa67160b6a3c417ec4559bfdcdcfb
SHA256 d269e16fbd9b2afe95b148ece22b2ac803768fb53ee42e1fad0181f9dec84544
SHA512 916d73d9b28b0600878418a06388c2ed61bfaf17807a16e1c157a30e5da136c6b6f194e99d151c43b9aa35d101de755caa6da69e1c8a50dd134f27a7f2adc016

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\de.pak

MD5 3a8de004b3a610271e1d1913b6d4b53b
SHA1 236893c3f7b450e6ad8b4d54e1a62b2e635b42d6
SHA256 43c060182c92caf4aebf8fd7b913dfe017beea71e796e862ebf8746575948364
SHA512 b70f849ccf7dd9e72d71522591420e0baa03ff74763b44563b0b3800ba3a88cb8b973fabb90bbb6653819947eca47f70e347958e3c31ab226957f7313bc03554

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\el.pak

MD5 58d6eaf71b9b73f5f7f057c73d0d92ec
SHA1 16e0587753e7d2834f4cbb24fed45e7bd2f8f2f4
SHA256 8474879de21c414d34c44cf0a8c91356a66dbd647308a4f994be25bd1f93a89f
SHA512 ab24c9655bd68e4a64e257914a35dc84b5f791c58b396ae004bf5da61df19c02ef9ca572b8e63f15baf3694ae1e540adf74586f10d28d7ef90edeec982bcf28d

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\es-419.pak

MD5 85e9b056e3ac3f6a5b113ed9f460e202
SHA1 dcceef6ea85d71a85dd24d17ec65371dce76f480
SHA256 16fe83762ed578c49685868418325920a72cd457907bc4e5264f2c172d53b27b
SHA512 e4dfde9c1260df1f77b7ec1797658f8cfeaab98142a8d512ed3bfac054933a4583f20091b97985b4ba9cf93f9faca3e7b0986cb4a3eb12fe0bc04ee1c45d3e0f

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\et.pak

MD5 8e2c2cc8c516d8b7181c0c712ca24513
SHA1 e0ccd9ed8de6640379f822a067dcf97d4bbe44a7
SHA256 c96937f46fb1b1182b201f5c48fe1da4d3f94a68a0e6e0699ccc0944cd0a5a33
SHA512 339bc655f22068f2ee9352a670325865265e4279197430214f7e3fba575415318110cccb03aed2c0e7ac673d4629bd495dc34a56cefbcaab62e1c4a1a87ed8c2

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\fa.pak

MD5 caee902136579f4bac72a6f0f75d171b
SHA1 cbbaf988a499005e21fd86652e1f48af8bce2c35
SHA256 e86f677e9654f6a16a7738e85a5a5d467a09cb18e47654f079506a00affad70c
SHA512 c0f2e8457f71789da8ce207aaae2f83196daac868fcaa7a84de04dd38730f8831b9643b8a404a7aa59c5b726da02090bba414529019f5eb9c94ac5a5af61bc9d

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\fr.pak

MD5 651e4cb14c4f784d36d0a1715c52dcf3
SHA1 540f6090e3223ad8e6424a9db78305f2db9974bf
SHA256 6d547cbc3304627d14aeb138aebd40786c30a4192e071d80bcecdb77a13ac80a
SHA512 1fe93058ec434c06ef4aa1519333ebd831311971b06d7279ddc4d86dfa860bbd6ea6d127b2a07425c3e78bd6d41c11eb2a76cf25b20c6a7de74d1f0ceec87079

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\he.pak

MD5 16562c59fba469e1dd2f3b0b87a64645
SHA1 9a6863205fca8ea6d09a98b8e8dab543ff6198a1
SHA256 64fa2e98a9056e23c3a934ff39fef81c306cec5844d56dda17ec6c25fcdb1b5a
SHA512 dbb6e1a5e52a005386007f88b53109037792bc7b65fb95ace3e8cc5ae3ebd8320c7e406381c375bf751a9265ace84e0bbe1301d4bf3aa79200ec789dc3b3bc0b

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\hu.pak

MD5 7add28fbbba1ce87972f6433862dcbaa
SHA1 8b4b0053663c0b69beca59faca79854a89ab9c97
SHA256 dd86976d72f3cb644b90c1863e29e2f8616b09ac4acfe9301fb346fa0d87bd78
SHA512 efed0891b0202bae9396df54f141a73bb6ccadd7947330fd9e6a3a8911e9e037454238c4bd2bb9075af3218230c9e4e394f83a70878396911faa282d99fdd884

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\lv.pak

MD5 00b517ce675a3089823708776c6f9302
SHA1 2bc24f150adaafd2604c5d95bbaaf8dc983d7da2
SHA256 0adedd1eaaf902feebb208220d9f21ae1b0175e74f6a966cd7ed226146d86ae8
SHA512 6c19a0d779185141fb050369f9fbfe60d0b838e55e2674e3f14a67e1a6970727e329656e458ca8516a41c97b20e67eb1789587af957129b3d32c94a3536ab12e

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\nl.pak

MD5 e8b790166d701f63a60c3b322fcce234
SHA1 61ec318aa8030f7d29c3258126b156d1d3eefa2c
SHA256 3d73b0110e5832b6a7c7b7e64018368464ef8552d6a98592d0adbf713eb9755e
SHA512 4e4b299cb55cbb5906ff974bb5e5078d2018298b5ee6d9ca0e40aab8db542aaedc4bd7a5db242a2c5194bc90c07631f627043dcc1a9f2d095a28c3e35f212dd9

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\th.pak

MD5 b18e4574db917920eccfb8e6900d0662
SHA1 554206b9e639135074b0946fb28b6ffe2d934159
SHA256 c14fa1bb30c880216d6cfea6fb738235cf72a3fe8be919c3d61321d5a5883211
SHA512 5f427f9ed85bb368b45bafd523c634e18596e430fdc380563878d2ca897cf2580d0405f7c0d8e10abba389bb7125978a81d335263bb777e0ee0bfe3d47c8c65f

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\resources\app.asar

MD5 f22ecb4d9ec69c266ed713cad8ea378d
SHA1 54317e92cd72895cec70a6c7a05a1a84ff692940
SHA256 e6950dcb3c57a32d89049fd7df783acf64b858c45f9bded621781977d55d7c96
SHA512 85ff75ac585da3e5565be38932ec03269af7db93084f8d8d1c45fcd298a26371841cb61c66e36062011728538514b1e42bfb7e35dea513cd82102db45854bcc9

\Users\Admin\AppData\Local\Temp\nst954E.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\zh-TW.pak

MD5 0be25a48eecee48f428fe56fbfa683fd
SHA1 94c0e8c99beb592ebab9ea5b8758aa414bbe7048
SHA256 a5e276bdfe4cf87832eee153596ccde9cf9193e81f29a4295c8335525da64295
SHA512 423033e67654820ab9f9773f45f70908511aeb8228c59126757885e0bbe0bd960257324d405d27526d61b541b1e6323de16bef29d4dcb94f39fd5e92fa811cc8

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\zh-CN.pak

MD5 798bc7d8b63906c5b1c67e89ad17dc58
SHA1 b39c86d6d3fd9d8b8da90d86f827a0c0803fba8c
SHA256 1c05280d8dcdfe99619695b76dd054292a90c1a93a5cfb92cdc4a5b0068a7092
SHA512 7a21af438823d562b889d7c99f639421e01f0536e95f3206dd53d2c8ded82b7a4ab74bb9b4262b2fa27e50efd8dd7719827ad2e6b6d4c2e0d0811930027ed982

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\vi.pak

MD5 045241a62232bae57f1d57c6c3af7c55
SHA1 5c2a1a677a8bdfa20f3577335131bd4b89a46355
SHA256 56758c918bbfe6a9d5b20e8b4a7248bdf2d43e0bf5f98e85a9892ff03dbc2d99
SHA512 8e30af44a53a36a194da16a756dff0f90efbef164277bdcde683c89a3cdc04ae5e1298475e8a098d19dab73eb0a71637f676d49d237c5480e1f7aca1765166bb

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ur.pak

MD5 cb228cc41981e8bcbd2768da20026912
SHA1 c55bb999c4c1fbee5e38b6c986fbce2b128f3880
SHA256 a7d825fe348700528800ef9ea7940ee8027373e9c05a4e51e526d0a213c05429
SHA512 85308806be53494683f32520e181dd9c8c9abac0b92bc439d4e30eef22d4af993794a9719dd9a4eeed0bbcaf61c0e2342e7d4ed5d30b504572bd2bc269100e2e

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\uk.pak

MD5 ec3aa18a9d9c989b1025dddb0fa52b55
SHA1 ab3b0834cabee34bc2f9fd04104b10e5f9c102ca
SHA256 ee67744c26e0c69fbed8b102add339070aabc70c2d8ca9ea037c6c9d23b66d3b
SHA512 90d40424b050c6c7ace113e85b0b0a58472967c50a14fbc6637cd3b2db8ff3f521cc94dcd256fa017684256e8a9c19b158aaa57f6d3094fab970578d3b1c6847

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\tr.pak

MD5 82c6a14ba1b28f947bee67bc3feab091
SHA1 25023b22eaed29d0817ec95d5bcb4ad3d724f5ad
SHA256 099507f6f2a2c98ecce275f8ad956eeeeaada65b7788356301af04a0cd7d431e
SHA512 988a9275b7a05d100ca9242dd05969d2363a42938d47db37a1f62ec1874e96b640c14b272f1829ab5c6e0d2763c22fbf0af99894d4d9d32726925eabbc02c05e

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\te.pak

MD5 a4accc25dd8a00bc57df4fca12e41295
SHA1 9466888034c9e6ecf4113ddda63d363ed20e3156
SHA256 157d646525f6a9ac267466631671e65e9b5c3e55b008b564186e64c6853e52aa
SHA512 f19116655b6c2bb5c572b45f1d712fa1f9d57d9e8963fb3d654ed3781bd34a4e937b590bcc1119a318e28632da12a0ef8b36f6426791de833898cf7f30189567

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ta.pak

MD5 aa06ead1200f01c9460399f0abe2d54f
SHA1 9b852c4691209c0ae9edf94a5dec4b902fec7b3e
SHA256 1946d903918c57836d2f898ef93cd1d575da1a464e358c399dfde73ea2ef057e
SHA512 6e556b962c16aee22695d93b62b308d95b0695873fb33d13a147b3d8b6791c9599daa6e3bf424a1897212a018ab36dd8c8214c2eb03457048c6931686be40e04

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\sw.pak

MD5 a63ef2c4676dfbee98e29a84a7ad9d27
SHA1 2f0f4b33acf5e63f3159c62c74deaa9a361203f4
SHA256 7b8c51b247dea72d68cb0ef4292800c13209da6f859a9ad289c996582f19e65c
SHA512 cd65fd2c49d35757de648f21dec748fb4a1d13d2308552774fe9c859ad5748b21f5db449f8b380520f27dc868a3ebaafd58d4c45aba34033785777d342e17e6f

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\sv.pak

MD5 cc0806219798e3ade0437219457a37ab
SHA1 dd6ba47e14b7b0d08159fbca2409b013dc2e17de
SHA256 79a7260c8651ff3024e21f9263543bf4e9d5f3574e81cf96edf6388f8da85cd1
SHA512 df3da02bb2fecbbaf1ab80af8ef8b1a7ae9f6c7ed01f94c5a502720376924132c344dd716fc5b4ddc03733a6c3581ed8d8a577154c619ba85c527dc67f4a48c2

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\sr.pak

MD5 abdd9eb966d915c1896b31cba0b2656b
SHA1 cb0080e5f2c168cd0f3edc6ed6c47734ffd67790
SHA256 3913d3be5016ce873ac68af376d5fcf558bb5f5f29a9bc56df0099ba47e52486
SHA512 bcb258d6da766bb6f00dfdbb03bc878000d9cf28b2b707375ce52485db9c530a34d1528a1473f09b5765bc57abd847f191bde55646eb707443cd0e40509b70e1

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\sl.pak

MD5 aa7c0f35b61a230d65e498daab67388c
SHA1 f60cb1c7128a1fb1cfd9aa029f96df36033777d0
SHA256 03afc83cdba98c08af169c8ae111aa916f3ee6d5a2fee4954ef35ecc063f2b21
SHA512 048d03c490f18d22f4900363f9c4abee037a2029f226c90806064ffedc85b07a1d86225b9c534311b08f588632a84221d7e4fa355e7b768cfdfd6102c5ffe705

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\sk.pak

MD5 b0bbb6661370d27b6600ebe98cadb9ac
SHA1 1139852da47048f15c16eb101dac86dfc8f652ba
SHA256 e0fe4130e668ac659d5334c5bc8cde70bba8742273b5965836860b5a8b1b016a
SHA512 c8eac323552f873ec088f77b8c46522387b0298b6d566cf8aa173fa9b2d66389068bb26e46044af2faa4224b39dc748164843b58b99e9dde093fcb32afb5fed0

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ru.pak

MD5 e9af20a6226511cd535888846a2bb16f
SHA1 739a46269f334ecc291bae6777f0b7c8e271e4c0
SHA256 5db640c6c288d9fc79012a7670301a3bc463359c17ba200aedaa56260ef8d955
SHA512 7897c500718382f08d55f3cddd96d1451524b5c2b8febc65e1700a645598b622c819ec66e4a21c119f044faaa525a2abdddf66d0c9800af6ecea9ceb217a88bb

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ro.pak

MD5 5db10edf772656c0808dd8da698334bf
SHA1 3caf7c9d5a3b44e06e0588daba698b6970ea06f5
SHA256 73b6a63352906d77196f38a1df937ec0770160fb7a93321867c7994ed3e7967b
SHA512 eb253b548c7f574943136764a23818f9dedea17ff42f92dc8591f4b7c297accdde9f6b2c0ad96f1fd0815c53940c0102a90c603f9f4d6d9c8fb053b559cc7a62

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\pt-PT.pak

MD5 cbe5e35f844f5f1400df3685cc847694
SHA1 e60cdb0a813a97c8548c878276bfae155350bb42
SHA256 6b9bd714d217d596183894ffed3174a617e1c8cfae292231d4b967183b589c6b
SHA512 96046c97436a3dbf5aac479b9eaa9dfdcfc81f1edcaee9cd65d59beb0ce6b6b42828e0d170aaef2ef1d68988f7916ac1dbac0d84218de83fedcca8592de4c1f1

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\pt-BR.pak

MD5 b1ab7d7aa67a7b61bfa9aebad0b812af
SHA1 95eff4be517c0a25c34578def10d48c77021de1a
SHA256 5bd503c413aaf8fa87fd47c341d437accc25397a50b082068bcf2f3bb4fb27c7
SHA512 8498fe7727771df3c1eb34560c1e25b0c30690c7c921104b4adcf04cc5753462bac513a60a5833cb6f57733201d4883605f8a4ec4a457f3ebc7c952090b1a9e1

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\pl.pak

MD5 8a4354163ff3b0978a568f781bdac289
SHA1 45de421f35af79adf962809cf8d0e6d2adbcb553
SHA256 2f6de0f9a46ae0b75beb67e09ffeee12483842a7cd6f2a2382ccbe36fbfc17e3
SHA512 5760f20228afe74e9ff2a916a168e8cc2d4a64d8e76065e61a7a60616a473c7dc3da4805125b270f179b7a0f291071e81d761d82eec3b130d552b57abd76c127

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\nb.pak

MD5 2a0ec73d03d4d7fcec71ad66cc0d4b30
SHA1 bb8df6e11b02086726ecede97d5f729f4197323c
SHA256 d44ef5e644b1b8f7c056d5e20651515fcc8565befec575091735fb39c6d63554
SHA512 cdcb4e436270156e263d731ce243d821c5361b18b6d7b8259875c9d895301d478a87feb7cafc3376d09d18d27f32dc403fd2cbd034d68736cb968bbefebd642b

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ms.pak

MD5 6149507c3aa99c4012d9d7cfe4bc30c8
SHA1 51a2bb5cbae64f3877afc342ea0f43915702f8f4
SHA256 dd75481d67d9be36ecb2e421117395fbb75b7623164f13a09be1cf3ce76d588f
SHA512 71f8dc03618d46be7b036353526bf20a61e648ef50adeeec057d314e9a4536899c37ef691164bf9de9e10a3867749f8d3d6f4038e16c82cf6122e7ab4a1c7732

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\mr.pak

MD5 0e5b29b6ae74a1f94ca4f880f131a79f
SHA1 6ac5089ace05847480d2aeec89954124caa781aa
SHA256 25bf8e86f7c9e88f68d4c40c4f124c16f60daf22e7a87f55ba2c560a0f640bc9
SHA512 30717c0aef4458bbcf7472316727981829edada8be3003afd9d65cb01d4cf309f601b1c41539343d6239cb2e9157554c95cf966a4156458a2fd78d2464075c98

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ml.pak

MD5 d32a29a61e8afaba6b42d236257d9929
SHA1 9664f50ea7590a47c2eb8eb4a3e49be556d08f7a
SHA256 a59fd15c969ee8ffd7e72f5a2245c6a5a4fc048f7899fca489d78c8f6394ca1e
SHA512 2668976853b26b22859f8c20afaeb4d641845e94779b8994b49f240302420279e3f9a99666b8f551495b7d5a8c3c83609b7ecf276fabd8345cc8c787319ea3d2

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\lt.pak

MD5 7cef6e31d76861db4d7d622fdd89e5aa
SHA1 31fa45c3b7666259d4d8a13518ece423a97edcca
SHA256 2f1e1c69da5cad8f47e45af0ac47cec90c20fe2897a43cb496c7feed1ec5d1ab
SHA512 df66a739f3a8da62a942b56b23f71a2b68469e87dc44eb8ce1a9a859a609f1db4bee2497defef06fa48e14cf461e61410668a5216459c94c79f4b69a3cf092f6

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ko.pak

MD5 4b563eb612d4fadc6bd8a4c918006ab1
SHA1 4b9e414af0c044c4487d1439d23ef11b0169d308
SHA256 e0d4461452607e0f4a619efe653ec9ec39f7d34a742ae98374b2bce0b821adc9
SHA512 b8c56d69fa41ad14f7197acab1ba987ebb06c5b15748e21cec27861721545e30fb20f76f2c3a752c8ea94cca1e6b4fab7fb0727b679a8fb8e94db2d5c028e7a6

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\kn.pak

MD5 52a0707a70b939bcd75b0838a5dc5357
SHA1 eb9e1350d9d217580b1939302d008dc07c3b781c
SHA256 b177eda102b1be8c53127e3bb47970a3c1e2032be24900d8a126c5f0f077ef3d
SHA512 d5fe69035338c4308f661fa0ac25c4a811a6014f6bd85ccc7ad947f76aecf76f67208512e1266e249ec067a5fb22fb74a3550b0f3aeb1bc50fadb3a9d3cc67e4

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\ja.pak

MD5 5a69547f56dc61e482dcda1ce704c5ac
SHA1 5b7bbc8e9b14d78f2105136afb7728050128c02e
SHA256 a286a5faf9021927ec09fd8cbf30ed14ad59c3baa36d29e5491ad27b957915e5
SHA512 2b9d020544201e2d0b0b44b0977fcbab858563969ce02be65689c5f5b780adc4560df523589293cd66f42903322ed61d781da093adfa44aa0681a28d97de4556

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\it.pak

MD5 6aa3bc3ee4999c324b82e50940e62c74
SHA1 10af8030fc2f875e133c9417e0221528160ad8b5
SHA256 73cc8422643a65753b2c3672c8f8331ee92c9bddc912576554e95b0986cf990d
SHA512 f039ef32002e55d09a4f567cc81fe2b3b329d517c985436a5da121ff0e6ac7e258b5d1fdda81e6c1578daf7078b91abcfb7da98cdba6693d4fbe7f28115e6971

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\id.pak

MD5 cfc848689a25f5e2e6ba9a06e09b6ee0
SHA1 35131e775d98a57ffcbd6a75e69f6f67437636c3
SHA256 ec1d7bbe064656dc53f70e3a612a582f5d5d0af5f0c2d6a783796cffa5bf7f57
SHA512 d5a027e35dd3846f5255b81eed36a3498ac9d809367692b2da216b5771c2d54fad35fc15c15705a2bbb4a7b35dd2245661882734998f9bc3ad8d62d2273b6577

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\hr.pak

MD5 fda338824b4171b10dcc3395a549fa9f
SHA1 ea42c8b18228e0ca57b8ed7ed48e3a2aebe08486
SHA256 43f370368b322cd1236632c82aa0e231965dc58fdd497f8aeae6b40eef9ee611
SHA512 9115f805f51f45839e0a87cf44c1cce311cecaf717c0da7db3b6da85cea95f24638af29da43bc01056994b22049daa0387cd4371c13b8e5399fe8f4e38771d57

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\hi.pak

MD5 6aa92c296ed09fe2aa94dc060b25774a
SHA1 7619ed3dc5b1e04c55b0ee7280ac2d0135eb9c80
SHA256 0c771c66db4f80a62912564944c4e239f8dac8381a06483ecab512e0d75744a1
SHA512 9255a4ffef7be07ceab5dd8f46365b9a52d621ae175c1022bb4685fe4f3ea63425f45aa9ef824b467b9c33c51a7104258e888e8ec15c88fea126bf0b5337ff14

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\gu.pak

MD5 6c949199eaaad8fcb12c38ec6c02d758
SHA1 ce4dbd5e6a37f25354ec6849f7008956ef3568ba
SHA256 966591a74e44c75c7f0114bb8e36b0e9f5502aebdc96c714c8a8f6d45bc863c8
SHA512 3344e0083969de6f4913893a14586b441f65cb5d45f913f1cea61b8d5abbdb3b1c18a48731870282174263c1f306ed6b99c279627bd269e89cd4e15dc3d88313

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\fil.pak

MD5 eaf43729e9bbd8004ef1ff56a3d85a48
SHA1 34b31ab8ea2ce6bd263f00acc50d5af8d0222d9a
SHA256 8559cc35335bb2c249297f4c7506df95cef899ef5f7ad942d2d511ae074d41b0
SHA512 010f8e5c3b969be0db4baec3acffdd69be25662387968e15e11af0da68ec2f45dc9edb83cafe7c92234e1e4e4aae1682223235af04d99e8b5238379e022e3d35

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\fi.pak

MD5 125a121c22dfc2b1a1c759cad9123e42
SHA1 d0282af9ec311c406ecccdfdd7216b7d883e94c3
SHA256 b733460f039dcb3795077ba91dafa3b9b8163dfd0f15168b250630f7de21ed0a
SHA512 c6e0ea8fab8115a632d4c74141efc46ea546f43e0b806d5bd95a1ecd3b8fe37a44565a2f79c43e0bc50dbdadc5d16054e07485fad83c99bd3550a907c852e724

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\es.pak

MD5 3db06ea954c83343bd333c15947f521a
SHA1 ddde6ab9f9085e83ec8bf7a37df3389040acea42
SHA256 45df7340fe3c8560b11ffba2219de1b5c45dbfe57b6db90bd6c246244fae338a
SHA512 cc29f1075c119daddaa108c17abb6d572925cac1ed2237ed2fd45364bfb2a00c1144fccdd22c6728c954af2cdd1b9477f39968ba25354bca2b9dca07f5c53dde

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\en-US.pak

MD5 752a3feed3ab6c127767c8fabc9a40b6
SHA1 4af9f9c19904d3bef154b469858dc44b1e630a75
SHA256 c6a6c5d7ab6119bba712d6fe45fd385506d4d0dd8e4156cca3925062f4502ac5
SHA512 ae96d4f391e36f8f741671b72ebd4b1ab2d049b2a99b95737fb9f81743b9e414b46022b65194af5616eb354056addf0e46ef090f56b7d945ef2cb5f4d100d64f

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\en-GB.pak

MD5 985558de03bf486aec1daadd39cb508d
SHA1 b693ddef983e8af212936202ddca92d908378404
SHA256 1956d448a4d333638f3601d0da976710cbe0a795504eb694ba18311fe586d195
SHA512 13d1c82b797ad4ff25a94a996f9fb52b530643a0e735f96e32b9e0698962770148d95db7beb91343d781fb84378a3e334ac0c1c913d8dbae20f425bf0dc364d3

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\da.pak

MD5 43029018648d558f9bbf7a74c59eb281
SHA1 90c6618cccb4db85d7485ae8d809ec3af4763e70
SHA256 4bd88f6ab82842358987aad384775b35198dd75c2cce4cae783208ed69296a7e
SHA512 9e8ef9d4367ad01f2f4e7dd6f9884e463729ee5a0f678fd16a3ce093c21efc1d78041d5c6e45037f37bfd732e4833744485b00acfda2313a1d1e947993129a3d

C:\Users\Admin\AppData\Local\Temp\nst954E.tmp\7z-out\locales\bn.pak

MD5 fc66adf3deac72fd39105540dd2daeff
SHA1 a53b54efcc1285a226d605116f87d12f69942482
SHA256 ef50cfebaf9e32edeec25d30197ac5899b3db8a0676671f639d32bc48f3b3bd8
SHA512 0b77daa056451d01a8cfb3ff1acc08d34e64e0a32bb119c8837ae3d6e3d5195311427c6101efd7e7bc9104aa369832bb12aab3d4080c00dc39edc98b6c0b949e

memory/2316-570-0x00000000006D0000-0x00000000006D2000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-11-15 07:12

Reported

2024-11-15 07:16

Platform

win10v2004-20241007-en

Max time kernel

90s

Max time network

139s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4232 wrote to memory of 4504 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4232 wrote to memory of 4504 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4232 wrote to memory of 4504 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4504 -ip 4504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

N/A