Malware Analysis Report

2024-11-30 02:21

Sample ID 241116-pxaxnaxakb
Target ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426
SHA256 ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426
Tags
dave discovery rhadamanthys ransomware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426

Threat Level: Known bad

The file ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426 was found to be: Known bad.

Malicious Activity Summary

dave discovery rhadamanthys ransomware stealer

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys family

Dave packer

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Checks installed software on the system

Sets desktop wallpaper using registry

Enumerates processes with tasklist

Unsigned PE

Program crash

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Modifies Control Panel

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-16 12:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20241023-en

Max time kernel

121s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

Signatures

Dave packer

dave
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe N/A

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2580 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2580 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2580 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2580 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1688 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1688 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1688 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1688 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1688 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1688 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1688 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 732

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nstC266.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nstC266.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nstC266.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nstC266.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\chrome_200_percent.pak

MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\chrome_100_percent.pak

MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\d3dcompiler_47.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\ffmpeg.dll

MD5 5a168cb3ea9d0e7400baabf60f6ab933
SHA1 82a86cb7f42294ab4ad6669c19b92605d960b676
SHA256 af5f1bc9f6a73750fa0c7bf17439700cfb3ab23e1393f0c9899825417e319b54
SHA512 7c1441ecd049543e38297a7b6929e9f3eb978422d0ce508fbe6350ffebd297f947b8d9ec75bd2054142dcd8461eef1bf110e040d0830da977fde8944bece843d

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\icudtl.dat

MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\libEGL.dll

MD5 39ccf402a62f068a8c573b45ea96154d
SHA1 57ceb915ea6f88c7fcca35339bf951659c0338ab
SHA256 8649d77ace8e5753b9a10e7ae3349aafa9d8e3406ba9c8c36a59633a84b3c41b
SHA512 c4f9225c54d413176cb3dd2b26d429493fd056c7c283bc7a1c52b4a2059dbb11380daf5d847be1ff29f058ba0ef44d4bf66a3d9e9a600000dc8f6d20dfb2ed03

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\libGLESv2.dll

MD5 f055a130c79bd517bdb53b1f8a38bd3b
SHA1 9fba0ad4ba973bb285b23cc125004baf61a98b5a
SHA256 45b53759392b81ce7d916b3f1cf02be30289809bd31d09fc1524ef2609183b17
SHA512 d9dcb217f268862c577cacf4e9f84c63e02b647113d484338a74eb0b24fadd6d87b4e7a551dd1ef692bb38e44562bff848982acb62840d4f49f91a7751320e34

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\LICENSES.chromium.html

MD5 6ff57c0aeccdf44c39c95dee9ecea805
SHA1 c76669a1354067a1c3ddbc032e66c323286a8d43
SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
SHA512 d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\resources.pak

MD5 6772b597bf68622d934f207570e771b1
SHA1 f2a80fbfa034cb1fa07dc9aa37bf9f5b2280ff13
SHA256 268de4d99ab7c4f4ee32c8e8cb2b058a2c8d0d839f468ae8e8c0605feaa736ea
SHA512 a2be67df09951c9ef9200dcccbdff13736921522191f0001da539d5c7f26b5b26a6b810be6963908f216768c98d21e52486c7e00538cc0730e8c78e78811b85b

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\v8_context_snapshot.bin

MD5 bf2976da5086b48d74eb36f56f5deb83
SHA1 5aa7669a3e2166fdd7534241a0e7a9bd3ff5748b
SHA256 9f1614328e18becb4adf96de98bc91ce2a69274abe6621327cc0fc8503a1ab20
SHA512 c44deeb96597b4498604ecf2060ee0520e84a00308ca1f47ffdf8e3ed3e676b27b622ff7dbd4b6f1a14ce60b05cc2ad9b8d7562bb362c1b12a885ea7fbe50e0a

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\snapshot_blob.bin

MD5 c8950b01f336b05609976546b1a007e6
SHA1 f04d0b0369007bbe6a7fe129b31b19dd1822f32f
SHA256 9b3a75a713e41bc73f219858fcac8e3031ba22732285ed3a64dc48074c725cc2
SHA512 b7db4277290e849a52ad5d31ff65ab5d2b75c2125d67eeee02b09e4e7001aa46d10bf89429c65695c7560d1c45b898c20275eb9e36cd8b259707ffb8b298f103

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\vulkan-1.dll

MD5 b6d3af84e8be0027741aa6077768789e
SHA1 e525f2434dc56f79644695f5841e91dd5f80eec4
SHA256 376ff6892ec7b406acd8c455ac82f8541e59e3757195488ff04cd9f20d554562
SHA512 f03b8792a740679c8a1a8ce0615b7876cc811130085f3ffb42182e0cb846519603804da97fc93a8abebee01e03fd257df289c54575da8faaad018f4f4bae606a

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\vk_swiftshader.dll

MD5 6720d5dcda6737eb0cc5a352a47414dc
SHA1 03d9a8e350f485dd955f7dee06bfc46371753032
SHA256 d8f36b089d83157abc271d9fe125919c3237943fa9789a511ac5ef1d41e2e3af
SHA512 de5ade6ce14b14957fce669c4181af1e6a6f540798d1c6720b56ff281f813a6ce4446bde33a8f175d2484e07f4911f93a773cac1d372cbe3b26be634b3fa1686

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\am.pak

MD5 e3933de22dc7fb98215b083d8a379f40
SHA1 68ddbd9bcc931f0d4a172fa65af35b823c7c9e37
SHA256 eaa747075e5a62be8b7df5908e167ccc5314c9c6a8b890059d00284a3c496fef
SHA512 7beb80fa029f41cb21536b15c604e2ae9dfc20b4a3ec4f5cc04e2b105d4b2c251830624957197084761f9686f95d332e25d4f6178509ad58257af90d96a9e7d5

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\cs.pak

MD5 92e3fd1eb47767a0cb5f6e734de4eec1
SHA1 33053bfead1fa67160b6a3c417ec4559bfdcdcfb
SHA256 d269e16fbd9b2afe95b148ece22b2ac803768fb53ee42e1fad0181f9dec84544
SHA512 916d73d9b28b0600878418a06388c2ed61bfaf17807a16e1c157a30e5da136c6b6f194e99d151c43b9aa35d101de755caa6da69e1c8a50dd134f27a7f2adc016

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\fa.pak

MD5 caee902136579f4bac72a6f0f75d171b
SHA1 cbbaf988a499005e21fd86652e1f48af8bce2c35
SHA256 e86f677e9654f6a16a7738e85a5a5d467a09cb18e47654f079506a00affad70c
SHA512 c0f2e8457f71789da8ce207aaae2f83196daac868fcaa7a84de04dd38730f8831b9643b8a404a7aa59c5b726da02090bba414529019f5eb9c94ac5a5af61bc9d

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\hr.pak

MD5 fda338824b4171b10dcc3395a549fa9f
SHA1 ea42c8b18228e0ca57b8ed7ed48e3a2aebe08486
SHA256 43f370368b322cd1236632c82aa0e231965dc58fdd497f8aeae6b40eef9ee611
SHA512 9115f805f51f45839e0a87cf44c1cce311cecaf717c0da7db3b6da85cea95f24638af29da43bc01056994b22049daa0387cd4371c13b8e5399fe8f4e38771d57

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ja.pak

MD5 5a69547f56dc61e482dcda1ce704c5ac
SHA1 5b7bbc8e9b14d78f2105136afb7728050128c02e
SHA256 a286a5faf9021927ec09fd8cbf30ed14ad59c3baa36d29e5491ad27b957915e5
SHA512 2b9d020544201e2d0b0b44b0977fcbab858563969ce02be65689c5f5b780adc4560df523589293cd66f42903322ed61d781da093adfa44aa0681a28d97de4556

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\nb.pak

MD5 2a0ec73d03d4d7fcec71ad66cc0d4b30
SHA1 bb8df6e11b02086726ecede97d5f729f4197323c
SHA256 d44ef5e644b1b8f7c056d5e20651515fcc8565befec575091735fb39c6d63554
SHA512 cdcb4e436270156e263d731ce243d821c5361b18b6d7b8259875c9d895301d478a87feb7cafc3376d09d18d27f32dc403fd2cbd034d68736cb968bbefebd642b

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\sk.pak

MD5 b0bbb6661370d27b6600ebe98cadb9ac
SHA1 1139852da47048f15c16eb101dac86dfc8f652ba
SHA256 e0fe4130e668ac659d5334c5bc8cde70bba8742273b5965836860b5a8b1b016a
SHA512 c8eac323552f873ec088f77b8c46522387b0298b6d566cf8aa173fa9b2d66389068bb26e46044af2faa4224b39dc748164843b58b99e9dde093fcb32afb5fed0

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\resources\app.asar

MD5 f22ecb4d9ec69c266ed713cad8ea378d
SHA1 54317e92cd72895cec70a6c7a05a1a84ff692940
SHA256 e6950dcb3c57a32d89049fd7df783acf64b858c45f9bded621781977d55d7c96
SHA512 85ff75ac585da3e5565be38932ec03269af7db93084f8d8d1c45fcd298a26371841cb61c66e36062011728538514b1e42bfb7e35dea513cd82102db45854bcc9

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\zh-TW.pak

MD5 0be25a48eecee48f428fe56fbfa683fd
SHA1 94c0e8c99beb592ebab9ea5b8758aa414bbe7048
SHA256 a5e276bdfe4cf87832eee153596ccde9cf9193e81f29a4295c8335525da64295
SHA512 423033e67654820ab9f9773f45f70908511aeb8228c59126757885e0bbe0bd960257324d405d27526d61b541b1e6323de16bef29d4dcb94f39fd5e92fa811cc8

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\zh-CN.pak

MD5 798bc7d8b63906c5b1c67e89ad17dc58
SHA1 b39c86d6d3fd9d8b8da90d86f827a0c0803fba8c
SHA256 1c05280d8dcdfe99619695b76dd054292a90c1a93a5cfb92cdc4a5b0068a7092
SHA512 7a21af438823d562b889d7c99f639421e01f0536e95f3206dd53d2c8ded82b7a4ab74bb9b4262b2fa27e50efd8dd7719827ad2e6b6d4c2e0d0811930027ed982

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\vi.pak

MD5 045241a62232bae57f1d57c6c3af7c55
SHA1 5c2a1a677a8bdfa20f3577335131bd4b89a46355
SHA256 56758c918bbfe6a9d5b20e8b4a7248bdf2d43e0bf5f98e85a9892ff03dbc2d99
SHA512 8e30af44a53a36a194da16a756dff0f90efbef164277bdcde683c89a3cdc04ae5e1298475e8a098d19dab73eb0a71637f676d49d237c5480e1f7aca1765166bb

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ur.pak

MD5 cb228cc41981e8bcbd2768da20026912
SHA1 c55bb999c4c1fbee5e38b6c986fbce2b128f3880
SHA256 a7d825fe348700528800ef9ea7940ee8027373e9c05a4e51e526d0a213c05429
SHA512 85308806be53494683f32520e181dd9c8c9abac0b92bc439d4e30eef22d4af993794a9719dd9a4eeed0bbcaf61c0e2342e7d4ed5d30b504572bd2bc269100e2e

memory/2580-567-0x0000000002BA0000-0x0000000002BA2000-memory.dmp

\Users\Admin\AppData\Local\Temp\nstC266.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\uk.pak

MD5 ec3aa18a9d9c989b1025dddb0fa52b55
SHA1 ab3b0834cabee34bc2f9fd04104b10e5f9c102ca
SHA256 ee67744c26e0c69fbed8b102add339070aabc70c2d8ca9ea037c6c9d23b66d3b
SHA512 90d40424b050c6c7ace113e85b0b0a58472967c50a14fbc6637cd3b2db8ff3f521cc94dcd256fa017684256e8a9c19b158aaa57f6d3094fab970578d3b1c6847

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\tr.pak

MD5 82c6a14ba1b28f947bee67bc3feab091
SHA1 25023b22eaed29d0817ec95d5bcb4ad3d724f5ad
SHA256 099507f6f2a2c98ecce275f8ad956eeeeaada65b7788356301af04a0cd7d431e
SHA512 988a9275b7a05d100ca9242dd05969d2363a42938d47db37a1f62ec1874e96b640c14b272f1829ab5c6e0d2763c22fbf0af99894d4d9d32726925eabbc02c05e

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\th.pak

MD5 b18e4574db917920eccfb8e6900d0662
SHA1 554206b9e639135074b0946fb28b6ffe2d934159
SHA256 c14fa1bb30c880216d6cfea6fb738235cf72a3fe8be919c3d61321d5a5883211
SHA512 5f427f9ed85bb368b45bafd523c634e18596e430fdc380563878d2ca897cf2580d0405f7c0d8e10abba389bb7125978a81d335263bb777e0ee0bfe3d47c8c65f

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\te.pak

MD5 a4accc25dd8a00bc57df4fca12e41295
SHA1 9466888034c9e6ecf4113ddda63d363ed20e3156
SHA256 157d646525f6a9ac267466631671e65e9b5c3e55b008b564186e64c6853e52aa
SHA512 f19116655b6c2bb5c572b45f1d712fa1f9d57d9e8963fb3d654ed3781bd34a4e937b590bcc1119a318e28632da12a0ef8b36f6426791de833898cf7f30189567

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ta.pak

MD5 aa06ead1200f01c9460399f0abe2d54f
SHA1 9b852c4691209c0ae9edf94a5dec4b902fec7b3e
SHA256 1946d903918c57836d2f898ef93cd1d575da1a464e358c399dfde73ea2ef057e
SHA512 6e556b962c16aee22695d93b62b308d95b0695873fb33d13a147b3d8b6791c9599daa6e3bf424a1897212a018ab36dd8c8214c2eb03457048c6931686be40e04

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\sw.pak

MD5 a63ef2c4676dfbee98e29a84a7ad9d27
SHA1 2f0f4b33acf5e63f3159c62c74deaa9a361203f4
SHA256 7b8c51b247dea72d68cb0ef4292800c13209da6f859a9ad289c996582f19e65c
SHA512 cd65fd2c49d35757de648f21dec748fb4a1d13d2308552774fe9c859ad5748b21f5db449f8b380520f27dc868a3ebaafd58d4c45aba34033785777d342e17e6f

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\sv.pak

MD5 cc0806219798e3ade0437219457a37ab
SHA1 dd6ba47e14b7b0d08159fbca2409b013dc2e17de
SHA256 79a7260c8651ff3024e21f9263543bf4e9d5f3574e81cf96edf6388f8da85cd1
SHA512 df3da02bb2fecbbaf1ab80af8ef8b1a7ae9f6c7ed01f94c5a502720376924132c344dd716fc5b4ddc03733a6c3581ed8d8a577154c619ba85c527dc67f4a48c2

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\sr.pak

MD5 abdd9eb966d915c1896b31cba0b2656b
SHA1 cb0080e5f2c168cd0f3edc6ed6c47734ffd67790
SHA256 3913d3be5016ce873ac68af376d5fcf558bb5f5f29a9bc56df0099ba47e52486
SHA512 bcb258d6da766bb6f00dfdbb03bc878000d9cf28b2b707375ce52485db9c530a34d1528a1473f09b5765bc57abd847f191bde55646eb707443cd0e40509b70e1

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\sl.pak

MD5 aa7c0f35b61a230d65e498daab67388c
SHA1 f60cb1c7128a1fb1cfd9aa029f96df36033777d0
SHA256 03afc83cdba98c08af169c8ae111aa916f3ee6d5a2fee4954ef35ecc063f2b21
SHA512 048d03c490f18d22f4900363f9c4abee037a2029f226c90806064ffedc85b07a1d86225b9c534311b08f588632a84221d7e4fa355e7b768cfdfd6102c5ffe705

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ru.pak

MD5 e9af20a6226511cd535888846a2bb16f
SHA1 739a46269f334ecc291bae6777f0b7c8e271e4c0
SHA256 5db640c6c288d9fc79012a7670301a3bc463359c17ba200aedaa56260ef8d955
SHA512 7897c500718382f08d55f3cddd96d1451524b5c2b8febc65e1700a645598b622c819ec66e4a21c119f044faaa525a2abdddf66d0c9800af6ecea9ceb217a88bb

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ro.pak

MD5 5db10edf772656c0808dd8da698334bf
SHA1 3caf7c9d5a3b44e06e0588daba698b6970ea06f5
SHA256 73b6a63352906d77196f38a1df937ec0770160fb7a93321867c7994ed3e7967b
SHA512 eb253b548c7f574943136764a23818f9dedea17ff42f92dc8591f4b7c297accdde9f6b2c0ad96f1fd0815c53940c0102a90c603f9f4d6d9c8fb053b559cc7a62

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\pt-PT.pak

MD5 cbe5e35f844f5f1400df3685cc847694
SHA1 e60cdb0a813a97c8548c878276bfae155350bb42
SHA256 6b9bd714d217d596183894ffed3174a617e1c8cfae292231d4b967183b589c6b
SHA512 96046c97436a3dbf5aac479b9eaa9dfdcfc81f1edcaee9cd65d59beb0ce6b6b42828e0d170aaef2ef1d68988f7916ac1dbac0d84218de83fedcca8592de4c1f1

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\pt-BR.pak

MD5 b1ab7d7aa67a7b61bfa9aebad0b812af
SHA1 95eff4be517c0a25c34578def10d48c77021de1a
SHA256 5bd503c413aaf8fa87fd47c341d437accc25397a50b082068bcf2f3bb4fb27c7
SHA512 8498fe7727771df3c1eb34560c1e25b0c30690c7c921104b4adcf04cc5753462bac513a60a5833cb6f57733201d4883605f8a4ec4a457f3ebc7c952090b1a9e1

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\pl.pak

MD5 8a4354163ff3b0978a568f781bdac289
SHA1 45de421f35af79adf962809cf8d0e6d2adbcb553
SHA256 2f6de0f9a46ae0b75beb67e09ffeee12483842a7cd6f2a2382ccbe36fbfc17e3
SHA512 5760f20228afe74e9ff2a916a168e8cc2d4a64d8e76065e61a7a60616a473c7dc3da4805125b270f179b7a0f291071e81d761d82eec3b130d552b57abd76c127

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\nl.pak

MD5 e8b790166d701f63a60c3b322fcce234
SHA1 61ec318aa8030f7d29c3258126b156d1d3eefa2c
SHA256 3d73b0110e5832b6a7c7b7e64018368464ef8552d6a98592d0adbf713eb9755e
SHA512 4e4b299cb55cbb5906ff974bb5e5078d2018298b5ee6d9ca0e40aab8db542aaedc4bd7a5db242a2c5194bc90c07631f627043dcc1a9f2d095a28c3e35f212dd9

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ms.pak

MD5 6149507c3aa99c4012d9d7cfe4bc30c8
SHA1 51a2bb5cbae64f3877afc342ea0f43915702f8f4
SHA256 dd75481d67d9be36ecb2e421117395fbb75b7623164f13a09be1cf3ce76d588f
SHA512 71f8dc03618d46be7b036353526bf20a61e648ef50adeeec057d314e9a4536899c37ef691164bf9de9e10a3867749f8d3d6f4038e16c82cf6122e7ab4a1c7732

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\mr.pak

MD5 0e5b29b6ae74a1f94ca4f880f131a79f
SHA1 6ac5089ace05847480d2aeec89954124caa781aa
SHA256 25bf8e86f7c9e88f68d4c40c4f124c16f60daf22e7a87f55ba2c560a0f640bc9
SHA512 30717c0aef4458bbcf7472316727981829edada8be3003afd9d65cb01d4cf309f601b1c41539343d6239cb2e9157554c95cf966a4156458a2fd78d2464075c98

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ml.pak

MD5 d32a29a61e8afaba6b42d236257d9929
SHA1 9664f50ea7590a47c2eb8eb4a3e49be556d08f7a
SHA256 a59fd15c969ee8ffd7e72f5a2245c6a5a4fc048f7899fca489d78c8f6394ca1e
SHA512 2668976853b26b22859f8c20afaeb4d641845e94779b8994b49f240302420279e3f9a99666b8f551495b7d5a8c3c83609b7ecf276fabd8345cc8c787319ea3d2

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\lv.pak

MD5 00b517ce675a3089823708776c6f9302
SHA1 2bc24f150adaafd2604c5d95bbaaf8dc983d7da2
SHA256 0adedd1eaaf902feebb208220d9f21ae1b0175e74f6a966cd7ed226146d86ae8
SHA512 6c19a0d779185141fb050369f9fbfe60d0b838e55e2674e3f14a67e1a6970727e329656e458ca8516a41c97b20e67eb1789587af957129b3d32c94a3536ab12e

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\lt.pak

MD5 7cef6e31d76861db4d7d622fdd89e5aa
SHA1 31fa45c3b7666259d4d8a13518ece423a97edcca
SHA256 2f1e1c69da5cad8f47e45af0ac47cec90c20fe2897a43cb496c7feed1ec5d1ab
SHA512 df66a739f3a8da62a942b56b23f71a2b68469e87dc44eb8ce1a9a859a609f1db4bee2497defef06fa48e14cf461e61410668a5216459c94c79f4b69a3cf092f6

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ko.pak

MD5 4b563eb612d4fadc6bd8a4c918006ab1
SHA1 4b9e414af0c044c4487d1439d23ef11b0169d308
SHA256 e0d4461452607e0f4a619efe653ec9ec39f7d34a742ae98374b2bce0b821adc9
SHA512 b8c56d69fa41ad14f7197acab1ba987ebb06c5b15748e21cec27861721545e30fb20f76f2c3a752c8ea94cca1e6b4fab7fb0727b679a8fb8e94db2d5c028e7a6

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\kn.pak

MD5 52a0707a70b939bcd75b0838a5dc5357
SHA1 eb9e1350d9d217580b1939302d008dc07c3b781c
SHA256 b177eda102b1be8c53127e3bb47970a3c1e2032be24900d8a126c5f0f077ef3d
SHA512 d5fe69035338c4308f661fa0ac25c4a811a6014f6bd85ccc7ad947f76aecf76f67208512e1266e249ec067a5fb22fb74a3550b0f3aeb1bc50fadb3a9d3cc67e4

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\it.pak

MD5 6aa3bc3ee4999c324b82e50940e62c74
SHA1 10af8030fc2f875e133c9417e0221528160ad8b5
SHA256 73cc8422643a65753b2c3672c8f8331ee92c9bddc912576554e95b0986cf990d
SHA512 f039ef32002e55d09a4f567cc81fe2b3b329d517c985436a5da121ff0e6ac7e258b5d1fdda81e6c1578daf7078b91abcfb7da98cdba6693d4fbe7f28115e6971

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\id.pak

MD5 cfc848689a25f5e2e6ba9a06e09b6ee0
SHA1 35131e775d98a57ffcbd6a75e69f6f67437636c3
SHA256 ec1d7bbe064656dc53f70e3a612a582f5d5d0af5f0c2d6a783796cffa5bf7f57
SHA512 d5a027e35dd3846f5255b81eed36a3498ac9d809367692b2da216b5771c2d54fad35fc15c15705a2bbb4a7b35dd2245661882734998f9bc3ad8d62d2273b6577

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\hu.pak

MD5 7add28fbbba1ce87972f6433862dcbaa
SHA1 8b4b0053663c0b69beca59faca79854a89ab9c97
SHA256 dd86976d72f3cb644b90c1863e29e2f8616b09ac4acfe9301fb346fa0d87bd78
SHA512 efed0891b0202bae9396df54f141a73bb6ccadd7947330fd9e6a3a8911e9e037454238c4bd2bb9075af3218230c9e4e394f83a70878396911faa282d99fdd884

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\hi.pak

MD5 6aa92c296ed09fe2aa94dc060b25774a
SHA1 7619ed3dc5b1e04c55b0ee7280ac2d0135eb9c80
SHA256 0c771c66db4f80a62912564944c4e239f8dac8381a06483ecab512e0d75744a1
SHA512 9255a4ffef7be07ceab5dd8f46365b9a52d621ae175c1022bb4685fe4f3ea63425f45aa9ef824b467b9c33c51a7104258e888e8ec15c88fea126bf0b5337ff14

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\he.pak

MD5 16562c59fba469e1dd2f3b0b87a64645
SHA1 9a6863205fca8ea6d09a98b8e8dab543ff6198a1
SHA256 64fa2e98a9056e23c3a934ff39fef81c306cec5844d56dda17ec6c25fcdb1b5a
SHA512 dbb6e1a5e52a005386007f88b53109037792bc7b65fb95ace3e8cc5ae3ebd8320c7e406381c375bf751a9265ace84e0bbe1301d4bf3aa79200ec789dc3b3bc0b

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\gu.pak

MD5 6c949199eaaad8fcb12c38ec6c02d758
SHA1 ce4dbd5e6a37f25354ec6849f7008956ef3568ba
SHA256 966591a74e44c75c7f0114bb8e36b0e9f5502aebdc96c714c8a8f6d45bc863c8
SHA512 3344e0083969de6f4913893a14586b441f65cb5d45f913f1cea61b8d5abbdb3b1c18a48731870282174263c1f306ed6b99c279627bd269e89cd4e15dc3d88313

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\fr.pak

MD5 651e4cb14c4f784d36d0a1715c52dcf3
SHA1 540f6090e3223ad8e6424a9db78305f2db9974bf
SHA256 6d547cbc3304627d14aeb138aebd40786c30a4192e071d80bcecdb77a13ac80a
SHA512 1fe93058ec434c06ef4aa1519333ebd831311971b06d7279ddc4d86dfa860bbd6ea6d127b2a07425c3e78bd6d41c11eb2a76cf25b20c6a7de74d1f0ceec87079

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\fil.pak

MD5 eaf43729e9bbd8004ef1ff56a3d85a48
SHA1 34b31ab8ea2ce6bd263f00acc50d5af8d0222d9a
SHA256 8559cc35335bb2c249297f4c7506df95cef899ef5f7ad942d2d511ae074d41b0
SHA512 010f8e5c3b969be0db4baec3acffdd69be25662387968e15e11af0da68ec2f45dc9edb83cafe7c92234e1e4e4aae1682223235af04d99e8b5238379e022e3d35

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\fi.pak

MD5 125a121c22dfc2b1a1c759cad9123e42
SHA1 d0282af9ec311c406ecccdfdd7216b7d883e94c3
SHA256 b733460f039dcb3795077ba91dafa3b9b8163dfd0f15168b250630f7de21ed0a
SHA512 c6e0ea8fab8115a632d4c74141efc46ea546f43e0b806d5bd95a1ecd3b8fe37a44565a2f79c43e0bc50dbdadc5d16054e07485fad83c99bd3550a907c852e724

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\et.pak

MD5 8e2c2cc8c516d8b7181c0c712ca24513
SHA1 e0ccd9ed8de6640379f822a067dcf97d4bbe44a7
SHA256 c96937f46fb1b1182b201f5c48fe1da4d3f94a68a0e6e0699ccc0944cd0a5a33
SHA512 339bc655f22068f2ee9352a670325865265e4279197430214f7e3fba575415318110cccb03aed2c0e7ac673d4629bd495dc34a56cefbcaab62e1c4a1a87ed8c2

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\es.pak

MD5 3db06ea954c83343bd333c15947f521a
SHA1 ddde6ab9f9085e83ec8bf7a37df3389040acea42
SHA256 45df7340fe3c8560b11ffba2219de1b5c45dbfe57b6db90bd6c246244fae338a
SHA512 cc29f1075c119daddaa108c17abb6d572925cac1ed2237ed2fd45364bfb2a00c1144fccdd22c6728c954af2cdd1b9477f39968ba25354bca2b9dca07f5c53dde

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\es-419.pak

MD5 85e9b056e3ac3f6a5b113ed9f460e202
SHA1 dcceef6ea85d71a85dd24d17ec65371dce76f480
SHA256 16fe83762ed578c49685868418325920a72cd457907bc4e5264f2c172d53b27b
SHA512 e4dfde9c1260df1f77b7ec1797658f8cfeaab98142a8d512ed3bfac054933a4583f20091b97985b4ba9cf93f9faca3e7b0986cb4a3eb12fe0bc04ee1c45d3e0f

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\en-US.pak

MD5 752a3feed3ab6c127767c8fabc9a40b6
SHA1 4af9f9c19904d3bef154b469858dc44b1e630a75
SHA256 c6a6c5d7ab6119bba712d6fe45fd385506d4d0dd8e4156cca3925062f4502ac5
SHA512 ae96d4f391e36f8f741671b72ebd4b1ab2d049b2a99b95737fb9f81743b9e414b46022b65194af5616eb354056addf0e46ef090f56b7d945ef2cb5f4d100d64f

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\en-GB.pak

MD5 985558de03bf486aec1daadd39cb508d
SHA1 b693ddef983e8af212936202ddca92d908378404
SHA256 1956d448a4d333638f3601d0da976710cbe0a795504eb694ba18311fe586d195
SHA512 13d1c82b797ad4ff25a94a996f9fb52b530643a0e735f96e32b9e0698962770148d95db7beb91343d781fb84378a3e334ac0c1c913d8dbae20f425bf0dc364d3

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\el.pak

MD5 58d6eaf71b9b73f5f7f057c73d0d92ec
SHA1 16e0587753e7d2834f4cbb24fed45e7bd2f8f2f4
SHA256 8474879de21c414d34c44cf0a8c91356a66dbd647308a4f994be25bd1f93a89f
SHA512 ab24c9655bd68e4a64e257914a35dc84b5f791c58b396ae004bf5da61df19c02ef9ca572b8e63f15baf3694ae1e540adf74586f10d28d7ef90edeec982bcf28d

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\de.pak

MD5 3a8de004b3a610271e1d1913b6d4b53b
SHA1 236893c3f7b450e6ad8b4d54e1a62b2e635b42d6
SHA256 43c060182c92caf4aebf8fd7b913dfe017beea71e796e862ebf8746575948364
SHA512 b70f849ccf7dd9e72d71522591420e0baa03ff74763b44563b0b3800ba3a88cb8b973fabb90bbb6653819947eca47f70e347958e3c31ab226957f7313bc03554

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\da.pak

MD5 43029018648d558f9bbf7a74c59eb281
SHA1 90c6618cccb4db85d7485ae8d809ec3af4763e70
SHA256 4bd88f6ab82842358987aad384775b35198dd75c2cce4cae783208ed69296a7e
SHA512 9e8ef9d4367ad01f2f4e7dd6f9884e463729ee5a0f678fd16a3ce093c21efc1d78041d5c6e45037f37bfd732e4833744485b00acfda2313a1d1e947993129a3d

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ca.pak

MD5 e1ac7f4c28177f68fac3be2375a9368c
SHA1 3d7738699087468a748f9b1189d2f7621187d03b
SHA256 efa1ba906f8abce91ebb9d6442b64e0d5ae7dab78dda8a49a6fed1a342c71b9b
SHA512 aee8cb28eb02e2fb2155c8d093cf678284e3571f46b913f743de3c6d0215c18b80866ff446f46ada160860ed9c18ae9a4209424e7e0f0ba97c78a3fe9815ca5a

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\bn.pak

MD5 fc66adf3deac72fd39105540dd2daeff
SHA1 a53b54efcc1285a226d605116f87d12f69942482
SHA256 ef50cfebaf9e32edeec25d30197ac5899b3db8a0676671f639d32bc48f3b3bd8
SHA512 0b77daa056451d01a8cfb3ff1acc08d34e64e0a32bb119c8837ae3d6e3d5195311427c6101efd7e7bc9104aa369832bb12aab3d4080c00dc39edc98b6c0b949e

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\bg.pak

MD5 7c37c8c9b4215089b6c16d22838d256b
SHA1 8f2afdc21353685353a0562452f4a79180e58829
SHA256 2ebd582dfaa3139cd6a03e9892a94a3d9bb6936e0b04085b8f2d27e1dec0bc8a
SHA512 beadd70e9d706576bfb6725617385f776e9f68c84d116b01187354d377e2c860899da34f8c5a054c4bde41a57e9aac56445f6ac0b8da8c75a424641a86fdd718

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\ar.pak

MD5 ac865ff462f341b4317c3d16eeb40460
SHA1 1e971d97f09884b23595f17534227ea43cf99090
SHA256 0557bc17eb1d134bd52f203836551b55579114708e2df51f653972951567513d
SHA512 a935b91a2c053303e941866cfc151f28053faf364aeece98d61fcd68fef6c6f1d3b73de01cd602c8a4a081cce452d1ce87f8166ba3c0e8b81e91d932f84737f2

C:\Users\Admin\AppData\Local\Temp\nstC266.tmp\7z-out\locales\af.pak

MD5 d9bec09b6c523dc3bca9a81264b1beed
SHA1 ea4ae9dff554c59994632f85af25b36c049fb5b2
SHA256 0b5a45de223ce8522cc296af1e93477540eaa74867428307cc3a5cd21921b022
SHA512 6e7677f86f73edffb5d6162ca19bb7464465f0f485ce2971fb20ad3f57d9fac56b7a21d378701f80e85fb185c3af6a238f8c8707f5874bffffd79d881a54dd6e

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20240903-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 220

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4476 wrote to memory of 1228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4476 wrote to memory of 1228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4476 wrote to memory of 1228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1228 -ip 1228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.73.50.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 180.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

163s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 17.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20241023-en

Max time kernel

121s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 220

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

144s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2932 wrote to memory of 4760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2932 wrote to memory of 4760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2932 wrote to memory of 4760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4760 -ip 4760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20240903-en

Max time kernel

117s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2824 wrote to memory of 2716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2824 wrote to memory of 2716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2824 wrote to memory of 2716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2824 wrote to memory of 2716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2824 wrote to memory of 2716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2824 wrote to memory of 2716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2824 wrote to memory of 2716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20240729-en

Max time kernel

11s

Max time network

20s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 220

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win7-20240903-en

Max time kernel

134s

Max time network

135s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000cab15e7acb035630cb6f365f04a1a0a00dc48b1d17cdcf2f8284eeb29bb5eb9c000000000e8000000002000020000000d87a97b2d1ca4175ddd929242357ff1d8d14a51a13f7eb7d2d46cf8e9fe014df20000000a00434c8185e0860f381679d70d34963c93cf4dd4a61e5f9b0b0f89bbebc045440000000038e682db1a9996f92acf633ff029f75b1e9afc186349298bc5b9c8d9d44bacb404e6ce42598735ed0bea30a3f513c9eb5c28eb005a99526f75abddf5e16e62d C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000e3cddc1c4ff5f54c599fef679a00325104be22f96f9d3d703a32bd0e365202ab000000000e8000000002000020000000eff897b46f06be03ae743dad1d5b0372d646833a2ee2ff7d17c364e625df13799000000077736fffa89cc3f72ef833da8f6fd713560b24f7f536b974d634dbe2d5b9b4948887e2bb8c8755fc4494502aa387a7b26be2b87fb5632a6300eb9e1c8cf4acc8446512ceb0de97ec048f3fa1e721001f1c6ff62d7b8c7290e8f4e82830e8bf446c8377ccc1c750ed4b9127bf653ca6e79aaff81372144e8690a39628af91f13f1dced91f93920eb5fa13c5603804d7da400000004fa4b8a0f197be92ccc167701c42bad8589101ecf891070eb1c1f9bf219727d7fa8213b7236a27ec8a4946ff2bc2829ee2ccf68f50296ae80a2f4a5fe1d2ad0a C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90504b622538db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437922950" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D1D51B1-A418-11EF-A914-FA59FB4FA467} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabC026.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 331c722a2e3a37e607b45e4d3e632d28
SHA1 5dce9b8947866b52ddfa489ed6876c3015f904bc
SHA256 02e13a720e86af6193d7fb6bf4ee1579b9fb68a0523b9cf57e14dd943d179039
SHA512 e1878683dce4bdd7b3d9c3c1473648fd6891b6c25916963f28d4239193ee13dff75748459b3287e742473fb9902394ce335d6b03772853aad135eeca40d4b6fc

C:\Users\Admin\AppData\Local\Temp\TarC0C6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a4301e957624e1a170cddd5ed235b8b0
SHA1 5b1f29a0e3c77878f33d82490043a71ab301540d
SHA256 31a54c0e86f0f091d14ba379a3f52ea252e164ddba046d676f529decc1f3d616
SHA512 98eb61a93fc6cae21f980b7aed156454a84f2d460002e5efd38219e48e75b9a5eec53d19c9cad58f690cebb8c54fd60a238933bbdaf3d80299fa0cb45c8e37e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8a42ffba8b0ee1bc99a0ec883c97e552
SHA1 bc41b8e485f7000fbeb9c94bd17cc9666ff58662
SHA256 6fbc3af5c3d133b591833eeceeeb24181be30bbf2aa735ac8155ded4bbd9ea29
SHA512 35d0d54a0b3d0880cf028c070ddbe96f8e130983c8ef313c3fe26abb1960178c63552a0cde912bfc8f08e6d7a54ab6feaf6d74c86311b0d38b44c3c4bc58cbe1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 003e169a354141d6f118e8b8d5dd5296
SHA1 5df1c42d0e540b71efd53401bb3d315c7f0dc9e9
SHA256 cf687235a75addcc54a1c86f074fbaa43243641a15c4aa9bf06e2893c6023ed2
SHA512 454c5f7e0dd39c07bbe755f028d553d3e9206b8cd31cbef2ae17bbea7467e134f2a223a537d62f88ae3aff0088ad33d36a8b40b7e447b318ca6fe996d1b41093

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5269b3d9c3d0c65eeb3bf37dbf90e9a7
SHA1 d5ab7a9947315feaaa6ad989c1286220d80064b0
SHA256 43c40eab13cda96404e192dfb80ba8044c9f097415f09b08c7365638eac387b3
SHA512 9f7951f493c20127145295a709c7b3ed68e23c125f56044b69e75666cf34e96081a5869878580e46a959c545f2b44464decf899d4aca3c0afaaa5a97ea9a9bcd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9d1f488da57a9aa34b662bf774fc662a
SHA1 023eac82452d038fc929a323e98c07b055481ff5
SHA256 4b70898cb4e2d720d2570a3d9276f24294faffe481bc5855fc83918eb73946e0
SHA512 f686f4b837783f83d4961426df7bd6245997cfae67a60fae9ea9efe33159c91f9e6b5781f278d365aa905736a5b08ae11080b8dd3695dbd26ddbc19b1745da0f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 671ad4d0aca9788516c554517745cb79
SHA1 acb3d7174c630e528d9782126958b86b2cfab8c4
SHA256 752f1ec2ab57337127ef2921143a2f4e0ca76bb081303b6f43b3fcc80ed0fe4a
SHA512 7a915fc06971c77951752dfe8fad07b054929606b892e79f868929722def54c244c6d22ca322054f7c075bf4d5fd72770acae4de11ade9130d95890e7a1095f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9f8d4cbeadbbd4213fae07b9687bfee1
SHA1 473613682a8ea2a1096daf96f4f94df4978fcd65
SHA256 ee2feff890f2da82bf25a648ea2b72f0ffef1e4d33da4af3d9c3f4bd2fdc11e2
SHA512 628480516481dd1038e635754ca5ca932e1681e14ea2ea5ab02a9cc0af9b4e76eda42734dc38a95014661fd4da1428a4207f0d2ac5cd6eca627e1f8e211a558b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e8e70180c01fac24fdcdb98a46ae884
SHA1 b948514e5b0fdecf2d52ce09464bb16db15a91ff
SHA256 d059cb2e5bcb4f8ce0494f7604007e8b9ba663b3ff5501fc97c922339d266a56
SHA512 3229a96ba5021aaf8877522bd4c06ada5ce90757e3417d72c90ad14da3bf4117266f89b9698f0fdf184a14a29e0743ab79fd1d434ef177fb4cc3916f383efb20

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 201c7493b949c236cf852f3f68136b0f
SHA1 c6fe4abb80728a67146cdacefa3ccf7070f023bf
SHA256 dd47ecc6276567d9c0faab4e356f58cfbe9a6b0c356678d1baabdbf1a09f3798
SHA512 5d08f3da8a84e96c7dc0737fb1d013651067f28f6031099330e0db84a6ddba097a22db46bc47ac7f60e1e558192bb8f1a3e3af7312f7ba1cd2868ad48886e5d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c59f939ae79af5d196b3c4655c7d51f2
SHA1 4183c55f7865199ecffd0d911870ccc310318f6f
SHA256 c901c903d3f81968126ab477b7fc78a3b0de65468bb51840e5b813b5297cf890
SHA512 33166fbbb31dbe3a5441514c3b07648e93c90faebe40e1ccb70cf2244462d11f3c0891f23b082447b7b02fc1225a4fb49aaa47341d62d43e33b794b3b8319d3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e7f74326a95e578261de7517fefa3cd5
SHA1 800f8cbaa4df6b9a6f63d60ed2dc55289a4eebfc
SHA256 2e632bf3cefb03bbf6e4978b4a40b6247f5f60bf1cfb0768372288c11e1f2392
SHA512 99a0f042d9930420ad948b103064960ef8bdd08803973d5994da2dc46aacfbd65750f889160b0967793a16a5c6bc162bbcadc86904ee3f33d1cb66c34be14ba6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01e252cc915d50d80cb68f8e7e3ccace
SHA1 1b7416cb999ae1c7ae180ac2e9a963043f6e36bb
SHA256 ca221747b548100821a22d61bfd000cc7cde4ba557d997cff9d2916b88628797
SHA512 1f18e816359ec7dbb6ed95d4b5324729dedf599b7e6562fcc9dc1d6ade36de63d1e7850bfb962449fd85c50aa8fc748886404a91ff813cf8550fe7c8ef3754b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb28a160938c6883f7af995e8e136a93
SHA1 364bd9e00ec409d75c8d610c927a0c191b97dc94
SHA256 60625bb350a5688d5d0ce22da30f5b6aae6dd84d95de4f4bf62c32489290bc2e
SHA512 c5cf0560353fbac6ffb8f408b538744bca6f707ba71c79cd2834c5a7fc96144f7d47311649007804e6a20491dbc3713e0601f340717f7dadbda7f9b5f0f04829

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 64ea452cd09641c18cfbc8b2c5af3c16
SHA1 cf282d3cb97d01fd3ccf049e4abb1fc0893bd571
SHA256 2a1109de5b62f49866920d7e6f28cd6a68139cde089ece4a0d6a81d007328808
SHA512 992611e45c1e03a49f6a97510399eab06380699de67f42adc1e90de0611bfca921d108ebb34b4bdee0cc0db8d6a3895de07d890507f8e8af1330f77f322308f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7314180589f7338aa85ee6f17d717f88
SHA1 f1c3058bc47ac6c251d16e72ccf22bf996eac109
SHA256 d83b2ca794018bf55d8ab4dee3a6fdbef8917fa11bc3916b78d4a14631c55708
SHA512 7369cc06f420e46fee502e015d45f23b7c44e5a613f1648a195ca21558ec25870150adb1f3c1ec143914c15190a80d42722fe02f55fe5dec5c2b094c610eefd8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ccc6f954b22f947aa3e414f92fcd7aa4
SHA1 1d373c868849ed6eae1f4bc9ab89b49204b434d6
SHA256 071b4eb856ada53dd6a077688937e6873e6721ccd334307893b94ea45bbfacc7
SHA512 3a18d17fbd1c0908a692730db2831cabf298736e870d99daf7ae04ee880408a01605e7af180959cb2662327c734ab21d80f88725ed8f4f348e3db05449890ad4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f2aea4fea4c73fc73119e23bf393569f
SHA1 47440cd745b3e80b44514ea8beaf4da360eee2b3
SHA256 55f934ed1fc7f52b01fa9e3d0d97e9576e2f8242daaf86aaef8897ac8e7037ea
SHA512 2be1bfb47af0d766c7bf139f137348a3b6d2d3e3129837dff54a5c5c3b86d0bc384026010e15f44926c4b7b7b1dbb566151f0f10966092be522fb6b1f4582a6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e69c141284ef71585127f20282b1ac18
SHA1 cd63081fc98e6a3c75de919a2e74990a2170494f
SHA256 ccc6074f4c0f02d12aed071d4fd2c72da9ee10d41bb0d7502b045dece0e599d9
SHA512 01940a6ba5148989e3d2150d93035a9b787b1c10db555bca7c854d3af8223fd6f432918828aad11b394ffafaa71053986b98cfe02bf11385fdcf78a3af89b236

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

90s

Max time network

147s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 544 wrote to memory of 2948 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 544 wrote to memory of 2948 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 544 wrote to memory of 2948 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20240903-en

Max time kernel

118s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 220

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20241010-en

Max time kernel

40s

Max time network

19s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 224

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20241023-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 220

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

151s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Rhadamanthys family

rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 5012 created 3024 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\system32\sihost.exe

Dave packer

dave
Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BGInfo.bmp" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\openwith.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\WallpaperStyle = "0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Colors\Background = "0 0 0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\TileWallpaper = "1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\BGInfo.Config.1\shell C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\BGInfo.Config.1\shell\open C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\BGInfo.Config.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\.bgi C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\.bgi\ = "BGInfo.Config.1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\BGInfo.Config.1 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\BGInfo.Config.1\ = "BGInfo Configuration File" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\BGInfo.Config.1\shell\open\command C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\BGInfo.Config.1\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\BGInfo.Config.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\",0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4900 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2552 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2552 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2552 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2552 wrote to memory of 3876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2552 wrote to memory of 3876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2552 wrote to memory of 3876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4832 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 4832 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4832 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4904 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 4904 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 4904 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 5012 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 5012 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 5012 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 5012 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 5012 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1784,i,9733442102431718906,1671046684145387196,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --field-trial-handle=2336,i,9733442102431718906,1671046684145387196,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe

"C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar

C:\Windows\SysWOW64\openwith.exe

"C:\Windows\system32\openwith.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\chrome_100_percent.pak

MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\chrome_200_percent.pak

MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\d3dcompiler_47.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\ffmpeg.dll

MD5 5a168cb3ea9d0e7400baabf60f6ab933
SHA1 82a86cb7f42294ab4ad6669c19b92605d960b676
SHA256 af5f1bc9f6a73750fa0c7bf17439700cfb3ab23e1393f0c9899825417e319b54
SHA512 7c1441ecd049543e38297a7b6929e9f3eb978422d0ce508fbe6350ffebd297f947b8d9ec75bd2054142dcd8461eef1bf110e040d0830da977fde8944bece843d

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\snapshot_blob.bin

MD5 c8950b01f336b05609976546b1a007e6
SHA1 f04d0b0369007bbe6a7fe129b31b19dd1822f32f
SHA256 9b3a75a713e41bc73f219858fcac8e3031ba22732285ed3a64dc48074c725cc2
SHA512 b7db4277290e849a52ad5d31ff65ab5d2b75c2125d67eeee02b09e4e7001aa46d10bf89429c65695c7560d1c45b898c20275eb9e36cd8b259707ffb8b298f103

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\v8_context_snapshot.bin

MD5 bf2976da5086b48d74eb36f56f5deb83
SHA1 5aa7669a3e2166fdd7534241a0e7a9bd3ff5748b
SHA256 9f1614328e18becb4adf96de98bc91ce2a69274abe6621327cc0fc8503a1ab20
SHA512 c44deeb96597b4498604ecf2060ee0520e84a00308ca1f47ffdf8e3ed3e676b27b622ff7dbd4b6f1a14ce60b05cc2ad9b8d7562bb362c1b12a885ea7fbe50e0a

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\resources.pak

MD5 6772b597bf68622d934f207570e771b1
SHA1 f2a80fbfa034cb1fa07dc9aa37bf9f5b2280ff13
SHA256 268de4d99ab7c4f4ee32c8e8cb2b058a2c8d0d839f468ae8e8c0605feaa736ea
SHA512 a2be67df09951c9ef9200dcccbdff13736921522191f0001da539d5c7f26b5b26a6b810be6963908f216768c98d21e52486c7e00538cc0730e8c78e78811b85b

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\LICENSES.chromium.html

MD5 6ff57c0aeccdf44c39c95dee9ecea805
SHA1 c76669a1354067a1c3ddbc032e66c323286a8d43
SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
SHA512 d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\vulkan-1.dll

MD5 b6d3af84e8be0027741aa6077768789e
SHA1 e525f2434dc56f79644695f5841e91dd5f80eec4
SHA256 376ff6892ec7b406acd8c455ac82f8541e59e3757195488ff04cd9f20d554562
SHA512 f03b8792a740679c8a1a8ce0615b7876cc811130085f3ffb42182e0cb846519603804da97fc93a8abebee01e03fd257df289c54575da8faaad018f4f4bae606a

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\bg.pak

MD5 7c37c8c9b4215089b6c16d22838d256b
SHA1 8f2afdc21353685353a0562452f4a79180e58829
SHA256 2ebd582dfaa3139cd6a03e9892a94a3d9bb6936e0b04085b8f2d27e1dec0bc8a
SHA512 beadd70e9d706576bfb6725617385f776e9f68c84d116b01187354d377e2c860899da34f8c5a054c4bde41a57e9aac56445f6ac0b8da8c75a424641a86fdd718

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ar.pak

MD5 ac865ff462f341b4317c3d16eeb40460
SHA1 1e971d97f09884b23595f17534227ea43cf99090
SHA256 0557bc17eb1d134bd52f203836551b55579114708e2df51f653972951567513d
SHA512 a935b91a2c053303e941866cfc151f28053faf364aeece98d61fcd68fef6c6f1d3b73de01cd602c8a4a081cce452d1ce87f8166ba3c0e8b81e91d932f84737f2

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ca.pak

MD5 e1ac7f4c28177f68fac3be2375a9368c
SHA1 3d7738699087468a748f9b1189d2f7621187d03b
SHA256 efa1ba906f8abce91ebb9d6442b64e0d5ae7dab78dda8a49a6fed1a342c71b9b
SHA512 aee8cb28eb02e2fb2155c8d093cf678284e3571f46b913f743de3c6d0215c18b80866ff446f46ada160860ed9c18ae9a4209424e7e0f0ba97c78a3fe9815ca5a

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\de.pak

MD5 3a8de004b3a610271e1d1913b6d4b53b
SHA1 236893c3f7b450e6ad8b4d54e1a62b2e635b42d6
SHA256 43c060182c92caf4aebf8fd7b913dfe017beea71e796e862ebf8746575948364
SHA512 b70f849ccf7dd9e72d71522591420e0baa03ff74763b44563b0b3800ba3a88cb8b973fabb90bbb6653819947eca47f70e347958e3c31ab226957f7313bc03554

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\da.pak

MD5 43029018648d558f9bbf7a74c59eb281
SHA1 90c6618cccb4db85d7485ae8d809ec3af4763e70
SHA256 4bd88f6ab82842358987aad384775b35198dd75c2cce4cae783208ed69296a7e
SHA512 9e8ef9d4367ad01f2f4e7dd6f9884e463729ee5a0f678fd16a3ce093c21efc1d78041d5c6e45037f37bfd732e4833744485b00acfda2313a1d1e947993129a3d

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\cs.pak

MD5 92e3fd1eb47767a0cb5f6e734de4eec1
SHA1 33053bfead1fa67160b6a3c417ec4559bfdcdcfb
SHA256 d269e16fbd9b2afe95b148ece22b2ac803768fb53ee42e1fad0181f9dec84544
SHA512 916d73d9b28b0600878418a06388c2ed61bfaf17807a16e1c157a30e5da136c6b6f194e99d151c43b9aa35d101de755caa6da69e1c8a50dd134f27a7f2adc016

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\bn.pak

MD5 fc66adf3deac72fd39105540dd2daeff
SHA1 a53b54efcc1285a226d605116f87d12f69942482
SHA256 ef50cfebaf9e32edeec25d30197ac5899b3db8a0676671f639d32bc48f3b3bd8
SHA512 0b77daa056451d01a8cfb3ff1acc08d34e64e0a32bb119c8837ae3d6e3d5195311427c6101efd7e7bc9104aa369832bb12aab3d4080c00dc39edc98b6c0b949e

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\am.pak

MD5 e3933de22dc7fb98215b083d8a379f40
SHA1 68ddbd9bcc931f0d4a172fa65af35b823c7c9e37
SHA256 eaa747075e5a62be8b7df5908e167ccc5314c9c6a8b890059d00284a3c496fef
SHA512 7beb80fa029f41cb21536b15c604e2ae9dfc20b4a3ec4f5cc04e2b105d4b2c251830624957197084761f9686f95d332e25d4f6178509ad58257af90d96a9e7d5

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\af.pak

MD5 d9bec09b6c523dc3bca9a81264b1beed
SHA1 ea4ae9dff554c59994632f85af25b36c049fb5b2
SHA256 0b5a45de223ce8522cc296af1e93477540eaa74867428307cc3a5cd21921b022
SHA512 6e7677f86f73edffb5d6162ca19bb7464465f0f485ce2971fb20ad3f57d9fac56b7a21d378701f80e85fb185c3af6a238f8c8707f5874bffffd79d881a54dd6e

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\vk_swiftshader.dll

MD5 6720d5dcda6737eb0cc5a352a47414dc
SHA1 03d9a8e350f485dd955f7dee06bfc46371753032
SHA256 d8f36b089d83157abc271d9fe125919c3237943fa9789a511ac5ef1d41e2e3af
SHA512 de5ade6ce14b14957fce669c4181af1e6a6f540798d1c6720b56ff281f813a6ce4446bde33a8f175d2484e07f4911f93a773cac1d372cbe3b26be634b3fa1686

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\libGLESv2.dll

MD5 f055a130c79bd517bdb53b1f8a38bd3b
SHA1 9fba0ad4ba973bb285b23cc125004baf61a98b5a
SHA256 45b53759392b81ce7d916b3f1cf02be30289809bd31d09fc1524ef2609183b17
SHA512 d9dcb217f268862c577cacf4e9f84c63e02b647113d484338a74eb0b24fadd6d87b4e7a551dd1ef692bb38e44562bff848982acb62840d4f49f91a7751320e34

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\libEGL.dll

MD5 39ccf402a62f068a8c573b45ea96154d
SHA1 57ceb915ea6f88c7fcca35339bf951659c0338ab
SHA256 8649d77ace8e5753b9a10e7ae3349aafa9d8e3406ba9c8c36a59633a84b3c41b
SHA512 c4f9225c54d413176cb3dd2b26d429493fd056c7c283bc7a1c52b4a2059dbb11380daf5d847be1ff29f058ba0ef44d4bf66a3d9e9a600000dc8f6d20dfb2ed03

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\icudtl.dat

MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\el.pak

MD5 58d6eaf71b9b73f5f7f057c73d0d92ec
SHA1 16e0587753e7d2834f4cbb24fed45e7bd2f8f2f4
SHA256 8474879de21c414d34c44cf0a8c91356a66dbd647308a4f994be25bd1f93a89f
SHA512 ab24c9655bd68e4a64e257914a35dc84b5f791c58b396ae004bf5da61df19c02ef9ca572b8e63f15baf3694ae1e540adf74586f10d28d7ef90edeec982bcf28d

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\fil.pak

MD5 eaf43729e9bbd8004ef1ff56a3d85a48
SHA1 34b31ab8ea2ce6bd263f00acc50d5af8d0222d9a
SHA256 8559cc35335bb2c249297f4c7506df95cef899ef5f7ad942d2d511ae074d41b0
SHA512 010f8e5c3b969be0db4baec3acffdd69be25662387968e15e11af0da68ec2f45dc9edb83cafe7c92234e1e4e4aae1682223235af04d99e8b5238379e022e3d35

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\he.pak

MD5 16562c59fba469e1dd2f3b0b87a64645
SHA1 9a6863205fca8ea6d09a98b8e8dab543ff6198a1
SHA256 64fa2e98a9056e23c3a934ff39fef81c306cec5844d56dda17ec6c25fcdb1b5a
SHA512 dbb6e1a5e52a005386007f88b53109037792bc7b65fb95ace3e8cc5ae3ebd8320c7e406381c375bf751a9265ace84e0bbe1301d4bf3aa79200ec789dc3b3bc0b

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\gu.pak

MD5 6c949199eaaad8fcb12c38ec6c02d758
SHA1 ce4dbd5e6a37f25354ec6849f7008956ef3568ba
SHA256 966591a74e44c75c7f0114bb8e36b0e9f5502aebdc96c714c8a8f6d45bc863c8
SHA512 3344e0083969de6f4913893a14586b441f65cb5d45f913f1cea61b8d5abbdb3b1c18a48731870282174263c1f306ed6b99c279627bd269e89cd4e15dc3d88313

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ja.pak

MD5 5a69547f56dc61e482dcda1ce704c5ac
SHA1 5b7bbc8e9b14d78f2105136afb7728050128c02e
SHA256 a286a5faf9021927ec09fd8cbf30ed14ad59c3baa36d29e5491ad27b957915e5
SHA512 2b9d020544201e2d0b0b44b0977fcbab858563969ce02be65689c5f5b780adc4560df523589293cd66f42903322ed61d781da093adfa44aa0681a28d97de4556

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\pl.pak

MD5 8a4354163ff3b0978a568f781bdac289
SHA1 45de421f35af79adf962809cf8d0e6d2adbcb553
SHA256 2f6de0f9a46ae0b75beb67e09ffeee12483842a7cd6f2a2382ccbe36fbfc17e3
SHA512 5760f20228afe74e9ff2a916a168e8cc2d4a64d8e76065e61a7a60616a473c7dc3da4805125b270f179b7a0f291071e81d761d82eec3b130d552b57abd76c127

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\nl.pak

MD5 e8b790166d701f63a60c3b322fcce234
SHA1 61ec318aa8030f7d29c3258126b156d1d3eefa2c
SHA256 3d73b0110e5832b6a7c7b7e64018368464ef8552d6a98592d0adbf713eb9755e
SHA512 4e4b299cb55cbb5906ff974bb5e5078d2018298b5ee6d9ca0e40aab8db542aaedc4bd7a5db242a2c5194bc90c07631f627043dcc1a9f2d095a28c3e35f212dd9

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\sw.pak

MD5 a63ef2c4676dfbee98e29a84a7ad9d27
SHA1 2f0f4b33acf5e63f3159c62c74deaa9a361203f4
SHA256 7b8c51b247dea72d68cb0ef4292800c13209da6f859a9ad289c996582f19e65c
SHA512 cd65fd2c49d35757de648f21dec748fb4a1d13d2308552774fe9c859ad5748b21f5db449f8b380520f27dc868a3ebaafd58d4c45aba34033785777d342e17e6f

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\zh-TW.pak

MD5 0be25a48eecee48f428fe56fbfa683fd
SHA1 94c0e8c99beb592ebab9ea5b8758aa414bbe7048
SHA256 a5e276bdfe4cf87832eee153596ccde9cf9193e81f29a4295c8335525da64295
SHA512 423033e67654820ab9f9773f45f70908511aeb8228c59126757885e0bbe0bd960257324d405d27526d61b541b1e6323de16bef29d4dcb94f39fd5e92fa811cc8

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\resources\app.asar

MD5 f22ecb4d9ec69c266ed713cad8ea378d
SHA1 54317e92cd72895cec70a6c7a05a1a84ff692940
SHA256 e6950dcb3c57a32d89049fd7df783acf64b858c45f9bded621781977d55d7c96
SHA512 85ff75ac585da3e5565be38932ec03269af7db93084f8d8d1c45fcd298a26371841cb61c66e36062011728538514b1e42bfb7e35dea513cd82102db45854bcc9

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\zh-CN.pak

MD5 798bc7d8b63906c5b1c67e89ad17dc58
SHA1 b39c86d6d3fd9d8b8da90d86f827a0c0803fba8c
SHA256 1c05280d8dcdfe99619695b76dd054292a90c1a93a5cfb92cdc4a5b0068a7092
SHA512 7a21af438823d562b889d7c99f639421e01f0536e95f3206dd53d2c8ded82b7a4ab74bb9b4262b2fa27e50efd8dd7719827ad2e6b6d4c2e0d0811930027ed982

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\vi.pak

MD5 045241a62232bae57f1d57c6c3af7c55
SHA1 5c2a1a677a8bdfa20f3577335131bd4b89a46355
SHA256 56758c918bbfe6a9d5b20e8b4a7248bdf2d43e0bf5f98e85a9892ff03dbc2d99
SHA512 8e30af44a53a36a194da16a756dff0f90efbef164277bdcde683c89a3cdc04ae5e1298475e8a098d19dab73eb0a71637f676d49d237c5480e1f7aca1765166bb

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ur.pak

MD5 cb228cc41981e8bcbd2768da20026912
SHA1 c55bb999c4c1fbee5e38b6c986fbce2b128f3880
SHA256 a7d825fe348700528800ef9ea7940ee8027373e9c05a4e51e526d0a213c05429
SHA512 85308806be53494683f32520e181dd9c8c9abac0b92bc439d4e30eef22d4af993794a9719dd9a4eeed0bbcaf61c0e2342e7d4ed5d30b504572bd2bc269100e2e

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\uk.pak

MD5 ec3aa18a9d9c989b1025dddb0fa52b55
SHA1 ab3b0834cabee34bc2f9fd04104b10e5f9c102ca
SHA256 ee67744c26e0c69fbed8b102add339070aabc70c2d8ca9ea037c6c9d23b66d3b
SHA512 90d40424b050c6c7ace113e85b0b0a58472967c50a14fbc6637cd3b2db8ff3f521cc94dcd256fa017684256e8a9c19b158aaa57f6d3094fab970578d3b1c6847

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\tr.pak

MD5 82c6a14ba1b28f947bee67bc3feab091
SHA1 25023b22eaed29d0817ec95d5bcb4ad3d724f5ad
SHA256 099507f6f2a2c98ecce275f8ad956eeeeaada65b7788356301af04a0cd7d431e
SHA512 988a9275b7a05d100ca9242dd05969d2363a42938d47db37a1f62ec1874e96b640c14b272f1829ab5c6e0d2763c22fbf0af99894d4d9d32726925eabbc02c05e

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\th.pak

MD5 b18e4574db917920eccfb8e6900d0662
SHA1 554206b9e639135074b0946fb28b6ffe2d934159
SHA256 c14fa1bb30c880216d6cfea6fb738235cf72a3fe8be919c3d61321d5a5883211
SHA512 5f427f9ed85bb368b45bafd523c634e18596e430fdc380563878d2ca897cf2580d0405f7c0d8e10abba389bb7125978a81d335263bb777e0ee0bfe3d47c8c65f

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\te.pak

MD5 a4accc25dd8a00bc57df4fca12e41295
SHA1 9466888034c9e6ecf4113ddda63d363ed20e3156
SHA256 157d646525f6a9ac267466631671e65e9b5c3e55b008b564186e64c6853e52aa
SHA512 f19116655b6c2bb5c572b45f1d712fa1f9d57d9e8963fb3d654ed3781bd34a4e937b590bcc1119a318e28632da12a0ef8b36f6426791de833898cf7f30189567

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ta.pak

MD5 aa06ead1200f01c9460399f0abe2d54f
SHA1 9b852c4691209c0ae9edf94a5dec4b902fec7b3e
SHA256 1946d903918c57836d2f898ef93cd1d575da1a464e358c399dfde73ea2ef057e
SHA512 6e556b962c16aee22695d93b62b308d95b0695873fb33d13a147b3d8b6791c9599daa6e3bf424a1897212a018ab36dd8c8214c2eb03457048c6931686be40e04

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\sv.pak

MD5 cc0806219798e3ade0437219457a37ab
SHA1 dd6ba47e14b7b0d08159fbca2409b013dc2e17de
SHA256 79a7260c8651ff3024e21f9263543bf4e9d5f3574e81cf96edf6388f8da85cd1
SHA512 df3da02bb2fecbbaf1ab80af8ef8b1a7ae9f6c7ed01f94c5a502720376924132c344dd716fc5b4ddc03733a6c3581ed8d8a577154c619ba85c527dc67f4a48c2

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\sr.pak

MD5 abdd9eb966d915c1896b31cba0b2656b
SHA1 cb0080e5f2c168cd0f3edc6ed6c47734ffd67790
SHA256 3913d3be5016ce873ac68af376d5fcf558bb5f5f29a9bc56df0099ba47e52486
SHA512 bcb258d6da766bb6f00dfdbb03bc878000d9cf28b2b707375ce52485db9c530a34d1528a1473f09b5765bc57abd847f191bde55646eb707443cd0e40509b70e1

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\sl.pak

MD5 aa7c0f35b61a230d65e498daab67388c
SHA1 f60cb1c7128a1fb1cfd9aa029f96df36033777d0
SHA256 03afc83cdba98c08af169c8ae111aa916f3ee6d5a2fee4954ef35ecc063f2b21
SHA512 048d03c490f18d22f4900363f9c4abee037a2029f226c90806064ffedc85b07a1d86225b9c534311b08f588632a84221d7e4fa355e7b768cfdfd6102c5ffe705

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\sk.pak

MD5 b0bbb6661370d27b6600ebe98cadb9ac
SHA1 1139852da47048f15c16eb101dac86dfc8f652ba
SHA256 e0fe4130e668ac659d5334c5bc8cde70bba8742273b5965836860b5a8b1b016a
SHA512 c8eac323552f873ec088f77b8c46522387b0298b6d566cf8aa173fa9b2d66389068bb26e46044af2faa4224b39dc748164843b58b99e9dde093fcb32afb5fed0

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ru.pak

MD5 e9af20a6226511cd535888846a2bb16f
SHA1 739a46269f334ecc291bae6777f0b7c8e271e4c0
SHA256 5db640c6c288d9fc79012a7670301a3bc463359c17ba200aedaa56260ef8d955
SHA512 7897c500718382f08d55f3cddd96d1451524b5c2b8febc65e1700a645598b622c819ec66e4a21c119f044faaa525a2abdddf66d0c9800af6ecea9ceb217a88bb

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ro.pak

MD5 5db10edf772656c0808dd8da698334bf
SHA1 3caf7c9d5a3b44e06e0588daba698b6970ea06f5
SHA256 73b6a63352906d77196f38a1df937ec0770160fb7a93321867c7994ed3e7967b
SHA512 eb253b548c7f574943136764a23818f9dedea17ff42f92dc8591f4b7c297accdde9f6b2c0ad96f1fd0815c53940c0102a90c603f9f4d6d9c8fb053b559cc7a62

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\pt-PT.pak

MD5 cbe5e35f844f5f1400df3685cc847694
SHA1 e60cdb0a813a97c8548c878276bfae155350bb42
SHA256 6b9bd714d217d596183894ffed3174a617e1c8cfae292231d4b967183b589c6b
SHA512 96046c97436a3dbf5aac479b9eaa9dfdcfc81f1edcaee9cd65d59beb0ce6b6b42828e0d170aaef2ef1d68988f7916ac1dbac0d84218de83fedcca8592de4c1f1

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\pt-BR.pak

MD5 b1ab7d7aa67a7b61bfa9aebad0b812af
SHA1 95eff4be517c0a25c34578def10d48c77021de1a
SHA256 5bd503c413aaf8fa87fd47c341d437accc25397a50b082068bcf2f3bb4fb27c7
SHA512 8498fe7727771df3c1eb34560c1e25b0c30690c7c921104b4adcf04cc5753462bac513a60a5833cb6f57733201d4883605f8a4ec4a457f3ebc7c952090b1a9e1

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\nb.pak

MD5 2a0ec73d03d4d7fcec71ad66cc0d4b30
SHA1 bb8df6e11b02086726ecede97d5f729f4197323c
SHA256 d44ef5e644b1b8f7c056d5e20651515fcc8565befec575091735fb39c6d63554
SHA512 cdcb4e436270156e263d731ce243d821c5361b18b6d7b8259875c9d895301d478a87feb7cafc3376d09d18d27f32dc403fd2cbd034d68736cb968bbefebd642b

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ms.pak

MD5 6149507c3aa99c4012d9d7cfe4bc30c8
SHA1 51a2bb5cbae64f3877afc342ea0f43915702f8f4
SHA256 dd75481d67d9be36ecb2e421117395fbb75b7623164f13a09be1cf3ce76d588f
SHA512 71f8dc03618d46be7b036353526bf20a61e648ef50adeeec057d314e9a4536899c37ef691164bf9de9e10a3867749f8d3d6f4038e16c82cf6122e7ab4a1c7732

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\mr.pak

MD5 0e5b29b6ae74a1f94ca4f880f131a79f
SHA1 6ac5089ace05847480d2aeec89954124caa781aa
SHA256 25bf8e86f7c9e88f68d4c40c4f124c16f60daf22e7a87f55ba2c560a0f640bc9
SHA512 30717c0aef4458bbcf7472316727981829edada8be3003afd9d65cb01d4cf309f601b1c41539343d6239cb2e9157554c95cf966a4156458a2fd78d2464075c98

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ml.pak

MD5 d32a29a61e8afaba6b42d236257d9929
SHA1 9664f50ea7590a47c2eb8eb4a3e49be556d08f7a
SHA256 a59fd15c969ee8ffd7e72f5a2245c6a5a4fc048f7899fca489d78c8f6394ca1e
SHA512 2668976853b26b22859f8c20afaeb4d641845e94779b8994b49f240302420279e3f9a99666b8f551495b7d5a8c3c83609b7ecf276fabd8345cc8c787319ea3d2

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\lv.pak

MD5 00b517ce675a3089823708776c6f9302
SHA1 2bc24f150adaafd2604c5d95bbaaf8dc983d7da2
SHA256 0adedd1eaaf902feebb208220d9f21ae1b0175e74f6a966cd7ed226146d86ae8
SHA512 6c19a0d779185141fb050369f9fbfe60d0b838e55e2674e3f14a67e1a6970727e329656e458ca8516a41c97b20e67eb1789587af957129b3d32c94a3536ab12e

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\lt.pak

MD5 7cef6e31d76861db4d7d622fdd89e5aa
SHA1 31fa45c3b7666259d4d8a13518ece423a97edcca
SHA256 2f1e1c69da5cad8f47e45af0ac47cec90c20fe2897a43cb496c7feed1ec5d1ab
SHA512 df66a739f3a8da62a942b56b23f71a2b68469e87dc44eb8ce1a9a859a609f1db4bee2497defef06fa48e14cf461e61410668a5216459c94c79f4b69a3cf092f6

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\ko.pak

MD5 4b563eb612d4fadc6bd8a4c918006ab1
SHA1 4b9e414af0c044c4487d1439d23ef11b0169d308
SHA256 e0d4461452607e0f4a619efe653ec9ec39f7d34a742ae98374b2bce0b821adc9
SHA512 b8c56d69fa41ad14f7197acab1ba987ebb06c5b15748e21cec27861721545e30fb20f76f2c3a752c8ea94cca1e6b4fab7fb0727b679a8fb8e94db2d5c028e7a6

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\kn.pak

MD5 52a0707a70b939bcd75b0838a5dc5357
SHA1 eb9e1350d9d217580b1939302d008dc07c3b781c
SHA256 b177eda102b1be8c53127e3bb47970a3c1e2032be24900d8a126c5f0f077ef3d
SHA512 d5fe69035338c4308f661fa0ac25c4a811a6014f6bd85ccc7ad947f76aecf76f67208512e1266e249ec067a5fb22fb74a3550b0f3aeb1bc50fadb3a9d3cc67e4

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\it.pak

MD5 6aa3bc3ee4999c324b82e50940e62c74
SHA1 10af8030fc2f875e133c9417e0221528160ad8b5
SHA256 73cc8422643a65753b2c3672c8f8331ee92c9bddc912576554e95b0986cf990d
SHA512 f039ef32002e55d09a4f567cc81fe2b3b329d517c985436a5da121ff0e6ac7e258b5d1fdda81e6c1578daf7078b91abcfb7da98cdba6693d4fbe7f28115e6971

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\id.pak

MD5 cfc848689a25f5e2e6ba9a06e09b6ee0
SHA1 35131e775d98a57ffcbd6a75e69f6f67437636c3
SHA256 ec1d7bbe064656dc53f70e3a612a582f5d5d0af5f0c2d6a783796cffa5bf7f57
SHA512 d5a027e35dd3846f5255b81eed36a3498ac9d809367692b2da216b5771c2d54fad35fc15c15705a2bbb4a7b35dd2245661882734998f9bc3ad8d62d2273b6577

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\hu.pak

MD5 7add28fbbba1ce87972f6433862dcbaa
SHA1 8b4b0053663c0b69beca59faca79854a89ab9c97
SHA256 dd86976d72f3cb644b90c1863e29e2f8616b09ac4acfe9301fb346fa0d87bd78
SHA512 efed0891b0202bae9396df54f141a73bb6ccadd7947330fd9e6a3a8911e9e037454238c4bd2bb9075af3218230c9e4e394f83a70878396911faa282d99fdd884

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\hr.pak

MD5 fda338824b4171b10dcc3395a549fa9f
SHA1 ea42c8b18228e0ca57b8ed7ed48e3a2aebe08486
SHA256 43f370368b322cd1236632c82aa0e231965dc58fdd497f8aeae6b40eef9ee611
SHA512 9115f805f51f45839e0a87cf44c1cce311cecaf717c0da7db3b6da85cea95f24638af29da43bc01056994b22049daa0387cd4371c13b8e5399fe8f4e38771d57

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\hi.pak

MD5 6aa92c296ed09fe2aa94dc060b25774a
SHA1 7619ed3dc5b1e04c55b0ee7280ac2d0135eb9c80
SHA256 0c771c66db4f80a62912564944c4e239f8dac8381a06483ecab512e0d75744a1
SHA512 9255a4ffef7be07ceab5dd8f46365b9a52d621ae175c1022bb4685fe4f3ea63425f45aa9ef824b467b9c33c51a7104258e888e8ec15c88fea126bf0b5337ff14

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\fr.pak

MD5 651e4cb14c4f784d36d0a1715c52dcf3
SHA1 540f6090e3223ad8e6424a9db78305f2db9974bf
SHA256 6d547cbc3304627d14aeb138aebd40786c30a4192e071d80bcecdb77a13ac80a
SHA512 1fe93058ec434c06ef4aa1519333ebd831311971b06d7279ddc4d86dfa860bbd6ea6d127b2a07425c3e78bd6d41c11eb2a76cf25b20c6a7de74d1f0ceec87079

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\fi.pak

MD5 125a121c22dfc2b1a1c759cad9123e42
SHA1 d0282af9ec311c406ecccdfdd7216b7d883e94c3
SHA256 b733460f039dcb3795077ba91dafa3b9b8163dfd0f15168b250630f7de21ed0a
SHA512 c6e0ea8fab8115a632d4c74141efc46ea546f43e0b806d5bd95a1ecd3b8fe37a44565a2f79c43e0bc50dbdadc5d16054e07485fad83c99bd3550a907c852e724

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\fa.pak

MD5 caee902136579f4bac72a6f0f75d171b
SHA1 cbbaf988a499005e21fd86652e1f48af8bce2c35
SHA256 e86f677e9654f6a16a7738e85a5a5d467a09cb18e47654f079506a00affad70c
SHA512 c0f2e8457f71789da8ce207aaae2f83196daac868fcaa7a84de04dd38730f8831b9643b8a404a7aa59c5b726da02090bba414529019f5eb9c94ac5a5af61bc9d

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\et.pak

MD5 8e2c2cc8c516d8b7181c0c712ca24513
SHA1 e0ccd9ed8de6640379f822a067dcf97d4bbe44a7
SHA256 c96937f46fb1b1182b201f5c48fe1da4d3f94a68a0e6e0699ccc0944cd0a5a33
SHA512 339bc655f22068f2ee9352a670325865265e4279197430214f7e3fba575415318110cccb03aed2c0e7ac673d4629bd495dc34a56cefbcaab62e1c4a1a87ed8c2

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\es-419.pak

MD5 85e9b056e3ac3f6a5b113ed9f460e202
SHA1 dcceef6ea85d71a85dd24d17ec65371dce76f480
SHA256 16fe83762ed578c49685868418325920a72cd457907bc4e5264f2c172d53b27b
SHA512 e4dfde9c1260df1f77b7ec1797658f8cfeaab98142a8d512ed3bfac054933a4583f20091b97985b4ba9cf93f9faca3e7b0986cb4a3eb12fe0bc04ee1c45d3e0f

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\en-US.pak

MD5 752a3feed3ab6c127767c8fabc9a40b6
SHA1 4af9f9c19904d3bef154b469858dc44b1e630a75
SHA256 c6a6c5d7ab6119bba712d6fe45fd385506d4d0dd8e4156cca3925062f4502ac5
SHA512 ae96d4f391e36f8f741671b72ebd4b1ab2d049b2a99b95737fb9f81743b9e414b46022b65194af5616eb354056addf0e46ef090f56b7d945ef2cb5f4d100d64f

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\en-GB.pak

MD5 985558de03bf486aec1daadd39cb508d
SHA1 b693ddef983e8af212936202ddca92d908378404
SHA256 1956d448a4d333638f3601d0da976710cbe0a795504eb694ba18311fe586d195
SHA512 13d1c82b797ad4ff25a94a996f9fb52b530643a0e735f96e32b9e0698962770148d95db7beb91343d781fb84378a3e334ac0c1c913d8dbae20f425bf0dc364d3

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\locales\es.pak

MD5 3db06ea954c83343bd333c15947f521a
SHA1 ddde6ab9f9085e83ec8bf7a37df3389040acea42
SHA256 45df7340fe3c8560b11ffba2219de1b5c45dbfe57b6db90bd6c246244fae338a
SHA512 cc29f1075c119daddaa108c17abb6d572925cac1ed2237ed2fd45364bfb2a00c1144fccdd22c6728c954af2cdd1b9477f39968ba25354bca2b9dca07f5c53dde

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nsaACDB.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\ab83a7c2-f0f3-4ff1-8d53-f594321c8898.tmp.exe

MD5 3aef228fb7ee187160482084d36c9726
SHA1 8b76990c5061890c94f81f504c5782912a58d8a6
SHA256 c885df88693496d5c28ad16a1ecde259e191f54ad76428857742af843b846c53
SHA512 e659a7cf12c6b41879e4ce987e4cd1cefce2ffc74e06817667fa833764f36f25cc5f8374dbc844b68b787acac011c7b8c8f2b74563bf8a96f623ebb110a593da

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\encrypted_shellcode.bin

MD5 9827ae88a9588b26de69046117d21c81
SHA1 c591b24672b8509dbdc087fc245a1f7fea3b1d9b
SHA256 3560f325b7a2c0918910bddd6462adef786270959e765069fc6dc3320f3180a6
SHA512 66c1f90a4a9dd2b31f9ee3e1049620bcec5bfc644546d4e18b651bc79b45e58a73e82d676dcb34819e59735b3d92163e80b9b1311285f6f452f97020439497c6

memory/5012-845-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

memory/5012-846-0x00000000013D0000-0x00000000017D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\version.dll

MD5 f8e8df746881bb6c15c61fee344b12ff
SHA1 6f5d6bbea6b3ef8f931fc18b51d0fdffa6367430
SHA256 4ec7e1ee6c2080e341c2a94d90af71d17d1f8f38bab8fc556219d11a79fabf85
SHA512 dc231aacd9e754192ca160823b465c9cb9ea3c9bbe35cf485428c2266c8112a292d05db7942d1ced210c072d71036a42777533359e7f34881bf0038940bfe309

memory/5012-848-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

memory/5012-847-0x00000000013D0000-0x00000000017D0000-memory.dmp

memory/5012-850-0x0000000075BC0000-0x0000000075DD5000-memory.dmp

memory/3644-851-0x00000000006B0000-0x00000000006B9000-memory.dmp

memory/3644-853-0x00000000022B0000-0x00000000026B0000-memory.dmp

memory/3644-854-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

memory/3644-856-0x0000000075BC0000-0x0000000075DD5000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4480 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4480 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1524 -ip 1524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 74.239.69.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

140s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2592 wrote to memory of 2676 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2592 wrote to memory of 2676 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2592 wrote to memory of 2676 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2676 -ip 2676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

148s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1500 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1500 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1500 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1320 -ip 1320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20241010-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2088 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2088 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2088 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2088 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2060 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2668 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2668 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2668 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2668 wrote to memory of 2436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2668 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2668 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2668 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2668 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

MD5 3fe065f3111d58d008fb8eb403a11a7c
SHA1 74ee9374e92cec677f39326d58b5f740b438cf10
SHA256 3866f85e7e0524bc2b5b43315da8e721b0e031ece4462329cab4892756abcebf
SHA512 e314110fba7203dca4ca71e75330c578889e3a01288be0dc1b04eba311b231199ffbe89a4cbbe58531b52c042b801dcb12fbe9e9f19e1427228007dfd6cd7ee7

\Users\Admin\AppData\Local\Temp\nstD8F2.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nstD8F2.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nstD8F2.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nstD8F2.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win7-20240903-en

Max time kernel

119s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 220

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

91s

Max time network

143s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1096 wrote to memory of 3928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1096 wrote to memory of 3928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1096 wrote to memory of 3928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3928 -ip 3928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 636

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

161s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Rhadamanthys family

rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3628 created 2716 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\system32\sihost.exe

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BGInfo.bmp" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\openwith.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\TileWallpaper = "1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\WallpaperStyle = "0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Colors\Background = "0 0 0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\.bgi\ = "BGInfo.Config.1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\ = "BGInfo Configuration File" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\shell\open\command C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\shell\open C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\",0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\.bgi C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\shell C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\BGInfo.Config.1\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 1372 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 1372 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 1372 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 2892 wrote to memory of 3628 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 2892 wrote to memory of 3628 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 2892 wrote to memory of 3628 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 3628 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3628 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3628 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3628 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3628 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1760,i,13540323998040460544,582911560413161674,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar"

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --field-trial-handle=1984,i,13540323998040460544,582911560413161674,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe

"C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar

C:\Windows\SysWOW64\openwith.exe

"C:\Windows\system32\openwith.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\d25ca1a2-6009-4a8d-81ab-3069add68aa4.tmp.exe

MD5 3aef228fb7ee187160482084d36c9726
SHA1 8b76990c5061890c94f81f504c5782912a58d8a6
SHA256 c885df88693496d5c28ad16a1ecde259e191f54ad76428857742af843b846c53
SHA512 e659a7cf12c6b41879e4ce987e4cd1cefce2ffc74e06817667fa833764f36f25cc5f8374dbc844b68b787acac011c7b8c8f2b74563bf8a96f623ebb110a593da

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\VERSION.dll

MD5 f8e8df746881bb6c15c61fee344b12ff
SHA1 6f5d6bbea6b3ef8f931fc18b51d0fdffa6367430
SHA256 4ec7e1ee6c2080e341c2a94d90af71d17d1f8f38bab8fc556219d11a79fabf85
SHA512 dc231aacd9e754192ca160823b465c9cb9ea3c9bbe35cf485428c2266c8112a292d05db7942d1ced210c072d71036a42777533359e7f34881bf0038940bfe309

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\encrypted_shellcode.bin

MD5 9827ae88a9588b26de69046117d21c81
SHA1 c591b24672b8509dbdc087fc245a1f7fea3b1d9b
SHA256 3560f325b7a2c0918910bddd6462adef786270959e765069fc6dc3320f3180a6
SHA512 66c1f90a4a9dd2b31f9ee3e1049620bcec5bfc644546d4e18b651bc79b45e58a73e82d676dcb34819e59735b3d92163e80b9b1311285f6f452f97020439497c6

memory/3628-113-0x0000000001220000-0x0000000001620000-memory.dmp

memory/3628-112-0x00000000007E0000-0x00000000007E9000-memory.dmp

memory/3628-114-0x0000000001220000-0x0000000001620000-memory.dmp

memory/3628-115-0x00007FFE5B330000-0x00007FFE5B525000-memory.dmp

memory/3628-117-0x0000000076080000-0x0000000076295000-memory.dmp

memory/3304-118-0x0000000000BA0000-0x0000000000BA9000-memory.dmp

memory/3304-120-0x0000000002A40000-0x0000000002E40000-memory.dmp

memory/3304-121-0x00007FFE5B330000-0x00007FFE5B525000-memory.dmp

memory/3304-123-0x0000000076080000-0x0000000076295000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win7-20241010-en

Max time kernel

119s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

147s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2352 wrote to memory of 3148 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2352 wrote to memory of 3148 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2352 wrote to memory of 3148 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3148 -ip 3148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

159s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3256 wrote to memory of 3356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 2188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 2188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdef3746f8,0x7ffdef374708,0x7ffdef374718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,16569222306636194120,7992948634516107542,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4008 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

\??\pipe\LOCAL\crashpad_3256_RQTXRBJRRZLOSZYK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 756f80e613ca683a0ce7a130ca7f5b9f
SHA1 33ba9938d3834926f54c2dc5ac17464b95a34eb5
SHA256 3fff204f5b6299500df0a3a312669012a068c136f213144c5d674d9758ec528d
SHA512 5233e3079e34253e3242f68352025e4cfb01583dd5f85ac8171fde720d8d5a7e1836bb134230fbaebeeea388b64baf25789e56b28990fa4fd7834b2e73c2f452

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c6bc470fc7042ac95f7533fe8691980d
SHA1 52cbed5eaeb2537fb91e14d0b2d756c2a3aa5eeb
SHA256 7265856c448d3fc6202c2439d14280615bed73200bfdee5cad1e35201dba7e5f
SHA512 f9662d24fa0d823fc517bbe01697d66bda0b3fdc5096ed12c0eeeb4878852aed6eae6154dfa2629bbe442aa284ff270b936fe29b72495708a555553d453ae529

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5c7ad6afefb914c744355b576cf53406
SHA1 e2b23103b85b361573ea21ed7d4af42300c43635
SHA256 7870465947386152807217d37d5e28de5c718de805e5690bdcbb50c585f2ec14
SHA512 1436bf88ab38572a8511de698f2ef9217f9a06cf496c2598a27383baf19c8bdd4bde36372cfbdbec8952a50e6ad2d846d6d599aef0dcb722098e6d04e28f0644

Analysis: behavioral20

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:47

Platform

win10v2004-20241007-en

Max time kernel

89s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win7-20240729-en

Max time kernel

120s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 220

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-11-16 12:42

Reported

2024-11-16 12:46

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

MD5 3fe065f3111d58d008fb8eb403a11a7c
SHA1 74ee9374e92cec677f39326d58b5f740b438cf10
SHA256 3866f85e7e0524bc2b5b43315da8e721b0e031ece4462329cab4892756abcebf
SHA512 e314110fba7203dca4ca71e75330c578889e3a01288be0dc1b04eba311b231199ffbe89a4cbbe58531b52c042b801dcb12fbe9e9f19e1427228007dfd6cd7ee7

C:\Users\Admin\AppData\Local\Temp\nsnCE1E.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsnCE1E.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsnCE1E.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsnCE1E.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f