Malware Analysis Report

2024-11-30 02:19

Sample ID 241116-rxayrsyaqg
Target ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe
SHA256 ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426
Tags
discovery rhadamanthys dave ransomware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426

Threat Level: Known bad

The file ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe was found to be: Known bad.

Malicious Activity Summary

discovery rhadamanthys dave ransomware stealer

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys

Rhadamanthys family

Dave packer

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Checks installed software on the system

Enumerates processes with tasklist

Sets desktop wallpaper using registry

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks processor information in registry

Modifies Control Panel

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-16 14:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

139s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1924 wrote to memory of 3140 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1924 wrote to memory of 3140 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1924 wrote to memory of 3140 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3140 -ip 3140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 616

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

157s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3236 wrote to memory of 384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 2360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 2360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3236 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb68d046f8,0x7ffb68d04708,0x7ffb68d04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,482545752347827664,1601903366987736033,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2744 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

\??\pipe\LOCAL\crashpad_3236_UDUATNEFCLMTNYDE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 95a3b6a16121a59b42c0203b19fe977f
SHA1 98ae03c5ef0b210fc25e408cf8cf70ec90b0a20c
SHA256 c17f8e4b7d559fef7343656c2bb61685cecc703a85c85ace7d26b841575ed6ac
SHA512 aca40b07b3c3f815dacd833d7cc0084206abd9591de78c41a2882bd31d5e3cda0e1545eed6a06946c7371986b2542e61c8dc4166554def8122cf713666901a96

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4ef47940ca81a76f24e63d2fdc1f991c
SHA1 e9582b687fb051c30631f12b10382b2e6777fdd9
SHA256 72179521d0464a5c5f12a06f44c6e648fbc124d95015a9ff6697cbc3d748cfa4
SHA512 811bd2edfd8fb2be3c9c39498013d3ebfb4c624c3bd3d350a78f4dea3770fae9ba8cea89bfc8dd599cfd487625b3aa27108ae5197c9cd66ee25d4f4bb4fed599

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 57d40638474290eb711cd60da14e20af
SHA1 ef75850bea16f5d6ce7b4bd3a349ffc53f47506e
SHA256 efbad0d6cf52c9d6a78ef8912becdee2aa5cf5902d1b39cef3e05c17f080d9fc
SHA512 2eb00a49801a45e8ffda234e2b6cffec9ef52b201faf004ccb603ede08281ae813c7f7e208000223505d653c53309f002d48ae7df3a854c2147946981e95a175

Analysis: behavioral25

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 744 wrote to memory of 4620 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 744 wrote to memory of 4620 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 744 wrote to memory of 4620 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4620 -ip 4620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20240729-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2716 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2716 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2716 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2716 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2716 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2716 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2716 wrote to memory of 2680 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20240903-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 220

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20240903-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

135s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1692 wrote to memory of 4996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 4996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 4996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4996 -ip 4996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20241023-en

Max time kernel

119s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 220

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20240903-en

Max time kernel

121s

Max time network

141s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000007e255ee2afd9b325ba2ea0f4b05a425510d6568e94a561303cc1d167cccbedcd000000000e800000000200002000000029612f5d17ad95bd677303de8e2cb952acae0903f130f45b852c979ae3f85c58900000007bc49c62d9c9132a4368f108b445aaa6c3cf5372cff2e62501203e6e3bae9250cf7d90f0dcd5ba9ee3ccf471d601ae6d288f8e95c4e0fe680a3ccddcc64624b2238737f7cdcd7aca1fb26f05baa7f75736ace066e502b02ab477dee4c521b69db9ff53f2700d0e310437cdeba9c498ab44c2c17776a599d40a81e39b0f21d6bbbb2edafd566f15a863ba4059ef7bf11d40000000856d87b0621d744dfd844bc49c7ebb1498d8838c2ab1a32a6626c3b9d5f46dfc3774899368e43fcb152d13633c6e437bdb6c913df0c54eae4e08ce6ebe965eb5 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15937881-A428-11EF-A045-62CAC36041A9} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b8adea3438db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437929624" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000049d39ab156c9b0d74d94530b28d1d60f7fd00dbf263e447cf79801cb21137994000000000e8000000002000020000000ef3566cd481e4304d19394ee6bda9116631bbf5beb3f936074ec67cd03717fec20000000cae928176f642205105461505774b5b8a5408ebf787d48817fd307f2418da72c40000000af4802dff42111c43d72bfb06fad2ed0a8cd12ff382fed70ca71d13cc42a312361d92c6672780c02dd7726625b5871722d409402993dfac860ccab362e976114 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab1DE0.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1E60.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 efdac7f1ab5aa2467483382524e4cdea
SHA1 df7a328e8f4e6ac712712eefa2afa8c4a17704dc
SHA256 4558f9144217d3c3fa2980e043194d788787a549ea9b1ed08c3eac05519263f3
SHA512 3623dfdfafe747dfdd0fc092b2ac8198f076dfa2650daaea03178f8617ef925825b8b40c6f3e096a71724353b85eb763ed13e83276c795a789dfe07a712d9393

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 080be608c7ddecd8d37a69b4a0cfbb45
SHA1 588d7b54e35d3d128bc23969f93c0cb642fec879
SHA256 8184e5d4929d7ba6bd7e095763098fb405175ea6ae7c8147cdd3cdb0b4ee5e4a
SHA512 1d2aa32cac91dfecb9d051b5d751ae4a64b139d5f51ec1b704f4cb8f37f977e29d24feef97cd03ddeb17c181c7afaa38d909b7160a0faef44773dca04efc3d7a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 69ce3ebbbd8a4901c9d79ac4caef83fc
SHA1 df33f7830b1e28f9d6c1b8e4c0649f57eb24a782
SHA256 c1f63b2ba57c0a4b970faba837da43e8d13c9be884e0cea4f2b5f487b73aaf9a
SHA512 3b84bf0a12c0ae3bddb5dd988d0718efbcf8f8550953962a185ec9018fecd8e6da986746c22b04504eaeb37d8f25116be1daa8d4d338b03962d00b8194e020af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2df0749a7f540a0cc898e8149362d70d
SHA1 75a2173eb11e47fd7ff367cbb4ccedbdf46e7ad1
SHA256 f63b2b77bb6afb285a225e6ebc6eed0a339885cba415e8b20f56de4a05e80957
SHA512 e7bc9e2c352b50e8a6b022be15acf208c769d5966372ebfbe034489b1f240ad7fe495e061960ef1c1c656b86f2b58985db459406484341a615839ba6b65bc429

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93d4054cd869d0181ee3c80a347b7eaa
SHA1 2e19568774514d06c727ee53ab63dabaeef2d5ae
SHA256 ce24286025011225e8b38d2cfd8c8ad702e4c965f2c0b27045b7a12d130d72b9
SHA512 747bd23379c9a92028dca6f465c39a956ee367b38a02206ffb6c94962813a0c2f7095d1ef1aa5b197791bdc0fbfdcf3965d656e5cf2a4e06e47c9ec2a9aa2a95

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c68b6821eb9c10ab460ba4cdad58dab3
SHA1 a7bf7dbc55c974ee30a314f106fb6468a41c21d5
SHA256 11ac522910de9b6c60e802b513ade2b8811e478090c7e82d47cbf7fd2e8cbe54
SHA512 8637e7940a5f82292a3f9d7461508b015a1b7cf8c8a2a964d6ee68edb13f1546e92b4ef34934f8e233c8f4c6589cc92a34fa654ffcfb60cac026a09ae6ebf60b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61e38ce1054877a1c2d4a96ac1d4d331
SHA1 37203a13fdd2384de2547842418193b4b9393780
SHA256 0a7e6c932fb387316fd87e0c7fa186b4f2fc9210abdce651e425fb66556a0677
SHA512 82d8a5f01e2bf6c4abb585e8c42eb357e4f60e9e75121791e3c145e4f801a97b93fb6e305753e27c85703d0b4f7627228ed2622901c4d70946937431082f54b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 62b757756b8aed7904ad6d17655f1a5d
SHA1 3fb344ce1a4998db2e39e3bbc5a418656436d4af
SHA256 72e73180e079faa46028ab26d7ff4c4f682242a30beac6c983afcc5befe7bd0a
SHA512 e04f9af565ae600090d326912ba76052319b78b21464bf48e033ace6e8c347424f4d6130836f75db967968e6db5852b9d40a35f183f7cb3a809015c34a1f0f44

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 029e66e9569d09a9a62deaa7324f80ad
SHA1 c2abb22839f2106c3a14931837813d55b97a9962
SHA256 4c5edab63dd10afe560016ad6d659ae6cac05b7371c1ae49b1478b187004b534
SHA512 ace14595608bf4be89b65bf7ab27ccc2216e2cf5918fb26d4a069757711fe5bc4fec956fee78fdbf6d5868ee5b89b178fb4392339eb7b60fb81c9dbac66765a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4bd4d70281cf00ad096450d50ae9f8ca
SHA1 25a8a7e5059fefcce9e3084921a0fa17ace3f96d
SHA256 e0bdc7cec861fc426060829033303e0406ba3b7ccd67bc7e238f9ffa94d34a90
SHA512 13ad0600fae598fa9473773c108b887400a4494038cd0c4ce324b5511a7ff06a6b104405ed96793534c7173444104b25ad3a41128a98b7bd4b034b72a054a928

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c926db510bff8ae2837c80b39afe11e4
SHA1 7377bc6f8c482f884c8d87471a3b3e993033c820
SHA256 1814302bbfff2c758a51afb87c480ae422001a44b3c88ed62343823d35f82fe8
SHA512 3090ee26f020b731e500d99690d53396be14dfc811b9ad0f01e610f6d38fa34a19195ab80f026fbf4fbadde40016f619ee27d86d1139946f2259f152c2120b36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 197975a299541bd027e5e2d397a216b4
SHA1 b260587f273dc28f3672009b6662ede7506ee5dc
SHA256 855896811255fe19d4dbf5d28e8ee17c87c22cb5eef73ae1b95978fdbff3af37
SHA512 d921b98a692a7d53f1c2b8e9f5eb2caf4b656b602c3ecf535c0460a2793659c8cbb2681963955482ce93f73d23e1c6b4fee8686ee5b23eea37d2348efd21fd19

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 04d0b90554b368ea0b5c60fc66a388f7
SHA1 fd9ddec806ae08b76cc3f610e9e5e88ec035cb29
SHA256 6bf7bbddcbce45a49290c3c6a0a416100f1ed5a71ceeedd8bb1176091f3404ef
SHA512 9c40f34fefc3af572898803c98b8067942742cbf9340df7c6d4aee7ec2f214c956a9e09e90850c19d304ccd449443c1e2da571648c8cc0ae7b6e663c5b731ff9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8acdff39138f4e6445d85003fe925ffa
SHA1 02adfb7b1fcdebfa94595c953ed5250bb3ac0a96
SHA256 88cc6524e3636b98b12a054e964d1dee1e6e6b6761c8fae3fbe1b47dd2cdc3d6
SHA512 739ed2927b74224c2736c86eaa05506f8febaf6397879d0682b6c4628112ad06cf2d9b66543774e74de478479d7ad2575473f53c9f12df261307faa6a604d783

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8a84a489823c01260bd8c168c22303ea
SHA1 375c2d1a9f80568e9713f3f7889eff0688c874c2
SHA256 079033dcc56b07eae5e1908358e08e843edc5dce4d155e37e95d8e2ee079ccf2
SHA512 933951e7e229cd65ccb8d959fa1088b79b87a31cdab8fd820abaea0732ed6c7e28a2497783afe0d5286aea688c59ba8b064d1d9881f2ad75a48620d5e502ce3c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87d7a2a9919ac0d84ca6ba0528a1b361
SHA1 fd51e807ae565c9398d4d8f08c9cd47354cfded2
SHA256 d307c34d9cf7f03e2e55cb9c3a7addaad2304740accf6231c12e2b9f8011bc14
SHA512 8a20bb85072e8c519ffbdc267013b136af9a6f69972fce4c5714aba860000054f9f8f3f8cb3f03f23df8a9f641c9082cf7b272f38a9b9220482e58fe58f750c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f8b9aba9b5b44e5cd6709aab373815b0
SHA1 7c35077f5dfb23a1bc4b29ac4ce11c501330f6e1
SHA256 a8cd2010446f10c52c790f159f2ece8cdc8c8c3c68632cbe3a7662400d592616
SHA512 3c40756778ad236b5d9881c4da0bbcc00f9acd5c06d2ecf00ee0cc91b820a8c23d59a3259041ea7b1ad9e8e1bcf14cde0d6f681b1e51878dd7d7b2d2f9082172

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:37

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

139s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1416 wrote to memory of 4668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1416 wrote to memory of 4668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1416 wrote to memory of 4668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4668 -ip 4668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20241010-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 220

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

130s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 14.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

162s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:37

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 220

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20241023-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 220

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20240903-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1928 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 1928 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 1928 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 1928 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
PID 2996 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2868 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2868 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2868 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2868 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2868 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2868 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2868 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

MD5 3fe065f3111d58d008fb8eb403a11a7c
SHA1 74ee9374e92cec677f39326d58b5f740b438cf10
SHA256 3866f85e7e0524bc2b5b43315da8e721b0e031ece4462329cab4892756abcebf
SHA512 e314110fba7203dca4ca71e75330c578889e3a01288be0dc1b04eba311b231199ffbe89a4cbbe58531b52c042b801dcb12fbe9e9f19e1427228007dfd6cd7ee7

\Users\Admin\AppData\Local\Temp\nsoD837.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsoD837.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nsoD837.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nsoD837.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

152s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Rhadamanthys family

rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1120 created 2884 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\system32\sihost.exe

Dave packer

dave
Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BGInfo.bmp" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\openwith.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Background = "0 0 0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\TileWallpaper = "1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WallpaperStyle = "0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\shell C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\shell\open C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\",0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.bgi C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.bgi\ = "BGInfo.Config.1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\ = "BGInfo Configuration File" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\shell\open\command C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5020 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 5020 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 5020 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1652 wrote to memory of 428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1652 wrote to memory of 428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1652 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1652 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 1652 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 3040 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 3040 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 3040 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe
PID 4288 wrote to memory of 1120 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 4288 wrote to memory of 1120 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 4288 wrote to memory of 1120 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 1120 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 1120 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 1120 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 1120 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 1120 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1828,i,3233024370827307939,4473115477594950356,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --field-trial-handle=1916,i,3233024370827307939,4473115477594950356,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe

"C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar

C:\Windows\SysWOW64\openwith.exe

"C:\Windows\system32\openwith.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\chrome_100_percent.pak

MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\chrome_200_percent.pak

MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\d3dcompiler_47.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\ffmpeg.dll

MD5 5a168cb3ea9d0e7400baabf60f6ab933
SHA1 82a86cb7f42294ab4ad6669c19b92605d960b676
SHA256 af5f1bc9f6a73750fa0c7bf17439700cfb3ab23e1393f0c9899825417e319b54
SHA512 7c1441ecd049543e38297a7b6929e9f3eb978422d0ce508fbe6350ffebd297f947b8d9ec75bd2054142dcd8461eef1bf110e040d0830da977fde8944bece843d

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\icudtl.dat

MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\libEGL.dll

MD5 39ccf402a62f068a8c573b45ea96154d
SHA1 57ceb915ea6f88c7fcca35339bf951659c0338ab
SHA256 8649d77ace8e5753b9a10e7ae3349aafa9d8e3406ba9c8c36a59633a84b3c41b
SHA512 c4f9225c54d413176cb3dd2b26d429493fd056c7c283bc7a1c52b4a2059dbb11380daf5d847be1ff29f058ba0ef44d4bf66a3d9e9a600000dc8f6d20dfb2ed03

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\libGLESv2.dll

MD5 f055a130c79bd517bdb53b1f8a38bd3b
SHA1 9fba0ad4ba973bb285b23cc125004baf61a98b5a
SHA256 45b53759392b81ce7d916b3f1cf02be30289809bd31d09fc1524ef2609183b17
SHA512 d9dcb217f268862c577cacf4e9f84c63e02b647113d484338a74eb0b24fadd6d87b4e7a551dd1ef692bb38e44562bff848982acb62840d4f49f91a7751320e34

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\v8_context_snapshot.bin

MD5 bf2976da5086b48d74eb36f56f5deb83
SHA1 5aa7669a3e2166fdd7534241a0e7a9bd3ff5748b
SHA256 9f1614328e18becb4adf96de98bc91ce2a69274abe6621327cc0fc8503a1ab20
SHA512 c44deeb96597b4498604ecf2060ee0520e84a00308ca1f47ffdf8e3ed3e676b27b622ff7dbd4b6f1a14ce60b05cc2ad9b8d7562bb362c1b12a885ea7fbe50e0a

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\vulkan-1.dll

MD5 b6d3af84e8be0027741aa6077768789e
SHA1 e525f2434dc56f79644695f5841e91dd5f80eec4
SHA256 376ff6892ec7b406acd8c455ac82f8541e59e3757195488ff04cd9f20d554562
SHA512 f03b8792a740679c8a1a8ce0615b7876cc811130085f3ffb42182e0cb846519603804da97fc93a8abebee01e03fd257df289c54575da8faaad018f4f4bae606a

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\vk_swiftshader.dll

MD5 6720d5dcda6737eb0cc5a352a47414dc
SHA1 03d9a8e350f485dd955f7dee06bfc46371753032
SHA256 d8f36b089d83157abc271d9fe125919c3237943fa9789a511ac5ef1d41e2e3af
SHA512 de5ade6ce14b14957fce669c4181af1e6a6f540798d1c6720b56ff281f813a6ce4446bde33a8f175d2484e07f4911f93a773cac1d372cbe3b26be634b3fa1686

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\snapshot_blob.bin

MD5 c8950b01f336b05609976546b1a007e6
SHA1 f04d0b0369007bbe6a7fe129b31b19dd1822f32f
SHA256 9b3a75a713e41bc73f219858fcac8e3031ba22732285ed3a64dc48074c725cc2
SHA512 b7db4277290e849a52ad5d31ff65ab5d2b75c2125d67eeee02b09e4e7001aa46d10bf89429c65695c7560d1c45b898c20275eb9e36cd8b259707ffb8b298f103

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\resources.pak

MD5 6772b597bf68622d934f207570e771b1
SHA1 f2a80fbfa034cb1fa07dc9aa37bf9f5b2280ff13
SHA256 268de4d99ab7c4f4ee32c8e8cb2b058a2c8d0d839f468ae8e8c0605feaa736ea
SHA512 a2be67df09951c9ef9200dcccbdff13736921522191f0001da539d5c7f26b5b26a6b810be6963908f216768c98d21e52486c7e00538cc0730e8c78e78811b85b

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\LICENSES.chromium.html

MD5 6ff57c0aeccdf44c39c95dee9ecea805
SHA1 c76669a1354067a1c3ddbc032e66c323286a8d43
SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
SHA512 d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\af.pak

MD5 d9bec09b6c523dc3bca9a81264b1beed
SHA1 ea4ae9dff554c59994632f85af25b36c049fb5b2
SHA256 0b5a45de223ce8522cc296af1e93477540eaa74867428307cc3a5cd21921b022
SHA512 6e7677f86f73edffb5d6162ca19bb7464465f0f485ce2971fb20ad3f57d9fac56b7a21d378701f80e85fb185c3af6a238f8c8707f5874bffffd79d881a54dd6e

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\am.pak

MD5 e3933de22dc7fb98215b083d8a379f40
SHA1 68ddbd9bcc931f0d4a172fa65af35b823c7c9e37
SHA256 eaa747075e5a62be8b7df5908e167ccc5314c9c6a8b890059d00284a3c496fef
SHA512 7beb80fa029f41cb21536b15c604e2ae9dfc20b4a3ec4f5cc04e2b105d4b2c251830624957197084761f9686f95d332e25d4f6178509ad58257af90d96a9e7d5

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ar.pak

MD5 ac865ff462f341b4317c3d16eeb40460
SHA1 1e971d97f09884b23595f17534227ea43cf99090
SHA256 0557bc17eb1d134bd52f203836551b55579114708e2df51f653972951567513d
SHA512 a935b91a2c053303e941866cfc151f28053faf364aeece98d61fcd68fef6c6f1d3b73de01cd602c8a4a081cce452d1ce87f8166ba3c0e8b81e91d932f84737f2

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\bg.pak

MD5 7c37c8c9b4215089b6c16d22838d256b
SHA1 8f2afdc21353685353a0562452f4a79180e58829
SHA256 2ebd582dfaa3139cd6a03e9892a94a3d9bb6936e0b04085b8f2d27e1dec0bc8a
SHA512 beadd70e9d706576bfb6725617385f776e9f68c84d116b01187354d377e2c860899da34f8c5a054c4bde41a57e9aac56445f6ac0b8da8c75a424641a86fdd718

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ca.pak

MD5 e1ac7f4c28177f68fac3be2375a9368c
SHA1 3d7738699087468a748f9b1189d2f7621187d03b
SHA256 efa1ba906f8abce91ebb9d6442b64e0d5ae7dab78dda8a49a6fed1a342c71b9b
SHA512 aee8cb28eb02e2fb2155c8d093cf678284e3571f46b913f743de3c6d0215c18b80866ff446f46ada160860ed9c18ae9a4209424e7e0f0ba97c78a3fe9815ca5a

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\bn.pak

MD5 fc66adf3deac72fd39105540dd2daeff
SHA1 a53b54efcc1285a226d605116f87d12f69942482
SHA256 ef50cfebaf9e32edeec25d30197ac5899b3db8a0676671f639d32bc48f3b3bd8
SHA512 0b77daa056451d01a8cfb3ff1acc08d34e64e0a32bb119c8837ae3d6e3d5195311427c6101efd7e7bc9104aa369832bb12aab3d4080c00dc39edc98b6c0b949e

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\cs.pak

MD5 92e3fd1eb47767a0cb5f6e734de4eec1
SHA1 33053bfead1fa67160b6a3c417ec4559bfdcdcfb
SHA256 d269e16fbd9b2afe95b148ece22b2ac803768fb53ee42e1fad0181f9dec84544
SHA512 916d73d9b28b0600878418a06388c2ed61bfaf17807a16e1c157a30e5da136c6b6f194e99d151c43b9aa35d101de755caa6da69e1c8a50dd134f27a7f2adc016

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\da.pak

MD5 43029018648d558f9bbf7a74c59eb281
SHA1 90c6618cccb4db85d7485ae8d809ec3af4763e70
SHA256 4bd88f6ab82842358987aad384775b35198dd75c2cce4cae783208ed69296a7e
SHA512 9e8ef9d4367ad01f2f4e7dd6f9884e463729ee5a0f678fd16a3ce093c21efc1d78041d5c6e45037f37bfd732e4833744485b00acfda2313a1d1e947993129a3d

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\de.pak

MD5 3a8de004b3a610271e1d1913b6d4b53b
SHA1 236893c3f7b450e6ad8b4d54e1a62b2e635b42d6
SHA256 43c060182c92caf4aebf8fd7b913dfe017beea71e796e862ebf8746575948364
SHA512 b70f849ccf7dd9e72d71522591420e0baa03ff74763b44563b0b3800ba3a88cb8b973fabb90bbb6653819947eca47f70e347958e3c31ab226957f7313bc03554

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\el.pak

MD5 58d6eaf71b9b73f5f7f057c73d0d92ec
SHA1 16e0587753e7d2834f4cbb24fed45e7bd2f8f2f4
SHA256 8474879de21c414d34c44cf0a8c91356a66dbd647308a4f994be25bd1f93a89f
SHA512 ab24c9655bd68e4a64e257914a35dc84b5f791c58b396ae004bf5da61df19c02ef9ca572b8e63f15baf3694ae1e540adf74586f10d28d7ef90edeec982bcf28d

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\en-GB.pak

MD5 985558de03bf486aec1daadd39cb508d
SHA1 b693ddef983e8af212936202ddca92d908378404
SHA256 1956d448a4d333638f3601d0da976710cbe0a795504eb694ba18311fe586d195
SHA512 13d1c82b797ad4ff25a94a996f9fb52b530643a0e735f96e32b9e0698962770148d95db7beb91343d781fb84378a3e334ac0c1c913d8dbae20f425bf0dc364d3

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\es.pak

MD5 3db06ea954c83343bd333c15947f521a
SHA1 ddde6ab9f9085e83ec8bf7a37df3389040acea42
SHA256 45df7340fe3c8560b11ffba2219de1b5c45dbfe57b6db90bd6c246244fae338a
SHA512 cc29f1075c119daddaa108c17abb6d572925cac1ed2237ed2fd45364bfb2a00c1144fccdd22c6728c954af2cdd1b9477f39968ba25354bca2b9dca07f5c53dde

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\es-419.pak

MD5 85e9b056e3ac3f6a5b113ed9f460e202
SHA1 dcceef6ea85d71a85dd24d17ec65371dce76f480
SHA256 16fe83762ed578c49685868418325920a72cd457907bc4e5264f2c172d53b27b
SHA512 e4dfde9c1260df1f77b7ec1797658f8cfeaab98142a8d512ed3bfac054933a4583f20091b97985b4ba9cf93f9faca3e7b0986cb4a3eb12fe0bc04ee1c45d3e0f

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\et.pak

MD5 8e2c2cc8c516d8b7181c0c712ca24513
SHA1 e0ccd9ed8de6640379f822a067dcf97d4bbe44a7
SHA256 c96937f46fb1b1182b201f5c48fe1da4d3f94a68a0e6e0699ccc0944cd0a5a33
SHA512 339bc655f22068f2ee9352a670325865265e4279197430214f7e3fba575415318110cccb03aed2c0e7ac673d4629bd495dc34a56cefbcaab62e1c4a1a87ed8c2

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\en-US.pak

MD5 752a3feed3ab6c127767c8fabc9a40b6
SHA1 4af9f9c19904d3bef154b469858dc44b1e630a75
SHA256 c6a6c5d7ab6119bba712d6fe45fd385506d4d0dd8e4156cca3925062f4502ac5
SHA512 ae96d4f391e36f8f741671b72ebd4b1ab2d049b2a99b95737fb9f81743b9e414b46022b65194af5616eb354056addf0e46ef090f56b7d945ef2cb5f4d100d64f

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\he.pak

MD5 16562c59fba469e1dd2f3b0b87a64645
SHA1 9a6863205fca8ea6d09a98b8e8dab543ff6198a1
SHA256 64fa2e98a9056e23c3a934ff39fef81c306cec5844d56dda17ec6c25fcdb1b5a
SHA512 dbb6e1a5e52a005386007f88b53109037792bc7b65fb95ace3e8cc5ae3ebd8320c7e406381c375bf751a9265ace84e0bbe1301d4bf3aa79200ec789dc3b3bc0b

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\gu.pak

MD5 6c949199eaaad8fcb12c38ec6c02d758
SHA1 ce4dbd5e6a37f25354ec6849f7008956ef3568ba
SHA256 966591a74e44c75c7f0114bb8e36b0e9f5502aebdc96c714c8a8f6d45bc863c8
SHA512 3344e0083969de6f4913893a14586b441f65cb5d45f913f1cea61b8d5abbdb3b1c18a48731870282174263c1f306ed6b99c279627bd269e89cd4e15dc3d88313

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\fr.pak

MD5 651e4cb14c4f784d36d0a1715c52dcf3
SHA1 540f6090e3223ad8e6424a9db78305f2db9974bf
SHA256 6d547cbc3304627d14aeb138aebd40786c30a4192e071d80bcecdb77a13ac80a
SHA512 1fe93058ec434c06ef4aa1519333ebd831311971b06d7279ddc4d86dfa860bbd6ea6d127b2a07425c3e78bd6d41c11eb2a76cf25b20c6a7de74d1f0ceec87079

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\fil.pak

MD5 eaf43729e9bbd8004ef1ff56a3d85a48
SHA1 34b31ab8ea2ce6bd263f00acc50d5af8d0222d9a
SHA256 8559cc35335bb2c249297f4c7506df95cef899ef5f7ad942d2d511ae074d41b0
SHA512 010f8e5c3b969be0db4baec3acffdd69be25662387968e15e11af0da68ec2f45dc9edb83cafe7c92234e1e4e4aae1682223235af04d99e8b5238379e022e3d35

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\fi.pak

MD5 125a121c22dfc2b1a1c759cad9123e42
SHA1 d0282af9ec311c406ecccdfdd7216b7d883e94c3
SHA256 b733460f039dcb3795077ba91dafa3b9b8163dfd0f15168b250630f7de21ed0a
SHA512 c6e0ea8fab8115a632d4c74141efc46ea546f43e0b806d5bd95a1ecd3b8fe37a44565a2f79c43e0bc50dbdadc5d16054e07485fad83c99bd3550a907c852e724

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\fa.pak

MD5 caee902136579f4bac72a6f0f75d171b
SHA1 cbbaf988a499005e21fd86652e1f48af8bce2c35
SHA256 e86f677e9654f6a16a7738e85a5a5d467a09cb18e47654f079506a00affad70c
SHA512 c0f2e8457f71789da8ce207aaae2f83196daac868fcaa7a84de04dd38730f8831b9643b8a404a7aa59c5b726da02090bba414529019f5eb9c94ac5a5af61bc9d

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\hi.pak

MD5 6aa92c296ed09fe2aa94dc060b25774a
SHA1 7619ed3dc5b1e04c55b0ee7280ac2d0135eb9c80
SHA256 0c771c66db4f80a62912564944c4e239f8dac8381a06483ecab512e0d75744a1
SHA512 9255a4ffef7be07ceab5dd8f46365b9a52d621ae175c1022bb4685fe4f3ea63425f45aa9ef824b467b9c33c51a7104258e888e8ec15c88fea126bf0b5337ff14

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\hu.pak

MD5 7add28fbbba1ce87972f6433862dcbaa
SHA1 8b4b0053663c0b69beca59faca79854a89ab9c97
SHA256 dd86976d72f3cb644b90c1863e29e2f8616b09ac4acfe9301fb346fa0d87bd78
SHA512 efed0891b0202bae9396df54f141a73bb6ccadd7947330fd9e6a3a8911e9e037454238c4bd2bb9075af3218230c9e4e394f83a70878396911faa282d99fdd884

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\id.pak

MD5 cfc848689a25f5e2e6ba9a06e09b6ee0
SHA1 35131e775d98a57ffcbd6a75e69f6f67437636c3
SHA256 ec1d7bbe064656dc53f70e3a612a582f5d5d0af5f0c2d6a783796cffa5bf7f57
SHA512 d5a027e35dd3846f5255b81eed36a3498ac9d809367692b2da216b5771c2d54fad35fc15c15705a2bbb4a7b35dd2245661882734998f9bc3ad8d62d2273b6577

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\hr.pak

MD5 fda338824b4171b10dcc3395a549fa9f
SHA1 ea42c8b18228e0ca57b8ed7ed48e3a2aebe08486
SHA256 43f370368b322cd1236632c82aa0e231965dc58fdd497f8aeae6b40eef9ee611
SHA512 9115f805f51f45839e0a87cf44c1cce311cecaf717c0da7db3b6da85cea95f24638af29da43bc01056994b22049daa0387cd4371c13b8e5399fe8f4e38771d57

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\it.pak

MD5 6aa3bc3ee4999c324b82e50940e62c74
SHA1 10af8030fc2f875e133c9417e0221528160ad8b5
SHA256 73cc8422643a65753b2c3672c8f8331ee92c9bddc912576554e95b0986cf990d
SHA512 f039ef32002e55d09a4f567cc81fe2b3b329d517c985436a5da121ff0e6ac7e258b5d1fdda81e6c1578daf7078b91abcfb7da98cdba6693d4fbe7f28115e6971

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\kn.pak

MD5 52a0707a70b939bcd75b0838a5dc5357
SHA1 eb9e1350d9d217580b1939302d008dc07c3b781c
SHA256 b177eda102b1be8c53127e3bb47970a3c1e2032be24900d8a126c5f0f077ef3d
SHA512 d5fe69035338c4308f661fa0ac25c4a811a6014f6bd85ccc7ad947f76aecf76f67208512e1266e249ec067a5fb22fb74a3550b0f3aeb1bc50fadb3a9d3cc67e4

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ms.pak

MD5 6149507c3aa99c4012d9d7cfe4bc30c8
SHA1 51a2bb5cbae64f3877afc342ea0f43915702f8f4
SHA256 dd75481d67d9be36ecb2e421117395fbb75b7623164f13a09be1cf3ce76d588f
SHA512 71f8dc03618d46be7b036353526bf20a61e648ef50adeeec057d314e9a4536899c37ef691164bf9de9e10a3867749f8d3d6f4038e16c82cf6122e7ab4a1c7732

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\mr.pak

MD5 0e5b29b6ae74a1f94ca4f880f131a79f
SHA1 6ac5089ace05847480d2aeec89954124caa781aa
SHA256 25bf8e86f7c9e88f68d4c40c4f124c16f60daf22e7a87f55ba2c560a0f640bc9
SHA512 30717c0aef4458bbcf7472316727981829edada8be3003afd9d65cb01d4cf309f601b1c41539343d6239cb2e9157554c95cf966a4156458a2fd78d2464075c98

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ml.pak

MD5 d32a29a61e8afaba6b42d236257d9929
SHA1 9664f50ea7590a47c2eb8eb4a3e49be556d08f7a
SHA256 a59fd15c969ee8ffd7e72f5a2245c6a5a4fc048f7899fca489d78c8f6394ca1e
SHA512 2668976853b26b22859f8c20afaeb4d641845e94779b8994b49f240302420279e3f9a99666b8f551495b7d5a8c3c83609b7ecf276fabd8345cc8c787319ea3d2

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\lv.pak

MD5 00b517ce675a3089823708776c6f9302
SHA1 2bc24f150adaafd2604c5d95bbaaf8dc983d7da2
SHA256 0adedd1eaaf902feebb208220d9f21ae1b0175e74f6a966cd7ed226146d86ae8
SHA512 6c19a0d779185141fb050369f9fbfe60d0b838e55e2674e3f14a67e1a6970727e329656e458ca8516a41c97b20e67eb1789587af957129b3d32c94a3536ab12e

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\lt.pak

MD5 7cef6e31d76861db4d7d622fdd89e5aa
SHA1 31fa45c3b7666259d4d8a13518ece423a97edcca
SHA256 2f1e1c69da5cad8f47e45af0ac47cec90c20fe2897a43cb496c7feed1ec5d1ab
SHA512 df66a739f3a8da62a942b56b23f71a2b68469e87dc44eb8ce1a9a859a609f1db4bee2497defef06fa48e14cf461e61410668a5216459c94c79f4b69a3cf092f6

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ko.pak

MD5 4b563eb612d4fadc6bd8a4c918006ab1
SHA1 4b9e414af0c044c4487d1439d23ef11b0169d308
SHA256 e0d4461452607e0f4a619efe653ec9ec39f7d34a742ae98374b2bce0b821adc9
SHA512 b8c56d69fa41ad14f7197acab1ba987ebb06c5b15748e21cec27861721545e30fb20f76f2c3a752c8ea94cca1e6b4fab7fb0727b679a8fb8e94db2d5c028e7a6

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ja.pak

MD5 5a69547f56dc61e482dcda1ce704c5ac
SHA1 5b7bbc8e9b14d78f2105136afb7728050128c02e
SHA256 a286a5faf9021927ec09fd8cbf30ed14ad59c3baa36d29e5491ad27b957915e5
SHA512 2b9d020544201e2d0b0b44b0977fcbab858563969ce02be65689c5f5b780adc4560df523589293cd66f42903322ed61d781da093adfa44aa0681a28d97de4556

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\nb.pak

MD5 2a0ec73d03d4d7fcec71ad66cc0d4b30
SHA1 bb8df6e11b02086726ecede97d5f729f4197323c
SHA256 d44ef5e644b1b8f7c056d5e20651515fcc8565befec575091735fb39c6d63554
SHA512 cdcb4e436270156e263d731ce243d821c5361b18b6d7b8259875c9d895301d478a87feb7cafc3376d09d18d27f32dc403fd2cbd034d68736cb968bbefebd642b

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\pt-BR.pak

MD5 b1ab7d7aa67a7b61bfa9aebad0b812af
SHA1 95eff4be517c0a25c34578def10d48c77021de1a
SHA256 5bd503c413aaf8fa87fd47c341d437accc25397a50b082068bcf2f3bb4fb27c7
SHA512 8498fe7727771df3c1eb34560c1e25b0c30690c7c921104b4adcf04cc5753462bac513a60a5833cb6f57733201d4883605f8a4ec4a457f3ebc7c952090b1a9e1

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\pl.pak

MD5 8a4354163ff3b0978a568f781bdac289
SHA1 45de421f35af79adf962809cf8d0e6d2adbcb553
SHA256 2f6de0f9a46ae0b75beb67e09ffeee12483842a7cd6f2a2382ccbe36fbfc17e3
SHA512 5760f20228afe74e9ff2a916a168e8cc2d4a64d8e76065e61a7a60616a473c7dc3da4805125b270f179b7a0f291071e81d761d82eec3b130d552b57abd76c127

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\nl.pak

MD5 e8b790166d701f63a60c3b322fcce234
SHA1 61ec318aa8030f7d29c3258126b156d1d3eefa2c
SHA256 3d73b0110e5832b6a7c7b7e64018368464ef8552d6a98592d0adbf713eb9755e
SHA512 4e4b299cb55cbb5906ff974bb5e5078d2018298b5ee6d9ca0e40aab8db542aaedc4bd7a5db242a2c5194bc90c07631f627043dcc1a9f2d095a28c3e35f212dd9

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ru.pak

MD5 e9af20a6226511cd535888846a2bb16f
SHA1 739a46269f334ecc291bae6777f0b7c8e271e4c0
SHA256 5db640c6c288d9fc79012a7670301a3bc463359c17ba200aedaa56260ef8d955
SHA512 7897c500718382f08d55f3cddd96d1451524b5c2b8febc65e1700a645598b622c819ec66e4a21c119f044faaa525a2abdddf66d0c9800af6ecea9ceb217a88bb

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\te.pak

MD5 a4accc25dd8a00bc57df4fca12e41295
SHA1 9466888034c9e6ecf4113ddda63d363ed20e3156
SHA256 157d646525f6a9ac267466631671e65e9b5c3e55b008b564186e64c6853e52aa
SHA512 f19116655b6c2bb5c572b45f1d712fa1f9d57d9e8963fb3d654ed3781bd34a4e937b590bcc1119a318e28632da12a0ef8b36f6426791de833898cf7f30189567

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\zh-TW.pak

MD5 0be25a48eecee48f428fe56fbfa683fd
SHA1 94c0e8c99beb592ebab9ea5b8758aa414bbe7048
SHA256 a5e276bdfe4cf87832eee153596ccde9cf9193e81f29a4295c8335525da64295
SHA512 423033e67654820ab9f9773f45f70908511aeb8228c59126757885e0bbe0bd960257324d405d27526d61b541b1e6323de16bef29d4dcb94f39fd5e92fa811cc8

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\zh-CN.pak

MD5 798bc7d8b63906c5b1c67e89ad17dc58
SHA1 b39c86d6d3fd9d8b8da90d86f827a0c0803fba8c
SHA256 1c05280d8dcdfe99619695b76dd054292a90c1a93a5cfb92cdc4a5b0068a7092
SHA512 7a21af438823d562b889d7c99f639421e01f0536e95f3206dd53d2c8ded82b7a4ab74bb9b4262b2fa27e50efd8dd7719827ad2e6b6d4c2e0d0811930027ed982

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\vi.pak

MD5 045241a62232bae57f1d57c6c3af7c55
SHA1 5c2a1a677a8bdfa20f3577335131bd4b89a46355
SHA256 56758c918bbfe6a9d5b20e8b4a7248bdf2d43e0bf5f98e85a9892ff03dbc2d99
SHA512 8e30af44a53a36a194da16a756dff0f90efbef164277bdcde683c89a3cdc04ae5e1298475e8a098d19dab73eb0a71637f676d49d237c5480e1f7aca1765166bb

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ur.pak

MD5 cb228cc41981e8bcbd2768da20026912
SHA1 c55bb999c4c1fbee5e38b6c986fbce2b128f3880
SHA256 a7d825fe348700528800ef9ea7940ee8027373e9c05a4e51e526d0a213c05429
SHA512 85308806be53494683f32520e181dd9c8c9abac0b92bc439d4e30eef22d4af993794a9719dd9a4eeed0bbcaf61c0e2342e7d4ed5d30b504572bd2bc269100e2e

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\resources\app.asar

MD5 f22ecb4d9ec69c266ed713cad8ea378d
SHA1 54317e92cd72895cec70a6c7a05a1a84ff692940
SHA256 e6950dcb3c57a32d89049fd7df783acf64b858c45f9bded621781977d55d7c96
SHA512 85ff75ac585da3e5565be38932ec03269af7db93084f8d8d1c45fcd298a26371841cb61c66e36062011728538514b1e42bfb7e35dea513cd82102db45854bcc9

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\uk.pak

MD5 ec3aa18a9d9c989b1025dddb0fa52b55
SHA1 ab3b0834cabee34bc2f9fd04104b10e5f9c102ca
SHA256 ee67744c26e0c69fbed8b102add339070aabc70c2d8ca9ea037c6c9d23b66d3b
SHA512 90d40424b050c6c7ace113e85b0b0a58472967c50a14fbc6637cd3b2db8ff3f521cc94dcd256fa017684256e8a9c19b158aaa57f6d3094fab970578d3b1c6847

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\tr.pak

MD5 82c6a14ba1b28f947bee67bc3feab091
SHA1 25023b22eaed29d0817ec95d5bcb4ad3d724f5ad
SHA256 099507f6f2a2c98ecce275f8ad956eeeeaada65b7788356301af04a0cd7d431e
SHA512 988a9275b7a05d100ca9242dd05969d2363a42938d47db37a1f62ec1874e96b640c14b272f1829ab5c6e0d2763c22fbf0af99894d4d9d32726925eabbc02c05e

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\th.pak

MD5 b18e4574db917920eccfb8e6900d0662
SHA1 554206b9e639135074b0946fb28b6ffe2d934159
SHA256 c14fa1bb30c880216d6cfea6fb738235cf72a3fe8be919c3d61321d5a5883211
SHA512 5f427f9ed85bb368b45bafd523c634e18596e430fdc380563878d2ca897cf2580d0405f7c0d8e10abba389bb7125978a81d335263bb777e0ee0bfe3d47c8c65f

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ta.pak

MD5 aa06ead1200f01c9460399f0abe2d54f
SHA1 9b852c4691209c0ae9edf94a5dec4b902fec7b3e
SHA256 1946d903918c57836d2f898ef93cd1d575da1a464e358c399dfde73ea2ef057e
SHA512 6e556b962c16aee22695d93b62b308d95b0695873fb33d13a147b3d8b6791c9599daa6e3bf424a1897212a018ab36dd8c8214c2eb03457048c6931686be40e04

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\sw.pak

MD5 a63ef2c4676dfbee98e29a84a7ad9d27
SHA1 2f0f4b33acf5e63f3159c62c74deaa9a361203f4
SHA256 7b8c51b247dea72d68cb0ef4292800c13209da6f859a9ad289c996582f19e65c
SHA512 cd65fd2c49d35757de648f21dec748fb4a1d13d2308552774fe9c859ad5748b21f5db449f8b380520f27dc868a3ebaafd58d4c45aba34033785777d342e17e6f

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\sv.pak

MD5 cc0806219798e3ade0437219457a37ab
SHA1 dd6ba47e14b7b0d08159fbca2409b013dc2e17de
SHA256 79a7260c8651ff3024e21f9263543bf4e9d5f3574e81cf96edf6388f8da85cd1
SHA512 df3da02bb2fecbbaf1ab80af8ef8b1a7ae9f6c7ed01f94c5a502720376924132c344dd716fc5b4ddc03733a6c3581ed8d8a577154c619ba85c527dc67f4a48c2

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\sr.pak

MD5 abdd9eb966d915c1896b31cba0b2656b
SHA1 cb0080e5f2c168cd0f3edc6ed6c47734ffd67790
SHA256 3913d3be5016ce873ac68af376d5fcf558bb5f5f29a9bc56df0099ba47e52486
SHA512 bcb258d6da766bb6f00dfdbb03bc878000d9cf28b2b707375ce52485db9c530a34d1528a1473f09b5765bc57abd847f191bde55646eb707443cd0e40509b70e1

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\sl.pak

MD5 aa7c0f35b61a230d65e498daab67388c
SHA1 f60cb1c7128a1fb1cfd9aa029f96df36033777d0
SHA256 03afc83cdba98c08af169c8ae111aa916f3ee6d5a2fee4954ef35ecc063f2b21
SHA512 048d03c490f18d22f4900363f9c4abee037a2029f226c90806064ffedc85b07a1d86225b9c534311b08f588632a84221d7e4fa355e7b768cfdfd6102c5ffe705

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\sk.pak

MD5 b0bbb6661370d27b6600ebe98cadb9ac
SHA1 1139852da47048f15c16eb101dac86dfc8f652ba
SHA256 e0fe4130e668ac659d5334c5bc8cde70bba8742273b5965836860b5a8b1b016a
SHA512 c8eac323552f873ec088f77b8c46522387b0298b6d566cf8aa173fa9b2d66389068bb26e46044af2faa4224b39dc748164843b58b99e9dde093fcb32afb5fed0

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\ro.pak

MD5 5db10edf772656c0808dd8da698334bf
SHA1 3caf7c9d5a3b44e06e0588daba698b6970ea06f5
SHA256 73b6a63352906d77196f38a1df937ec0770160fb7a93321867c7994ed3e7967b
SHA512 eb253b548c7f574943136764a23818f9dedea17ff42f92dc8591f4b7c297accdde9f6b2c0ad96f1fd0815c53940c0102a90c603f9f4d6d9c8fb053b559cc7a62

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\7z-out\locales\pt-PT.pak

MD5 cbe5e35f844f5f1400df3685cc847694
SHA1 e60cdb0a813a97c8548c878276bfae155350bb42
SHA256 6b9bd714d217d596183894ffed3174a617e1c8cfae292231d4b967183b589c6b
SHA512 96046c97436a3dbf5aac479b9eaa9dfdcfc81f1edcaee9cd65d59beb0ce6b6b42828e0d170aaef2ef1d68988f7916ac1dbac0d84218de83fedcca8592de4c1f1

C:\Users\Admin\AppData\Local\Temp\nspC600.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\16cffb80-b344-4999-be4d-e081508492d4.tmp.exe

MD5 3aef228fb7ee187160482084d36c9726
SHA1 8b76990c5061890c94f81f504c5782912a58d8a6
SHA256 c885df88693496d5c28ad16a1ecde259e191f54ad76428857742af843b846c53
SHA512 e659a7cf12c6b41879e4ce987e4cd1cefce2ffc74e06817667fa833764f36f25cc5f8374dbc844b68b787acac011c7b8c8f2b74563bf8a96f623ebb110a593da

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\VERSION.dll

MD5 f8e8df746881bb6c15c61fee344b12ff
SHA1 6f5d6bbea6b3ef8f931fc18b51d0fdffa6367430
SHA256 4ec7e1ee6c2080e341c2a94d90af71d17d1f8f38bab8fc556219d11a79fabf85
SHA512 dc231aacd9e754192ca160823b465c9cb9ea3c9bbe35cf485428c2266c8112a292d05db7942d1ced210c072d71036a42777533359e7f34881bf0038940bfe309

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\encrypted_shellcode.bin

MD5 9827ae88a9588b26de69046117d21c81
SHA1 c591b24672b8509dbdc087fc245a1f7fea3b1d9b
SHA256 3560f325b7a2c0918910bddd6462adef786270959e765069fc6dc3320f3180a6
SHA512 66c1f90a4a9dd2b31f9ee3e1049620bcec5bfc644546d4e18b651bc79b45e58a73e82d676dcb34819e59735b3d92163e80b9b1311285f6f452f97020439497c6

memory/1120-846-0x00000000013B0000-0x00000000017B0000-memory.dmp

memory/1120-845-0x0000000000A70000-0x0000000000A79000-memory.dmp

memory/1120-847-0x00000000013B0000-0x00000000017B0000-memory.dmp

memory/1120-848-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

memory/3188-851-0x0000000000B70000-0x0000000000B79000-memory.dmp

memory/3188-856-0x0000000076AE0000-0x0000000076CF5000-memory.dmp

memory/3188-854-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

memory/3188-853-0x0000000002890000-0x0000000002C90000-memory.dmp

memory/1120-850-0x0000000076AE0000-0x0000000076CF5000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20240903-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 220

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

165s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:37

Platform

win7-20240729-en

Max time kernel

16s

Max time network

17s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 220

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win7-20240729-en

Max time kernel

118s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

Signatures

Dave packer

dave
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe N/A

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2096 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 608 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 608 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 608 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 608 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 608 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 608 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 608 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe

"C:\Users\Admin\AppData\Local\Temp\ed02ac429db2a8e556c8edd22d575ae4caae45719df16dce9b2026205572a426.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Programs\DocuAppCenter\DocuAppCenter.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nst2398.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nst2398.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nst2398.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nst2398.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nst2398.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\chrome_200_percent.pak

MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\chrome_100_percent.pak

MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\d3dcompiler_47.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\ffmpeg.dll

MD5 5a168cb3ea9d0e7400baabf60f6ab933
SHA1 82a86cb7f42294ab4ad6669c19b92605d960b676
SHA256 af5f1bc9f6a73750fa0c7bf17439700cfb3ab23e1393f0c9899825417e319b54
SHA512 7c1441ecd049543e38297a7b6929e9f3eb978422d0ce508fbe6350ffebd297f947b8d9ec75bd2054142dcd8461eef1bf110e040d0830da977fde8944bece843d

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\icudtl.dat

MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\libGLESv2.dll

MD5 f055a130c79bd517bdb53b1f8a38bd3b
SHA1 9fba0ad4ba973bb285b23cc125004baf61a98b5a
SHA256 45b53759392b81ce7d916b3f1cf02be30289809bd31d09fc1524ef2609183b17
SHA512 d9dcb217f268862c577cacf4e9f84c63e02b647113d484338a74eb0b24fadd6d87b4e7a551dd1ef692bb38e44562bff848982acb62840d4f49f91a7751320e34

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\libEGL.dll

MD5 39ccf402a62f068a8c573b45ea96154d
SHA1 57ceb915ea6f88c7fcca35339bf951659c0338ab
SHA256 8649d77ace8e5753b9a10e7ae3349aafa9d8e3406ba9c8c36a59633a84b3c41b
SHA512 c4f9225c54d413176cb3dd2b26d429493fd056c7c283bc7a1c52b4a2059dbb11380daf5d847be1ff29f058ba0ef44d4bf66a3d9e9a600000dc8f6d20dfb2ed03

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\LICENSES.chromium.html

MD5 6ff57c0aeccdf44c39c95dee9ecea805
SHA1 c76669a1354067a1c3ddbc032e66c323286a8d43
SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
SHA512 d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\snapshot_blob.bin

MD5 c8950b01f336b05609976546b1a007e6
SHA1 f04d0b0369007bbe6a7fe129b31b19dd1822f32f
SHA256 9b3a75a713e41bc73f219858fcac8e3031ba22732285ed3a64dc48074c725cc2
SHA512 b7db4277290e849a52ad5d31ff65ab5d2b75c2125d67eeee02b09e4e7001aa46d10bf89429c65695c7560d1c45b898c20275eb9e36cd8b259707ffb8b298f103

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\resources.pak

MD5 6772b597bf68622d934f207570e771b1
SHA1 f2a80fbfa034cb1fa07dc9aa37bf9f5b2280ff13
SHA256 268de4d99ab7c4f4ee32c8e8cb2b058a2c8d0d839f468ae8e8c0605feaa736ea
SHA512 a2be67df09951c9ef9200dcccbdff13736921522191f0001da539d5c7f26b5b26a6b810be6963908f216768c98d21e52486c7e00538cc0730e8c78e78811b85b

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\v8_context_snapshot.bin

MD5 bf2976da5086b48d74eb36f56f5deb83
SHA1 5aa7669a3e2166fdd7534241a0e7a9bd3ff5748b
SHA256 9f1614328e18becb4adf96de98bc91ce2a69274abe6621327cc0fc8503a1ab20
SHA512 c44deeb96597b4498604ecf2060ee0520e84a00308ca1f47ffdf8e3ed3e676b27b622ff7dbd4b6f1a14ce60b05cc2ad9b8d7562bb362c1b12a885ea7fbe50e0a

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\vk_swiftshader.dll

MD5 6720d5dcda6737eb0cc5a352a47414dc
SHA1 03d9a8e350f485dd955f7dee06bfc46371753032
SHA256 d8f36b089d83157abc271d9fe125919c3237943fa9789a511ac5ef1d41e2e3af
SHA512 de5ade6ce14b14957fce669c4181af1e6a6f540798d1c6720b56ff281f813a6ce4446bde33a8f175d2484e07f4911f93a773cac1d372cbe3b26be634b3fa1686

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\vulkan-1.dll

MD5 b6d3af84e8be0027741aa6077768789e
SHA1 e525f2434dc56f79644695f5841e91dd5f80eec4
SHA256 376ff6892ec7b406acd8c455ac82f8541e59e3757195488ff04cd9f20d554562
SHA512 f03b8792a740679c8a1a8ce0615b7876cc811130085f3ffb42182e0cb846519603804da97fc93a8abebee01e03fd257df289c54575da8faaad018f4f4bae606a

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\af.pak

MD5 d9bec09b6c523dc3bca9a81264b1beed
SHA1 ea4ae9dff554c59994632f85af25b36c049fb5b2
SHA256 0b5a45de223ce8522cc296af1e93477540eaa74867428307cc3a5cd21921b022
SHA512 6e7677f86f73edffb5d6162ca19bb7464465f0f485ce2971fb20ad3f57d9fac56b7a21d378701f80e85fb185c3af6a238f8c8707f5874bffffd79d881a54dd6e

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\cs.pak

MD5 92e3fd1eb47767a0cb5f6e734de4eec1
SHA1 33053bfead1fa67160b6a3c417ec4559bfdcdcfb
SHA256 d269e16fbd9b2afe95b148ece22b2ac803768fb53ee42e1fad0181f9dec84544
SHA512 916d73d9b28b0600878418a06388c2ed61bfaf17807a16e1c157a30e5da136c6b6f194e99d151c43b9aa35d101de755caa6da69e1c8a50dd134f27a7f2adc016

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\en-US.pak

MD5 752a3feed3ab6c127767c8fabc9a40b6
SHA1 4af9f9c19904d3bef154b469858dc44b1e630a75
SHA256 c6a6c5d7ab6119bba712d6fe45fd385506d4d0dd8e4156cca3925062f4502ac5
SHA512 ae96d4f391e36f8f741671b72ebd4b1ab2d049b2a99b95737fb9f81743b9e414b46022b65194af5616eb354056addf0e46ef090f56b7d945ef2cb5f4d100d64f

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\fi.pak

MD5 125a121c22dfc2b1a1c759cad9123e42
SHA1 d0282af9ec311c406ecccdfdd7216b7d883e94c3
SHA256 b733460f039dcb3795077ba91dafa3b9b8163dfd0f15168b250630f7de21ed0a
SHA512 c6e0ea8fab8115a632d4c74141efc46ea546f43e0b806d5bd95a1ecd3b8fe37a44565a2f79c43e0bc50dbdadc5d16054e07485fad83c99bd3550a907c852e724

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\hu.pak

MD5 7add28fbbba1ce87972f6433862dcbaa
SHA1 8b4b0053663c0b69beca59faca79854a89ab9c97
SHA256 dd86976d72f3cb644b90c1863e29e2f8616b09ac4acfe9301fb346fa0d87bd78
SHA512 efed0891b0202bae9396df54f141a73bb6ccadd7947330fd9e6a3a8911e9e037454238c4bd2bb9075af3218230c9e4e394f83a70878396911faa282d99fdd884

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\lv.pak

MD5 00b517ce675a3089823708776c6f9302
SHA1 2bc24f150adaafd2604c5d95bbaaf8dc983d7da2
SHA256 0adedd1eaaf902feebb208220d9f21ae1b0175e74f6a966cd7ed226146d86ae8
SHA512 6c19a0d779185141fb050369f9fbfe60d0b838e55e2674e3f14a67e1a6970727e329656e458ca8516a41c97b20e67eb1789587af957129b3d32c94a3536ab12e

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ru.pak

MD5 e9af20a6226511cd535888846a2bb16f
SHA1 739a46269f334ecc291bae6777f0b7c8e271e4c0
SHA256 5db640c6c288d9fc79012a7670301a3bc463359c17ba200aedaa56260ef8d955
SHA512 7897c500718382f08d55f3cddd96d1451524b5c2b8febc65e1700a645598b622c819ec66e4a21c119f044faaa525a2abdddf66d0c9800af6ecea9ceb217a88bb

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\zh-CN.pak

MD5 798bc7d8b63906c5b1c67e89ad17dc58
SHA1 b39c86d6d3fd9d8b8da90d86f827a0c0803fba8c
SHA256 1c05280d8dcdfe99619695b76dd054292a90c1a93a5cfb92cdc4a5b0068a7092
SHA512 7a21af438823d562b889d7c99f639421e01f0536e95f3206dd53d2c8ded82b7a4ab74bb9b4262b2fa27e50efd8dd7719827ad2e6b6d4c2e0d0811930027ed982

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\resources\app.asar

MD5 f22ecb4d9ec69c266ed713cad8ea378d
SHA1 54317e92cd72895cec70a6c7a05a1a84ff692940
SHA256 e6950dcb3c57a32d89049fd7df783acf64b858c45f9bded621781977d55d7c96
SHA512 85ff75ac585da3e5565be38932ec03269af7db93084f8d8d1c45fcd298a26371841cb61c66e36062011728538514b1e42bfb7e35dea513cd82102db45854bcc9

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\zh-TW.pak

MD5 0be25a48eecee48f428fe56fbfa683fd
SHA1 94c0e8c99beb592ebab9ea5b8758aa414bbe7048
SHA256 a5e276bdfe4cf87832eee153596ccde9cf9193e81f29a4295c8335525da64295
SHA512 423033e67654820ab9f9773f45f70908511aeb8228c59126757885e0bbe0bd960257324d405d27526d61b541b1e6323de16bef29d4dcb94f39fd5e92fa811cc8

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\vi.pak

MD5 045241a62232bae57f1d57c6c3af7c55
SHA1 5c2a1a677a8bdfa20f3577335131bd4b89a46355
SHA256 56758c918bbfe6a9d5b20e8b4a7248bdf2d43e0bf5f98e85a9892ff03dbc2d99
SHA512 8e30af44a53a36a194da16a756dff0f90efbef164277bdcde683c89a3cdc04ae5e1298475e8a098d19dab73eb0a71637f676d49d237c5480e1f7aca1765166bb

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ur.pak

MD5 cb228cc41981e8bcbd2768da20026912
SHA1 c55bb999c4c1fbee5e38b6c986fbce2b128f3880
SHA256 a7d825fe348700528800ef9ea7940ee8027373e9c05a4e51e526d0a213c05429
SHA512 85308806be53494683f32520e181dd9c8c9abac0b92bc439d4e30eef22d4af993794a9719dd9a4eeed0bbcaf61c0e2342e7d4ed5d30b504572bd2bc269100e2e

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\uk.pak

MD5 ec3aa18a9d9c989b1025dddb0fa52b55
SHA1 ab3b0834cabee34bc2f9fd04104b10e5f9c102ca
SHA256 ee67744c26e0c69fbed8b102add339070aabc70c2d8ca9ea037c6c9d23b66d3b
SHA512 90d40424b050c6c7ace113e85b0b0a58472967c50a14fbc6637cd3b2db8ff3f521cc94dcd256fa017684256e8a9c19b158aaa57f6d3094fab970578d3b1c6847

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\tr.pak

MD5 82c6a14ba1b28f947bee67bc3feab091
SHA1 25023b22eaed29d0817ec95d5bcb4ad3d724f5ad
SHA256 099507f6f2a2c98ecce275f8ad956eeeeaada65b7788356301af04a0cd7d431e
SHA512 988a9275b7a05d100ca9242dd05969d2363a42938d47db37a1f62ec1874e96b640c14b272f1829ab5c6e0d2763c22fbf0af99894d4d9d32726925eabbc02c05e

\Users\Admin\AppData\Local\Temp\nst2398.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\th.pak

MD5 b18e4574db917920eccfb8e6900d0662
SHA1 554206b9e639135074b0946fb28b6ffe2d934159
SHA256 c14fa1bb30c880216d6cfea6fb738235cf72a3fe8be919c3d61321d5a5883211
SHA512 5f427f9ed85bb368b45bafd523c634e18596e430fdc380563878d2ca897cf2580d0405f7c0d8e10abba389bb7125978a81d335263bb777e0ee0bfe3d47c8c65f

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\te.pak

MD5 a4accc25dd8a00bc57df4fca12e41295
SHA1 9466888034c9e6ecf4113ddda63d363ed20e3156
SHA256 157d646525f6a9ac267466631671e65e9b5c3e55b008b564186e64c6853e52aa
SHA512 f19116655b6c2bb5c572b45f1d712fa1f9d57d9e8963fb3d654ed3781bd34a4e937b590bcc1119a318e28632da12a0ef8b36f6426791de833898cf7f30189567

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ta.pak

MD5 aa06ead1200f01c9460399f0abe2d54f
SHA1 9b852c4691209c0ae9edf94a5dec4b902fec7b3e
SHA256 1946d903918c57836d2f898ef93cd1d575da1a464e358c399dfde73ea2ef057e
SHA512 6e556b962c16aee22695d93b62b308d95b0695873fb33d13a147b3d8b6791c9599daa6e3bf424a1897212a018ab36dd8c8214c2eb03457048c6931686be40e04

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\sw.pak

MD5 a63ef2c4676dfbee98e29a84a7ad9d27
SHA1 2f0f4b33acf5e63f3159c62c74deaa9a361203f4
SHA256 7b8c51b247dea72d68cb0ef4292800c13209da6f859a9ad289c996582f19e65c
SHA512 cd65fd2c49d35757de648f21dec748fb4a1d13d2308552774fe9c859ad5748b21f5db449f8b380520f27dc868a3ebaafd58d4c45aba34033785777d342e17e6f

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\sv.pak

MD5 cc0806219798e3ade0437219457a37ab
SHA1 dd6ba47e14b7b0d08159fbca2409b013dc2e17de
SHA256 79a7260c8651ff3024e21f9263543bf4e9d5f3574e81cf96edf6388f8da85cd1
SHA512 df3da02bb2fecbbaf1ab80af8ef8b1a7ae9f6c7ed01f94c5a502720376924132c344dd716fc5b4ddc03733a6c3581ed8d8a577154c619ba85c527dc67f4a48c2

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\sr.pak

MD5 abdd9eb966d915c1896b31cba0b2656b
SHA1 cb0080e5f2c168cd0f3edc6ed6c47734ffd67790
SHA256 3913d3be5016ce873ac68af376d5fcf558bb5f5f29a9bc56df0099ba47e52486
SHA512 bcb258d6da766bb6f00dfdbb03bc878000d9cf28b2b707375ce52485db9c530a34d1528a1473f09b5765bc57abd847f191bde55646eb707443cd0e40509b70e1

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\sl.pak

MD5 aa7c0f35b61a230d65e498daab67388c
SHA1 f60cb1c7128a1fb1cfd9aa029f96df36033777d0
SHA256 03afc83cdba98c08af169c8ae111aa916f3ee6d5a2fee4954ef35ecc063f2b21
SHA512 048d03c490f18d22f4900363f9c4abee037a2029f226c90806064ffedc85b07a1d86225b9c534311b08f588632a84221d7e4fa355e7b768cfdfd6102c5ffe705

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\sk.pak

MD5 b0bbb6661370d27b6600ebe98cadb9ac
SHA1 1139852da47048f15c16eb101dac86dfc8f652ba
SHA256 e0fe4130e668ac659d5334c5bc8cde70bba8742273b5965836860b5a8b1b016a
SHA512 c8eac323552f873ec088f77b8c46522387b0298b6d566cf8aa173fa9b2d66389068bb26e46044af2faa4224b39dc748164843b58b99e9dde093fcb32afb5fed0

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ro.pak

MD5 5db10edf772656c0808dd8da698334bf
SHA1 3caf7c9d5a3b44e06e0588daba698b6970ea06f5
SHA256 73b6a63352906d77196f38a1df937ec0770160fb7a93321867c7994ed3e7967b
SHA512 eb253b548c7f574943136764a23818f9dedea17ff42f92dc8591f4b7c297accdde9f6b2c0ad96f1fd0815c53940c0102a90c603f9f4d6d9c8fb053b559cc7a62

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\pt-PT.pak

MD5 cbe5e35f844f5f1400df3685cc847694
SHA1 e60cdb0a813a97c8548c878276bfae155350bb42
SHA256 6b9bd714d217d596183894ffed3174a617e1c8cfae292231d4b967183b589c6b
SHA512 96046c97436a3dbf5aac479b9eaa9dfdcfc81f1edcaee9cd65d59beb0ce6b6b42828e0d170aaef2ef1d68988f7916ac1dbac0d84218de83fedcca8592de4c1f1

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\pt-BR.pak

MD5 b1ab7d7aa67a7b61bfa9aebad0b812af
SHA1 95eff4be517c0a25c34578def10d48c77021de1a
SHA256 5bd503c413aaf8fa87fd47c341d437accc25397a50b082068bcf2f3bb4fb27c7
SHA512 8498fe7727771df3c1eb34560c1e25b0c30690c7c921104b4adcf04cc5753462bac513a60a5833cb6f57733201d4883605f8a4ec4a457f3ebc7c952090b1a9e1

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\pl.pak

MD5 8a4354163ff3b0978a568f781bdac289
SHA1 45de421f35af79adf962809cf8d0e6d2adbcb553
SHA256 2f6de0f9a46ae0b75beb67e09ffeee12483842a7cd6f2a2382ccbe36fbfc17e3
SHA512 5760f20228afe74e9ff2a916a168e8cc2d4a64d8e76065e61a7a60616a473c7dc3da4805125b270f179b7a0f291071e81d761d82eec3b130d552b57abd76c127

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\nl.pak

MD5 e8b790166d701f63a60c3b322fcce234
SHA1 61ec318aa8030f7d29c3258126b156d1d3eefa2c
SHA256 3d73b0110e5832b6a7c7b7e64018368464ef8552d6a98592d0adbf713eb9755e
SHA512 4e4b299cb55cbb5906ff974bb5e5078d2018298b5ee6d9ca0e40aab8db542aaedc4bd7a5db242a2c5194bc90c07631f627043dcc1a9f2d095a28c3e35f212dd9

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\nb.pak

MD5 2a0ec73d03d4d7fcec71ad66cc0d4b30
SHA1 bb8df6e11b02086726ecede97d5f729f4197323c
SHA256 d44ef5e644b1b8f7c056d5e20651515fcc8565befec575091735fb39c6d63554
SHA512 cdcb4e436270156e263d731ce243d821c5361b18b6d7b8259875c9d895301d478a87feb7cafc3376d09d18d27f32dc403fd2cbd034d68736cb968bbefebd642b

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ms.pak

MD5 6149507c3aa99c4012d9d7cfe4bc30c8
SHA1 51a2bb5cbae64f3877afc342ea0f43915702f8f4
SHA256 dd75481d67d9be36ecb2e421117395fbb75b7623164f13a09be1cf3ce76d588f
SHA512 71f8dc03618d46be7b036353526bf20a61e648ef50adeeec057d314e9a4536899c37ef691164bf9de9e10a3867749f8d3d6f4038e16c82cf6122e7ab4a1c7732

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\mr.pak

MD5 0e5b29b6ae74a1f94ca4f880f131a79f
SHA1 6ac5089ace05847480d2aeec89954124caa781aa
SHA256 25bf8e86f7c9e88f68d4c40c4f124c16f60daf22e7a87f55ba2c560a0f640bc9
SHA512 30717c0aef4458bbcf7472316727981829edada8be3003afd9d65cb01d4cf309f601b1c41539343d6239cb2e9157554c95cf966a4156458a2fd78d2464075c98

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ml.pak

MD5 d32a29a61e8afaba6b42d236257d9929
SHA1 9664f50ea7590a47c2eb8eb4a3e49be556d08f7a
SHA256 a59fd15c969ee8ffd7e72f5a2245c6a5a4fc048f7899fca489d78c8f6394ca1e
SHA512 2668976853b26b22859f8c20afaeb4d641845e94779b8994b49f240302420279e3f9a99666b8f551495b7d5a8c3c83609b7ecf276fabd8345cc8c787319ea3d2

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\lt.pak

MD5 7cef6e31d76861db4d7d622fdd89e5aa
SHA1 31fa45c3b7666259d4d8a13518ece423a97edcca
SHA256 2f1e1c69da5cad8f47e45af0ac47cec90c20fe2897a43cb496c7feed1ec5d1ab
SHA512 df66a739f3a8da62a942b56b23f71a2b68469e87dc44eb8ce1a9a859a609f1db4bee2497defef06fa48e14cf461e61410668a5216459c94c79f4b69a3cf092f6

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ko.pak

MD5 4b563eb612d4fadc6bd8a4c918006ab1
SHA1 4b9e414af0c044c4487d1439d23ef11b0169d308
SHA256 e0d4461452607e0f4a619efe653ec9ec39f7d34a742ae98374b2bce0b821adc9
SHA512 b8c56d69fa41ad14f7197acab1ba987ebb06c5b15748e21cec27861721545e30fb20f76f2c3a752c8ea94cca1e6b4fab7fb0727b679a8fb8e94db2d5c028e7a6

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\kn.pak

MD5 52a0707a70b939bcd75b0838a5dc5357
SHA1 eb9e1350d9d217580b1939302d008dc07c3b781c
SHA256 b177eda102b1be8c53127e3bb47970a3c1e2032be24900d8a126c5f0f077ef3d
SHA512 d5fe69035338c4308f661fa0ac25c4a811a6014f6bd85ccc7ad947f76aecf76f67208512e1266e249ec067a5fb22fb74a3550b0f3aeb1bc50fadb3a9d3cc67e4

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ja.pak

MD5 5a69547f56dc61e482dcda1ce704c5ac
SHA1 5b7bbc8e9b14d78f2105136afb7728050128c02e
SHA256 a286a5faf9021927ec09fd8cbf30ed14ad59c3baa36d29e5491ad27b957915e5
SHA512 2b9d020544201e2d0b0b44b0977fcbab858563969ce02be65689c5f5b780adc4560df523589293cd66f42903322ed61d781da093adfa44aa0681a28d97de4556

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\it.pak

MD5 6aa3bc3ee4999c324b82e50940e62c74
SHA1 10af8030fc2f875e133c9417e0221528160ad8b5
SHA256 73cc8422643a65753b2c3672c8f8331ee92c9bddc912576554e95b0986cf990d
SHA512 f039ef32002e55d09a4f567cc81fe2b3b329d517c985436a5da121ff0e6ac7e258b5d1fdda81e6c1578daf7078b91abcfb7da98cdba6693d4fbe7f28115e6971

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\id.pak

MD5 cfc848689a25f5e2e6ba9a06e09b6ee0
SHA1 35131e775d98a57ffcbd6a75e69f6f67437636c3
SHA256 ec1d7bbe064656dc53f70e3a612a582f5d5d0af5f0c2d6a783796cffa5bf7f57
SHA512 d5a027e35dd3846f5255b81eed36a3498ac9d809367692b2da216b5771c2d54fad35fc15c15705a2bbb4a7b35dd2245661882734998f9bc3ad8d62d2273b6577

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\hr.pak

MD5 fda338824b4171b10dcc3395a549fa9f
SHA1 ea42c8b18228e0ca57b8ed7ed48e3a2aebe08486
SHA256 43f370368b322cd1236632c82aa0e231965dc58fdd497f8aeae6b40eef9ee611
SHA512 9115f805f51f45839e0a87cf44c1cce311cecaf717c0da7db3b6da85cea95f24638af29da43bc01056994b22049daa0387cd4371c13b8e5399fe8f4e38771d57

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\hi.pak

MD5 6aa92c296ed09fe2aa94dc060b25774a
SHA1 7619ed3dc5b1e04c55b0ee7280ac2d0135eb9c80
SHA256 0c771c66db4f80a62912564944c4e239f8dac8381a06483ecab512e0d75744a1
SHA512 9255a4ffef7be07ceab5dd8f46365b9a52d621ae175c1022bb4685fe4f3ea63425f45aa9ef824b467b9c33c51a7104258e888e8ec15c88fea126bf0b5337ff14

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\he.pak

MD5 16562c59fba469e1dd2f3b0b87a64645
SHA1 9a6863205fca8ea6d09a98b8e8dab543ff6198a1
SHA256 64fa2e98a9056e23c3a934ff39fef81c306cec5844d56dda17ec6c25fcdb1b5a
SHA512 dbb6e1a5e52a005386007f88b53109037792bc7b65fb95ace3e8cc5ae3ebd8320c7e406381c375bf751a9265ace84e0bbe1301d4bf3aa79200ec789dc3b3bc0b

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\gu.pak

MD5 6c949199eaaad8fcb12c38ec6c02d758
SHA1 ce4dbd5e6a37f25354ec6849f7008956ef3568ba
SHA256 966591a74e44c75c7f0114bb8e36b0e9f5502aebdc96c714c8a8f6d45bc863c8
SHA512 3344e0083969de6f4913893a14586b441f65cb5d45f913f1cea61b8d5abbdb3b1c18a48731870282174263c1f306ed6b99c279627bd269e89cd4e15dc3d88313

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\fr.pak

MD5 651e4cb14c4f784d36d0a1715c52dcf3
SHA1 540f6090e3223ad8e6424a9db78305f2db9974bf
SHA256 6d547cbc3304627d14aeb138aebd40786c30a4192e071d80bcecdb77a13ac80a
SHA512 1fe93058ec434c06ef4aa1519333ebd831311971b06d7279ddc4d86dfa860bbd6ea6d127b2a07425c3e78bd6d41c11eb2a76cf25b20c6a7de74d1f0ceec87079

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\fil.pak

MD5 eaf43729e9bbd8004ef1ff56a3d85a48
SHA1 34b31ab8ea2ce6bd263f00acc50d5af8d0222d9a
SHA256 8559cc35335bb2c249297f4c7506df95cef899ef5f7ad942d2d511ae074d41b0
SHA512 010f8e5c3b969be0db4baec3acffdd69be25662387968e15e11af0da68ec2f45dc9edb83cafe7c92234e1e4e4aae1682223235af04d99e8b5238379e022e3d35

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\fa.pak

MD5 caee902136579f4bac72a6f0f75d171b
SHA1 cbbaf988a499005e21fd86652e1f48af8bce2c35
SHA256 e86f677e9654f6a16a7738e85a5a5d467a09cb18e47654f079506a00affad70c
SHA512 c0f2e8457f71789da8ce207aaae2f83196daac868fcaa7a84de04dd38730f8831b9643b8a404a7aa59c5b726da02090bba414529019f5eb9c94ac5a5af61bc9d

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\et.pak

MD5 8e2c2cc8c516d8b7181c0c712ca24513
SHA1 e0ccd9ed8de6640379f822a067dcf97d4bbe44a7
SHA256 c96937f46fb1b1182b201f5c48fe1da4d3f94a68a0e6e0699ccc0944cd0a5a33
SHA512 339bc655f22068f2ee9352a670325865265e4279197430214f7e3fba575415318110cccb03aed2c0e7ac673d4629bd495dc34a56cefbcaab62e1c4a1a87ed8c2

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\es.pak

MD5 3db06ea954c83343bd333c15947f521a
SHA1 ddde6ab9f9085e83ec8bf7a37df3389040acea42
SHA256 45df7340fe3c8560b11ffba2219de1b5c45dbfe57b6db90bd6c246244fae338a
SHA512 cc29f1075c119daddaa108c17abb6d572925cac1ed2237ed2fd45364bfb2a00c1144fccdd22c6728c954af2cdd1b9477f39968ba25354bca2b9dca07f5c53dde

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\es-419.pak

MD5 85e9b056e3ac3f6a5b113ed9f460e202
SHA1 dcceef6ea85d71a85dd24d17ec65371dce76f480
SHA256 16fe83762ed578c49685868418325920a72cd457907bc4e5264f2c172d53b27b
SHA512 e4dfde9c1260df1f77b7ec1797658f8cfeaab98142a8d512ed3bfac054933a4583f20091b97985b4ba9cf93f9faca3e7b0986cb4a3eb12fe0bc04ee1c45d3e0f

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\en-GB.pak

MD5 985558de03bf486aec1daadd39cb508d
SHA1 b693ddef983e8af212936202ddca92d908378404
SHA256 1956d448a4d333638f3601d0da976710cbe0a795504eb694ba18311fe586d195
SHA512 13d1c82b797ad4ff25a94a996f9fb52b530643a0e735f96e32b9e0698962770148d95db7beb91343d781fb84378a3e334ac0c1c913d8dbae20f425bf0dc364d3

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\el.pak

MD5 58d6eaf71b9b73f5f7f057c73d0d92ec
SHA1 16e0587753e7d2834f4cbb24fed45e7bd2f8f2f4
SHA256 8474879de21c414d34c44cf0a8c91356a66dbd647308a4f994be25bd1f93a89f
SHA512 ab24c9655bd68e4a64e257914a35dc84b5f791c58b396ae004bf5da61df19c02ef9ca572b8e63f15baf3694ae1e540adf74586f10d28d7ef90edeec982bcf28d

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\de.pak

MD5 3a8de004b3a610271e1d1913b6d4b53b
SHA1 236893c3f7b450e6ad8b4d54e1a62b2e635b42d6
SHA256 43c060182c92caf4aebf8fd7b913dfe017beea71e796e862ebf8746575948364
SHA512 b70f849ccf7dd9e72d71522591420e0baa03ff74763b44563b0b3800ba3a88cb8b973fabb90bbb6653819947eca47f70e347958e3c31ab226957f7313bc03554

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\da.pak

MD5 43029018648d558f9bbf7a74c59eb281
SHA1 90c6618cccb4db85d7485ae8d809ec3af4763e70
SHA256 4bd88f6ab82842358987aad384775b35198dd75c2cce4cae783208ed69296a7e
SHA512 9e8ef9d4367ad01f2f4e7dd6f9884e463729ee5a0f678fd16a3ce093c21efc1d78041d5c6e45037f37bfd732e4833744485b00acfda2313a1d1e947993129a3d

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ca.pak

MD5 e1ac7f4c28177f68fac3be2375a9368c
SHA1 3d7738699087468a748f9b1189d2f7621187d03b
SHA256 efa1ba906f8abce91ebb9d6442b64e0d5ae7dab78dda8a49a6fed1a342c71b9b
SHA512 aee8cb28eb02e2fb2155c8d093cf678284e3571f46b913f743de3c6d0215c18b80866ff446f46ada160860ed9c18ae9a4209424e7e0f0ba97c78a3fe9815ca5a

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\bn.pak

MD5 fc66adf3deac72fd39105540dd2daeff
SHA1 a53b54efcc1285a226d605116f87d12f69942482
SHA256 ef50cfebaf9e32edeec25d30197ac5899b3db8a0676671f639d32bc48f3b3bd8
SHA512 0b77daa056451d01a8cfb3ff1acc08d34e64e0a32bb119c8837ae3d6e3d5195311427c6101efd7e7bc9104aa369832bb12aab3d4080c00dc39edc98b6c0b949e

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\bg.pak

MD5 7c37c8c9b4215089b6c16d22838d256b
SHA1 8f2afdc21353685353a0562452f4a79180e58829
SHA256 2ebd582dfaa3139cd6a03e9892a94a3d9bb6936e0b04085b8f2d27e1dec0bc8a
SHA512 beadd70e9d706576bfb6725617385f776e9f68c84d116b01187354d377e2c860899da34f8c5a054c4bde41a57e9aac56445f6ac0b8da8c75a424641a86fdd718

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\ar.pak

MD5 ac865ff462f341b4317c3d16eeb40460
SHA1 1e971d97f09884b23595f17534227ea43cf99090
SHA256 0557bc17eb1d134bd52f203836551b55579114708e2df51f653972951567513d
SHA512 a935b91a2c053303e941866cfc151f28053faf364aeece98d61fcd68fef6c6f1d3b73de01cd602c8a4a081cce452d1ce87f8166ba3c0e8b81e91d932f84737f2

C:\Users\Admin\AppData\Local\Temp\nst2398.tmp\7z-out\locales\am.pak

MD5 e3933de22dc7fb98215b083d8a379f40
SHA1 68ddbd9bcc931f0d4a172fa65af35b823c7c9e37
SHA256 eaa747075e5a62be8b7df5908e167ccc5314c9c6a8b890059d00284a3c496fef
SHA512 7beb80fa029f41cb21536b15c604e2ae9dfc20b4a3ec4f5cc04e2b105d4b2c251830624957197084761f9686f95d332e25d4f6178509ad58257af90d96a9e7d5

memory/2096-571-0x0000000000640000-0x0000000000642000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1340 wrote to memory of 4704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1340 wrote to memory of 4704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1340 wrote to memory of 4704 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4796 wrote to memory of 2652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4796 wrote to memory of 2652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4796 wrote to memory of 2652 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2652 -ip 2652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

156s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Rhadamanthys family

rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3304 created 2648 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\system32\sihost.exe

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BGInfo.bmp" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\openwith.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\TileWallpaper = "1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\WallpaperStyle = "0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Colors\Background = "0 0 0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\.bgi C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\.bgi\ = "BGInfo.Config.1" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\BGInfo.Config.1 C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\BGInfo.Config.1\shell C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\BGInfo.Config.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\",0" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\BGInfo.Config.1\ = "BGInfo Configuration File" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\BGInfo.Config.1\shell\open\command C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\BGInfo.Config.1\shell\open C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\BGInfo.Config.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ChromiumDriver\\Bginfo.exe\" \"%1\"" C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\BGInfo.Config.1\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 864 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe
PID 3176 wrote to memory of 3304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 3176 wrote to memory of 3304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 3176 wrote to memory of 3304 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe
PID 3304 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3304 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3304 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3304 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe
PID 3304 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe C:\Windows\SysWOW64\openwith.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1748,i,2367029622722702312,11897228306250527683,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar"

C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\DocuAppCenter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\DocuAppCenter" --field-trial-handle=1988,i,2367029622722702312,11897228306250527683,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe

"C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\Bginfo.exe" /taskbar

C:\Windows\SysWOW64\openwith.exe

"C:\Windows\system32\openwith.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\6a586462-3f40-49f8-9b73-d8921b71889e.tmp.exe

MD5 3aef228fb7ee187160482084d36c9726
SHA1 8b76990c5061890c94f81f504c5782912a58d8a6
SHA256 c885df88693496d5c28ad16a1ecde259e191f54ad76428857742af843b846c53
SHA512 e659a7cf12c6b41879e4ce987e4cd1cefce2ffc74e06817667fa833764f36f25cc5f8374dbc844b68b787acac011c7b8c8f2b74563bf8a96f623ebb110a593da

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\version.dll

MD5 f8e8df746881bb6c15c61fee344b12ff
SHA1 6f5d6bbea6b3ef8f931fc18b51d0fdffa6367430
SHA256 4ec7e1ee6c2080e341c2a94d90af71d17d1f8f38bab8fc556219d11a79fabf85
SHA512 dc231aacd9e754192ca160823b465c9cb9ea3c9bbe35cf485428c2266c8112a292d05db7942d1ced210c072d71036a42777533359e7f34881bf0038940bfe309

memory/3304-113-0x0000000001A50000-0x0000000001E50000-memory.dmp

memory/3304-114-0x0000000001A50000-0x0000000001E50000-memory.dmp

memory/3304-115-0x00007FFD4D570000-0x00007FFD4D765000-memory.dmp

memory/1748-118-0x0000000000350000-0x0000000000359000-memory.dmp

memory/3304-117-0x0000000076750000-0x0000000076965000-memory.dmp

memory/1748-123-0x0000000076750000-0x0000000076965000-memory.dmp

memory/1748-121-0x00007FFD4D570000-0x00007FFD4D765000-memory.dmp

memory/1748-120-0x0000000002250000-0x0000000002650000-memory.dmp

memory/3304-112-0x0000000001580000-0x0000000001589000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ChromiumDriver\encrypted_shellcode.bin

MD5 9827ae88a9588b26de69046117d21c81
SHA1 c591b24672b8509dbdc087fc245a1f7fea3b1d9b
SHA256 3560f325b7a2c0918910bddd6462adef786270959e765069fc6dc3320f3180a6
SHA512 66c1f90a4a9dd2b31f9ee3e1049620bcec5bfc644546d4e18b651bc79b45e58a73e82d676dcb34819e59735b3d92163e80b9b1311285f6f452f97020439497c6

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

91s

Max time network

141s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2736 wrote to memory of 712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2736 wrote to memory of 712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 712 -ip 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:38

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe

"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall DocuAppCenter.exe"

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv | "C:\Windows\system32\find.exe" "DocuAppCenter.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq DocuAppCenter.exe" /FO csv

C:\Windows\SysWOW64\find.exe

"C:\Windows\system32\find.exe" "DocuAppCenter.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

MD5 3fe065f3111d58d008fb8eb403a11a7c
SHA1 74ee9374e92cec677f39326d58b5f740b438cf10
SHA256 3866f85e7e0524bc2b5b43315da8e721b0e031ece4462329cab4892756abcebf
SHA512 e314110fba7203dca4ca71e75330c578889e3a01288be0dc1b04eba311b231199ffbe89a4cbbe58531b52c042b801dcb12fbe9e9f19e1427228007dfd6cd7ee7

C:\Users\Admin\AppData\Local\Temp\nsqA0D5.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsqA0D5.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsqA0D5.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsqA0D5.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Analysis: behavioral29

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:37

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1220 wrote to memory of 2928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1220 wrote to memory of 2928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1220 wrote to memory of 2928 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2928 -ip 2928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-11-16 14:33

Reported

2024-11-16 14:37

Platform

win7-20240903-en

Max time kernel

117s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 220

Network

N/A

Files

N/A