IOC Report
SenPalia.exe

loading gif

Files

File Path
Type
Category
Malicious
SenPalia.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
malicious
C:\Users\user\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
ASCII text, with no line terminators
modified
C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\LICENSE.electron.txt
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\LICENSES.chromium.html
HTML document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\chrome_100_percent.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\chrome_200_percent.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\d3dcompiler_47.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\ffmpeg.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\icudtl.dat
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libEGL.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libGLESv2.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\af.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\am.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ar.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\bg.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\bn.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ca.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\cs.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\da.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\de.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\el.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\en-GB.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\en-US.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\es-419.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\es.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\et.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\fa.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\fi.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\fil.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\fr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\gu.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\he.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\hi.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\hr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\hu.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\id.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\it.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ja.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\kn.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ko.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\lt.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\lv.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ml.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\mr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ms.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\nb.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\nl.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\pl.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\pt-BR.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\pt-PT.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ro.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ru.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\sk.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\sl.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\sr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\sv.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\sw.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ta.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\te.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\th.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\tr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\uk.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ur.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\vi.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\zh-CN.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\zh-TW.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources\app.asar
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources\elevate.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\snapshot_blob.bin
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\v8_context_snapshot.bin
data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vk_swiftshader.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vk_swiftshader_icd.json
JSON data
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vulkan-1.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\SpiderBanner.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\StdUtils.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\app-64.7z
7-zip archive data, version 0.4
dropped
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\nsis7z.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
There are 70 hidden files, click here to show them.