Edit tour

Windows Analysis Report
Mansion_setup (1).exe

Overview

General Information

Sample name:	Mansion_setup (1).exe
Analysis ID:	1615829
MD5:	b51a099db70fbe7d19e9ff67e628fd41
SHA1:	f46b9367619d335451d6c5b747101e116a2d29d2
SHA256:	36be5a492b06835015566ffd1217a94ba86a274dd98e3a648848f1143619ca23
Tags:	AtlasCareHomesLimitedexeuser-SquiblydooBlog
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Compliance

Score:	49
Range:	0 - 100

Signatures

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Drops large PE files

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Enables debug privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Dllhost Internet Connection

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Mansion_setup (1).exe (PID: 7608 cmdline: "C:\Users\user\Desktop\Mansion_setup (1).exe" MD5: B51A099DB70FBE7D19E9FF67E628FD41)

Mansion.exe (PID: 7916 cmdline: C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe MD5: 92FD2FE1716B9F3E45B6AE30FFF45D8B)

Mansion.exe (PID: 8164 cmdline: "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1652 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 92FD2FE1716B9F3E45B6AE30FFF45D8B)

explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

MSBuild.exe (PID: 2044 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 4240 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 364 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7620 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

svchost.exe (PID: 6204 cmdline: "C:\Windows\System32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 5688 cmdline: --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr15B6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/d0fbef96/bd5c97e1" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2228,i,1313803575449606696,11911411455849681461,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 6900 cmdline: --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/d0fbef96/0da50779" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2224,i,3086125716147971170,5077429259784092469,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

wmpshare.exe (PID: 4692 cmdline: "C:\Program Files\Windows Media Player\wmpshare.exe" MD5: A89F75B51EAADA8C97F8D674B3EDB2F2)

dllhost.exe (PID: 8000 cmdline: "C:\Windows\system32\dllhost.exe" MD5: 08EB78E5BE019DF044C26B14703BD1FA)

Mansion.exe (PID: 7380 cmdline: "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --mojo-platform-channel-handle=2864 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 92FD2FE1716B9F3E45B6AE30FFF45D8B)

Mansion.exe (PID: 4656 cmdline: "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --app-path="C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1739624080749253 --launch-time-ticks=5384764539 --mojo-platform-channel-handle=3108 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1 MD5: 92FD2FE1716B9F3E45B6AE30FFF45D8B)

ExtractJPEGcmd.exe (PID: 7428 cmdline: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe MD5: 98FD0CECF45A8DC755F232E073B509E7)

qtZint.exe (PID: 6664 cmdline: C:\games\DDR5_NetCache\qtZint.exe MD5: 1944E1DC273E06252EAE4971DEBC0D91)

cleanup

Sigma Signatures

System Summary

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DestinationIp: 45.91.193.85, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\dllhost.exe, Initiated: true, ProcessId: 8000, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49999

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 4056, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 7620, ProcessName: svchost.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe, CommandLine: C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe, ParentCommandLine: "C:\Users\user\Desktop\Mansion_setup (1).exe", ParentImage: C:\Users\user\Desktop\Mansion_setup (1).exe, ParentProcessId: 7608, ParentProcessName: Mansion_setup (1).exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe, ProcessId: 7916, ProcessName: Mansion.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 4056, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 7620, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (actiothreaz .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:24:57.751980+0100	2059907	1	Domain Observed Used for C2 Detected	192.168.2.7	64769	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (breedertremnd .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:24:57.784365+0100	2059911	1	Domain Observed Used for C2 Detected	192.168.2.7	54307	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (garulouscuto .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:24:57.764064+0100	2059915	1	Domain Observed Used for C2 Detected	192.168.2.7	55827	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (importenptoc .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:24:57.612400+0100	2059919	1	Domain Observed Used for C2 Detected	192.168.2.7	53485	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inputrreparnt .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:24:57.648233+0100	2059921	1	Domain Observed Used for C2 Detected	192.168.2.7	54993	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebeldettern .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:24:57.738279+0100	2059927	1	Domain Observed Used for C2 Detected	192.168.2.7	58711	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (torpdidebar .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:24:57.664935+0100	2059931	1	Domain Observed Used for C2 Detected	192.168.2.7	52295	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (voicesharped .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:24:57.637085+0100	2059933	1	Domain Observed Used for C2 Detected	192.168.2.7	50072	1.1.1.1	53	UDP

ETPRO JA3 HASH Suspected Malware Related Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:25:30.720980+0100	2854824	2	Potentially Bad Traffic	45.91.193.85	1308	192.168.2.7	49997	TCP
2025-02-15T15:25:39.331812+0100	2854824	2	Potentially Bad Traffic	45.91.193.85	1308	192.168.2.7	49998	TCP

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T15:25:15.354986+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	1308	192.168.2.7	49983	TCP
2025-02-15T15:25:30.720980+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	1308	192.168.2.7	49997	TCP
2025-02-15T15:25:39.331812+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	1308	192.168.2.7	49998	TCP
2025-02-15T15:25:44.704791+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	49999	TCP
2025-02-15T15:25:51.301017+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50000	TCP
2025-02-15T15:25:57.890444+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50001	TCP
2025-02-15T15:26:04.485182+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50002	TCP
2025-02-15T15:26:11.074560+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50003	TCP
2025-02-15T15:26:17.663627+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50004	TCP
2025-02-15T15:26:24.334680+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50005	TCP
2025-02-15T15:26:31.020416+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50006	TCP
2025-02-15T15:26:37.528824+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50007	TCP
2025-02-15T15:26:44.134706+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50008	TCP
2025-02-15T15:26:50.706638+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50009	TCP
2025-02-15T15:26:57.317269+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50010	TCP
2025-02-15T15:27:03.922425+0100	2854802	1	Domain Observed Used for C2 Detected	45.91.193.85	443	192.168.2.7	50011	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: Mansion_setup (1).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Creates license or readme file

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user~1\AppData\Local\Temp\nsyC1B1.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\LICENSE.electron.txt			Jump to behavior

PE / OLE file has a valid certificate

Source: Mansion_setup (1).exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50011 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Mansion_setup (1).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr

Spreading

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user~1\AppData\Local\Temp\nsyC1B1.tmp\7z-out\locales	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user\Desktop\Mansion_setup (1).exe	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user~1\AppData\Local\Temp\nsyC1B1.tmp\app-64.7z	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user~1\AppData\Local\Temp\nsyC1B1.tmp\7z-out\resources	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2059919 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (importenptoc .com) : 192.168.2.7:53485 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059915 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (garulouscuto .com) : 192.168.2.7:55827 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebeldettern .com) : 192.168.2.7:58711 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059933 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (voicesharped .com) : 192.168.2.7:50072 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (torpdidebar .com) : 192.168.2.7:52295 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inputrreparnt .com) : 192.168.2.7:54993 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059907 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (actiothreaz .com) : 192.168.2.7:64769 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059911 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (breedertremnd .com) : 192.168.2.7:54307 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:1308 -> 192.168.2.7:49983
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:1308 -> 192.168.2.7:49997
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:1308 -> 192.168.2.7:49998
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50001
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50002
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50000
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50004
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50011
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50005
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50003
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50010
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50007
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50008
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50006
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:50009
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 45.91.193.85:443 -> 192.168.2.7:49999

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 45.91.193.85 1308

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 45.91.193.85 ports 0,1,3,443,8,1308

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.7:49983 -> 45.91.193.85:1308

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 194.58.203.20 194.58.203.20
Source: Joe Sandbox View	IP Address: 129.250.35.250 129.250.35.250

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: HOSTCRAMHostCramLLCUS HOSTCRAMHostCramLLCUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: caec7ddf6889590d999d7ca1b76373b6

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 45.91.193.85:1308 -> 192.168.2.7:49997
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 45.91.193.85:1308 -> 192.168.2.7:49998

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.224.46

Source: global traffic	HTTP traffic detected: GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMDtATfnJO6JAXDQoHl8pAaJdhTQQU3QQJB6L1en1SUxKSle44gCUNplkCEG1SGHCH6CNNhWAA0ICPk1Y%3D HTTP/1.1Cache-Control: max-age = 86400Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 26 Sep 2024 16:44:07 GMTIf-None-Match: "59820a5ba49dee3594b50ae906ccedc5b81eb911"User-Agent: Microsoft-CryptoAPI/10.0Host: ocsps.ssl.com
Source: global traffic	HTTP traffic detected: GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQg3SSkKA74hABkhmlBtJTz8w3hlAQU%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D HTTP/1.1Cache-Control: max-age = 86400Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 26 Sep 2024 16:44:14 GMTIf-None-Match: "3d5557f4d0ce85b5d42ae97579b154c53648c418"User-Agent: Microsoft-CryptoAPI/10.0Host: ocsps.ssl.com
Source: global traffic	HTTP traffic detected: GET /ud83c7gi0/8pe93ha5y.php?get=c3RhcnQ%3D&name=8J%2BqliBNYW5zaW9uIGdhbWU%3D&info=V2luZG93cyAxMCwgNTYyMjU4LCAxMjgweDEwMjQ%3D HTTP/1.1host: 95.216.224.46connection: keep-aliveaccept: /accept-language: *sec-fetch-mode: corsuser-agent: undiciaccept-encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ud83c7gi0/8pe93ha5y.php?get=bGV0c2dv&name=8J%2BqliBNYW5zaW9uIGdhbWU%3D&info=V2luZG93cyAxMCwgNTYyMjU4LCAxMjgweDEwMjQ%3D HTTP/1.1host: 95.216.224.46connection: keep-aliveaccept: /accept-language: *sec-fetch-mode: corsuser-agent: undiciaccept-encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ud83c7gi0/8pe93ha5y.php?get=ZG93bmxvYWQ%3D&name=8J%2BqliBNYW5zaW9uIGdhbWU%3D&info=V2luZG93cyAxMCwgNTYyMjU4LCAxMjgweDEwMjQ%3D HTTP/1.1host: 95.216.224.46connection: keep-aliveaccept: /accept-language: *sec-fetch-mode: corsuser-agent: undiciaccept-encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ud83c7gi0/8pe93ha5y.php?get=Z2V0ZXhpdA%3D%3D&name=8J%2BqliBNYW5zaW9uIGdhbWU%3D&info=V2luZG93cyAxMCwgNTYyMjU4LCAxMjgweDEwMjQ%3D HTTP/1.1host: 95.216.224.46connection: keep-aliveaccept: /accept-language: *sec-fetch-mode: corsuser-agent: undiciaccept-encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ud83c7gi0/8pe93ha5y.php?get=Z2V0ZXhpdA%3D%3D&name=8J%2BqliBNYW5zaW9uIGdhbWU%3D&info=V2luZG93cyAxMCwgNTYyMjU4LCAxMjgweDEwMjQ%3D HTTP/1.1host: 95.216.224.46connection: keep-aliveaccept: /accept-language: *sec-fetch-mode: corsuser-agent: undiciaccept-encoding: gzip, deflate

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: ocsps.ssl.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: smartsjolutions.cyou
Source: global traffic	DNS traffic detected: DNS query: importenptoc.com
Source: global traffic	DNS traffic detected: DNS query: voicesharped.com
Source: global traffic	DNS traffic detected: DNS query: inputrreparnt.com
Source: global traffic	DNS traffic detected: DNS query: torpdidebar.com
Source: global traffic	DNS traffic detected: DNS query: rebeldettern.com
Source: global traffic	DNS traffic detected: DNS query: actiothreaz.com
Source: global traffic	DNS traffic detected: DNS query: garulouscuto.com
Source: global traffic	DNS traffic detected: DNS query: breedertremnd.com
Source: global traffic	DNS traffic detected: DNS query: ts1.aco.net
Source: global traffic	DNS traffic detected: DNS query: time.facebook.com
Source: global traffic	DNS traffic detected: DNS query: gbg1.ntp.se
Source: global traffic	DNS traffic detected: DNS query: time.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: time.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.time.nl
Source: global traffic	DNS traffic detected: DNS query: x.ns.gin.ntt.net

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1085
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1423136
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1423136Frontend
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1452
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1512
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1637
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1936
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2046
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2152
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2162
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2273
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2517
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2894
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2970
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2978
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3027
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3045
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3078
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3205
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3206
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3246
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3452
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3498
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3502
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3577
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3584
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3586
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3623
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3624
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3625
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3682
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3729
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3832
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3862
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3965
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3970
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3997
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4214
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4267
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4324
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4384
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4405
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4428
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4551
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4633
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4646
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4722
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/482
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4836
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4901
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4937
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5007
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5055
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5061
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5281
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5371
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5375
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5421
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5430
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5469
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5535
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5577
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5658
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5750
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5881
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5901
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/5906
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6041
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6048
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6141
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6248
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6439
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6651
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6692
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6755
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6860
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6876
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6878
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6929
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/6953
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7036
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7036dumpShaderSourceWrite
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7047
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7172
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7279
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7370
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7406
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7488
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7527
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7553
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7556
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7724
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7760
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7760enableShaderSubstitutionCheck
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7761
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/7761disableProgramCachingDisables
Source: explorer.exe, 00000007.00000000.1576389816.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1578678923.0000000008F83000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/1094869
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/110263
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/1144207
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/1171371
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/1181068
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/1181193
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/1420130
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/1456243
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/308366
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/403957
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/550292
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/565179
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/642227
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/642605
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/644669
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/650547
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/672380
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/709351
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/797243
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/809422
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/830046
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/849576
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/883276
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/927470
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/941620
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: explorer.exe, 00000007.00000000.1576389816.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1578678923.0000000008F83000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000007.00000000.1576389816.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1578678923.0000000008F83000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: elevate.exe.0.dr	String found in binary or memory: http://int3.de/
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://issuetracker.google.com/200067929
Source: Mansion_setup (1).exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000007.00000000.1576389816.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1578678923.0000000008F83000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000007.00000000.1578233176.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1578209820.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1577554321.0000000007C70000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000007.00000000.1576389816.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.foreca.com
Source: explorer.exe, 00000007.00000000.1578678923.0000000008F83000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000007.00000000.1578678923.000000000913F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/4674
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/4830
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/4849
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/4966
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/5140
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/5536
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/5845
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/6574
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7161
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7162
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7246
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7308
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7319
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7320
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7369
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7382
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7405
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7489
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7604
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7714
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7847
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://anglebug.com/7899
Source: explorer.exe, 00000007.00000000.1578678923.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000007.00000000.1578678923.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: fr.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: fr.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=frRaccourci
Source: sw.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=sw&category=theme81https://myactivity.google.com/myactivity/?u
Source: sw.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=swUmeondoa
Source: zh-CN.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN
Source: zh-CN.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/1042393
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/1046462
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/1060012
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/1091824
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/1137851
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/1300575
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/1356053
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/593024
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/650547
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/655534
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/705865
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/710443
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/811661
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://crbug.com/848952
Source: explorer.exe, 00000007.00000000.1581782657.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/161903006
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/166809097
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/184850002
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/187425444
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/220069903
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/229267970
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/250706693
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/253522366
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/255411748
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/274859104
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/275210062
Source: libGLESv2.dll.0.dr	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://myactivity.google.com/
Source: explorer.exe, 00000007.00000000.1581782657.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: sw.pak.0.dr	String found in binary or memory: https://passwords.google.comAkaunti
Source: fr.pak.0.dr	String found in binary or memory: https://passwords.google.comCompte
Source: zh-CN.pak.0.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://policies.google.com/
Source: explorer.exe, 00000007.00000000.1581782657.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000007.00000000.1578678923.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 00000007.00000000.1581782657.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: zh-CN.pak.0.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: fr.pak.0.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlG
Source: sw.pak.0.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlInasimamiwa
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000007.00000000.1576389816.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.pollensense.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.91.193.85:443 -> 192.168.2.7:50011 version: TLS 1.2

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File dump: Mansion.exe.0.dr 163326464			Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File dump: Mansion.exe0.0.dr 163326464			Jump to dropped file

Abnormal high CPU Usage

Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe

Process Stats: CPU usage > 49%

Enables security privileges

Source: C:\Users\user\Desktop\Mansion_setup (1).exe

Process token adjusted: Security

Jump to behavior

One or more processes crash

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 364

PE file contains more sections than normal

Source: Mansion.exe.0.dr	Static PE information: Number of sections : 15 > 10
Source: vulkan-1.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: Mansion.exe0.0.dr	Static PE information: Number of sections : 15 > 10
Source: libEGL.dll0.0.dr	Static PE information: Number of sections : 11 > 10

Uses 32bit PE files

Source: Mansion_setup (1).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: qtZint.exe.3.dr

Static PE information: Section: .qtmimed ZLIB complexity 0.998278287914692

Source: classification engine

Classification label: mal60.troj.spyw.evad.winEXE@52/268@23/12

Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe

File created: C:\Users\user\AppData\Roaming\my-electron-app

Jump to behavior

Source: C:\games\DDR5_NetCache\qtZint.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4240:64:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-f33e4931-9ab6-355492-e6e220284809}

Source: C:\Users\user\Desktop\Mansion_setup (1).exe

File created: C:\Users\user~1\AppData\Local\Temp\nsiC1A0.tmp

Jump to behavior

Source: Mansion_setup (1).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Mansion_setup (1).exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Mansion_setup (1).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\Mansion_setup (1).exe

File read: C:\Users\user\Desktop\Mansion_setup (1).exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Mansion_setup (1).exe "C:\Users\user\Desktop\Mansion_setup (1).exe"
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1652 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --mojo-platform-channel-handle=2864 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --app-path="C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1739624080749253 --launch-time-ticks=5384764539 --mojo-platform-channel-handle=3108 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe C:\games\DDR5_NetCache\ExtractJPEGcmd.exe
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\games\DDR5_NetCache\qtZint.exe C:\games\DDR5_NetCache\qtZint.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 364
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr15B6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/d0fbef96/bd5c97e1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2228,i,1313803575449606696,11911411455849681461,262144 /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/d0fbef96/0da50779"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2224,i,3086125716147971170,5077429259784092469,262144 /prefetch:3
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1652 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --mojo-platform-channel-handle=2864 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --app-path="C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1739624080749253 --launch-time-ticks=5384764539 --mojo-platform-channel-handle=3108 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\games\DDR5_NetCache\qtZint.exe C:\games\DDR5_NetCache\qtZint.exe	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr15B6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/d0fbef96/bd5c97e1"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --user-data-dir="C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/d0fbef96/0da50779"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2228,i,1313803575449606696,11911411455849681461,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2224,i,3086125716147971170,5077429259784092469,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: msspellcheckingfacility.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: msmpeg2vdec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dxva2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: msvproc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: version.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll

Source: C:\Users\user\Desktop\Mansion_setup (1).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Uses Microsoft Silverlight

Source: C:\games\DDR5_NetCache\qtZint.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: Mansion_setup (1).exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: Mansion_setup (1).exe

Static file information: File size 65780936 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Mansion_setup (1).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr

Data Obfuscation

PE file contains an invalid checksum

Source: vulkan-1.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0xe8fc5
Source: libEGL.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x7f49d
Source: ExtractJPEGcmd.exe.3.dr	Static PE information: real checksum: 0x6e862a should be: 0x6e2977
Source: libGLESv2.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x7202c9
Source: System.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xe5c7
Source: vk_swiftshader.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0x506829
Source: vk_swiftshader.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x506829
Source: libGLESv2.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0x7202c9
Source: elevate.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x225bc
Source: nsis7z.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x7611e
Source: vulkan-1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xe8fc5
Source: libEGL.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0x7f49d
Source: ffmpeg.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0x2c5e0e
Source: ffmpeg.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x2c5e0e

PE file contains sections with non-standard names

Source: ffmpeg.dll.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: Mansion.exe.0.dr	Static PE information: section name: .00cfg
Source: Mansion.exe.0.dr	Static PE information: section name: .gxfg
Source: Mansion.exe.0.dr	Static PE information: section name: .retplne
Source: Mansion.exe.0.dr	Static PE information: section name: .rodata
Source: Mansion.exe.0.dr	Static PE information: section name: CPADinfo
Source: Mansion.exe.0.dr	Static PE information: section name: LZMADEC
Source: Mansion.exe.0.dr	Static PE information: section name: _RDATA
Source: Mansion.exe.0.dr	Static PE information: section name: malloc_h
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr	Static PE information: section name: _RDATA
Source: Mansion.exe0.0.dr	Static PE information: section name: .00cfg
Source: Mansion.exe0.0.dr	Static PE information: section name: .gxfg
Source: Mansion.exe0.0.dr	Static PE information: section name: .retplne
Source: Mansion.exe0.0.dr	Static PE information: section name: .rodata
Source: Mansion.exe0.0.dr	Static PE information: section name: CPADinfo
Source: Mansion.exe0.0.dr	Static PE information: section name: LZMADEC
Source: Mansion.exe0.0.dr	Static PE information: section name: _RDATA
Source: Mansion.exe0.0.dr	Static PE information: section name: malloc_h
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll0.0.dr	Static PE information: section name: _RDATA
Source: qtZint.exe.3.dr	Static PE information: section name: .qtmetad
Source: qtZint.exe.3.dr	Static PE information: section name: _RDATA
Source: qtZint.exe.3.dr	Static PE information: section name: .qtmimed

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\Mansion.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	File created: C:\games\DDR5_NetCache\qtZint.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	File created: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Jump to dropped file

Creates license or readme file

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user~1\AppData\Local\Temp\nsyC1B1.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\LICENSE.electron.txt			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe

Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling

Jump to behavior

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API/Special instruction interceptor: Address: 7FFB2CECD044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFB2CECD044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 51CB83A

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\games\DDR5_NetCache\qtZint.exe	Memory allocated: 3F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Memory allocated: 4260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Memory allocated: 3FF0000 memory reserve \| memory write watch	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\libGLESv2.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe TID: 1552

Thread sleep time: -60000s >= -30000s

Jump to behavior

Queries keyboard layouts

Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809			Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	File Volume queried: C:\Users\user\AppData\Roaming\my-electron-app\Code Cache\wasm FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	File Volume queried: C:\Users\user\AppData\Roaming\my-electron-app\Code Cache\js FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	File Volume queried: C:\Users\user\AppData\Roaming\my-electron-app\blob_storage\523b45e6-05f1-47c8-b4cb-d55d78148986 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	File Volume queried: C:\Users\user\AppData\Roaming\my-electron-app\Cache\Cache_Data FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user~1\AppData\Local\Temp\nsyC1B1.tmp\7z-out\locales	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user\Desktop\Mansion_setup (1).exe	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user~1\AppData\Local\Temp\nsyC1B1.tmp\app-64.7z	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user~1\AppData\Local\Temp\nsyC1B1.tmp\7z-out\resources	Jump to behavior
Source: C:\Users\user\Desktop\Mansion_setup (1).exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: libGLESv2.dll.0.dr	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (!isMesa && IsMaliT8xxOrOlder(functions)) \|\| (!isMesa && IsMaliG31OrOlder(functions))
Source: libGLESv2.dll.0.dr	Binary or memory string: VMware
Source: explorer.exe, 00000007.00000000.1568164948.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
Source: libGLESv2.dll.0.dr	Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestYE
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000007.00000000.1578678923.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000007.00000000.1578678923.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
Source: explorer.exe, 00000007.00000000.1578678923.0000000009013000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000007.00000000.1576389816.0000000007306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_xU1
Source: explorer.exe, 00000007.00000000.1578678923.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000007.00000000.1578678923.0000000009052000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
Source: explorer.exe, 00000007.00000000.1578678923.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
Source: explorer.exe, 00000007.00000000.1578678923.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000007.00000000.1578678923.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: explorer.exe, 00000007.00000000.1578678923.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMWare
Source: explorer.exe, 00000007.00000000.1578678923.0000000009052000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
Source: explorer.exe, 00000007.00000000.1576389816.0000000007306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 00000007.00000000.1578678923.0000000008F27000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT`
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: explorer.exe, 00000007.00000000.1568164948.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000007.00000000.1574715690.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: explorer.exe, 00000007.00000000.1578678923.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.1568164948.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\games\DDR5_NetCache\qtZint.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\games\DDR5_NetCache\qtZint.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 45.91.193.85 1308

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmpshare.exe

Memory allocated: C:\Windows\System32\dllhost.exe base: 2395B820000 protect: page read and write

Writes to foreign memory regions

Source: C:\Program Files\Windows Media Player\wmpshare.exe	Memory written: C:\Windows\System32\dllhost.exe base: 2395B820000
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF7D87314E0

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1652 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --mojo-platform-channel-handle=2864 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\my-electron-app" --app-path="C:\Users\user~1\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1739624080749253 --launch-time-ticks=5384764539 --mojo-platform-channel-handle=3108 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe C:\games\DDR5_NetCache\ExtractJPEGcmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\games\DDR5_NetCache\qtZint.exe C:\games\DDR5_NetCache\qtZint.exe	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "c:\users\user~1\appdata\local\temp\2sbmkhykamuetmmmtcvrnvtlaaj\mansion.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\my-electron-app" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1652 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "c:\users\user~1\appdata\local\temp\2sbmkhykamuetmmmtcvrnvtlaaj\mansion.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\my-electron-app" --mojo-platform-channel-handle=2864 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "c:\users\user~1\appdata\local\temp\2sbmkhykamuetmmmtcvrnvtlaaj\mansion.exe" --type=renderer --user-data-dir="c:\users\user\appdata\roaming\my-electron-app" --app-path="c:\users\user~1\appdata\local\temp\2sbmkhykamuetmmmtcvrnvtlaaj\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1739624080749253 --launch-time-ticks=5384764539 --mojo-platform-channel-handle=3108 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:1
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "c:\users\user~1\appdata\local\temp\2sbmkhykamuetmmmtcvrnvtlaaj\mansion.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\my-electron-app" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1652 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "c:\users\user~1\appdata\local\temp\2sbmkhykamuetmmmtcvrnvtlaaj\mansion.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\my-electron-app" --mojo-platform-channel-handle=2864 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Process created: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe "c:\users\user~1\appdata\local\temp\2sbmkhykamuetmmmtcvrnvtlaaj\mansion.exe" --type=renderer --user-data-dir="c:\users\user\appdata\roaming\my-electron-app" --app-path="c:\users\user~1\appdata\local\temp\2sbmkhykamuetmmmtcvrnvtlaaj\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1739624080749253 --launch-time-ticks=5384764539 --mojo-platform-channel-handle=3108 --field-trial-handle=1680,i,17790820734740734710,14756549403870583201,262144 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:1	Jump to behavior

Source: explorer.exe, 00000007.00000000.1576232434.0000000004880000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1572340351.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1578678923.0000000009013000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.1572340351.0000000001440000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.1572340351.0000000001440000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: explorer.exe, 00000007.00000000.1568164948.0000000000C59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman
Source: explorer.exe, 00000007.00000000.1572340351.0000000001440000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Users\user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\resources VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\games\DDR5_NetCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\games\DDR5_NetCache\Array_User_Boot.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\games\DDR5_NetCache\Array_User_Boot.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\games\DDR5_NetCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\games\DDR5_NetCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\games\DDR5_NetCache\Array_User_Boot.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\games\DDR5_NetCache\ExtractJPEGcmd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\games\DDR5_NetCache\qtZint.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\games\DDR5_NetCache\qtZint.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\y572q81e.default
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\startupCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\safebrowsing\google4
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings\main
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\safebrowsing
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings\main\ms-language-packs\browser\newtab
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\cache2\doomed
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\thumbnails
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings\main\ms-language-packs
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\cache2
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\settings\main\ms-language-packs\browser
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release\cache2\entries

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	312 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	3 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Mansion_setup (1).exe	0%	Virustotal		Browse
Mansion_setup (1).exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\Mansion.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC1B1.tmp\nsis7z.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://issuetracker.google.com/275210062	0%	Avira URL Cloud	safe
https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106	0%	Avira URL Cloud	safe
http://anglebug.com/1423136Frontend	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
time.cloudflare.com	162.159.200.123	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
gbg1.ntp.netnod.se	194.58.203.20	true	false	high
x.ns.gin.ntt.net	129.250.35.250	true	false	high
time.google.com	216.239.35.4	true	false	high
ocsps.ssl.com	108.138.36.12	true	false	high
twc.trafficmanager.net	20.101.57.9	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ntp.time.nl	94.198.159.14	true	false	high
ts1.aco.net	193.171.23.163	true	false	high
time.facebook.com	129.134.27.123	true	false	high
voicesharped.com	unknown	unknown	false	unknown
breedertremnd.com	unknown	unknown	false	high
inputrreparnt.com	unknown	unknown	false	unknown
time.windows.com	unknown	unknown	false	high
garulouscuto.com	unknown	unknown	false	high
smartsjolutions.cyou	unknown	unknown	false	unknown
rebeldettern.com	unknown	unknown	false	high
gbg1.ntp.se	unknown	unknown	false	high
torpdidebar.com	unknown	unknown	false	high
importenptoc.com	unknown	unknown	false	high
actiothreaz.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://anglebug.com/4674	libGLESv2.dll.0.dr	false		high
https://issuetracker.google.com/275210062	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/answer/6098869	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	libGLESv2.dll.0.dr	false		high
https://anglebug.com/7382	libGLESv2.dll.0.dr	false		high
http://crbug.com/550292	libGLESv2.dll.0.dr	false		high
http://crbug.com/883276	libGLESv2.dll.0.dr	false		high
https://crbug.com/1356053	libGLESv2.dll.0.dr	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
https://anglebug.com/7714	libGLESv2.dll.0.dr	false		high
https://anglebug.com/5536	libGLESv2.dll.0.dr	false		high
https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
https://crbug.com/705865	libGLESv2.dll.0.dr	false		high
http://crbug.com/110263	libGLESv2.dll.0.dr	false		high
http://anglebug.com/6248	libGLESv2.dll.0.dr	false		high
http://anglebug.com/6929	libGLESv2.dll.0.dr	false		high
https://wns.windows.com/	explorer.exe, 00000007.00000000.1578678923.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/privacy/eula_text.htmlG	fr.pak.0.dr	false		high
http://anglebug.com/5281	libGLESv2.dll.0.dr	false		high
https://issuetracker.google.com/255411748	libGLESv2.dll.0.dr	false		high
https://anglebug.com/7246	libGLESv2.dll.0.dr	false		high
https://anglebug.com/7369	libGLESv2.dll.0.dr	false		high
https://anglebug.com/7489	libGLESv2.dll.0.dr	false		high
https://crbug.com/593024	libGLESv2.dll.0.dr	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://crbug.com/1137851	libGLESv2.dll.0.dr	false		high
https://issuetracker.google.com/161903006	libGLESv2.dll.0.dr	false		high
http://anglebug.com/2152skipVSConstantRegisterZeroIn	libGLESv2.dll.0.dr	false		high
https://crbug.com/1300575	libGLESv2.dll.0.dr	false		high
https://crbug.com/710443	libGLESv2.dll.0.dr	false		high
https://crbug.com/1042393	libGLESv2.dll.0.dr	false		high
https://crbug.com/1060012	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3078	libGLESv2.dll.0.dr	false		high
http://anglebug.com/7553	libGLESv2.dll.0.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
http://anglebug.com/5375	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3246allowClearForRobustResourceInitSome	libGLESv2.dll.0.dr	false		high
http://anglebug.com/5371	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3997	libGLESv2.dll.0.dr	false		high
http://anglebug.com/4722	libGLESv2.dll.0.dr	false		high
http://crbug.com/642605	libGLESv2.dll.0.dr	false		high
http://anglebug.com/1452	libGLESv2.dll.0.dr	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000007.00000000.1578678923.0000000008F83000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	libGLESv2.dll.0.dr	false		high
https://chrome.google.com/webstore?hl=frRaccourci	fr.pak.0.dr	false		high
https://support.google.com/chrome/a/answer/9122284	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://chrome.google.com/webstore?hl=swUmeondoa	sw.pak.0.dr	false		high
https://chrome.google.com/webstore?hl=zh-CN	zh-CN.pak.0.dr	false		high
https://crbug.com/650547callClearTwiceUsing	libGLESv2.dll.0.dr	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crbug.com/1420130	libGLESv2.dll.0.dr	false		high
http://anglebug.com/6692	libGLESv2.dll.0.dr	false		high
https://chrome.google.com/webstore?hl=sw&category=theme81https://myactivity.google.com/myactivity/?u	sw.pak.0.dr	false		high
https://www.google.com/chrome/privacy/eula_text.htmlInasimamiwa	sw.pak.0.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3623	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3625	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3624	libGLESv2.dll.0.dr	false		high
http://anglebug.com/5007	libGLESv2.dll.0.dr	false		high
http://crbug.com/1181068	libGLESv2.dll.0.dr	false		high
http://anglebug.com/2894	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3862	libGLESv2.dll.0.dr	false		high
http://anglebug.com/4836	libGLESv2.dll.0.dr	false		high
https://issuetracker.google.com/issues/166475273	libGLESv2.dll.0.dr	false		high
http://schemas.micro	explorer.exe, 00000007.00000000.1578233176.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1578209820.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1577554321.0000000007C70000.00000002.00000001.00040000.00000000.sdmp	false		high
https://passwords.google.comCompte	fr.pak.0.dr	false		high
http://int3.de/	elevate.exe.0.dr	false		high
http://anglebug.com/4384	libGLESv2.dll.0.dr	false		high
https://anglebug.com/7246enableCaptureLimitsSet	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3970	libGLESv2.dll.0.dr	false		high
http://anglebug.com/4267	libGLESv2.dll.0.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://policies.google.com/	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
http://crbug.com/1181193	libGLESv2.dll.0.dr	false		high
http://anglebug.com/1423136Frontend	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/482	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3045	libGLESv2.dll.0.dr	false		high
https://anglebug.com/7604	libGLESv2.dll.0.dr	false		high
http://anglebug.com/7761	libGLESv2.dll.0.dr	false		high
http://anglebug.com/7760	libGLESv2.dll.0.dr	false		high
https://chrome.google.com/webstore/category/extensions	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
http://crbug.com/308366	libGLESv2.dll.0.dr	false		high
https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm	explorer.exe, 00000007.00000000.1576389816.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		high
http://anglebug.com/5901	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3965	libGLESv2.dll.0.dr	false		high
http://anglebug.com/6439	libGLESv2.dll.0.dr	false		high
http://anglebug.com/7406	libGLESv2.dll.0.dr	false		high
http://anglebug.com/7527	libGLESv2.dll.0.dr	false		high
https://anglebug.com/7161	libGLESv2.dll.0.dr	false		high
http://anglebug.com/5469	libGLESv2.dll.0.dr	false		high
https://anglebug.com/7162	libGLESv2.dll.0.dr	false		high
http://anglebug.com/3729	libGLESv2.dll.0.dr	false		high
http://anglebug.com/5906	libGLESv2.dll.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.58.203.20	gbg1.ntp.netnod.se	Sweden	57021	NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	false
95.216.224.46	unknown	Germany	24940	HETZNER-ASDE	false
94.198.159.14	ntp.time.nl	Netherlands	1140	SIDNNL	false
45.91.193.85	unknown	Germany	39618	HOSTCRAMHostCramLLCUS	true
129.250.35.250	x.ns.gin.ntt.net	United States	2914	NTT-COMMUNICATIONS-2914US	false
216.239.35.4	time.google.com	United States	15169	GOOGLEUS	false
193.171.23.163	ts1.aco.net	Austria	1853	ACONETACOnetBackboneAT	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
129.134.27.123	time.facebook.com	United States	32934	FACEBOOKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1615829
Start date and time:	2025-02-15 15:22:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Mansion_setup (1).exe
Detection:	MAL
Classification:	mal60.troj.spyw.evad.winEXE@52/268@23/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 199.232.210.172, 20.242.39.171, 13.95.31.18, 2.19.106.160, 20.3.187.198, 90.187.112.137, 130.162.222.153, 162.159.200.123, 194.50.19.204, 142.250.185.99, 142.250.186.78, 74.125.71.84, 13.107.42.16, 13.107.21.239, 204.79.197.239, 142.250.184.206, 13.107.6.158, 142.251.32.99, 142.250.65.195, 13.107.246.45
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, l-0007.l-msedge.net, wu-b-net.trafficmanager.net, config.edge.skype.com, glb.sls.prod.dcat.dsp.trafficmanager.net, pool.ntp.org, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, l-0007.config.skype.com, azureedge-t-prod.trafficmanager.net, business.bing.com, clients
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.58.203.20	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse
95.216.224.46	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	/ud83c7gi0/8pe93ha5y.php?get=Z2V0ZXhpdA%3D%3D&name=8J%2BPnSBGYWVyc2FmZSBnYW1l&info=V2luZG93cyAxMCwgNTc5NTY5LCAxMjgweDEwMjQ%3D
94.198.159.14	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
94.198.159.14	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse
45.91.193.85	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
129.250.35.250	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
	TSWY.ps1	Get hash	malicious	RHADAMANTHYS	Browse
	SecuriteInfo.com.Win64.Evo-gen.13578.12741.exe	Get hash	malicious	RHADAMANTHYS	Browse
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse
	msimg32.dll	Get hash	malicious	RHADAMANTHYS	Browse
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
time.cloudflare.com	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	162.159.200.123
	Dr63BNDQN1.dll	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	msimg32.dll	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	g8ix97hz.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	162.159.200.1
	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.123
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	162.159.200.123
chrome.cloudflare-dns.com	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	QEIFBCQW.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	Notification Detail.html	Get hash	malicious	Unknown	Browse	162.159.61.3
	2025_Simplified_Tips_to_Stay_on_Track.pdf	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	phish_alert_iocp_v1.4.85.eml	Get hash	malicious	Tycoon2FA	Browse	172.64.41.3
	_747031500 D747031500_A.html	Get hash	malicious	Remcos	Browse	162.159.61.3
	747031500_D747031500_A.js	Get hash	malicious	Remcos	Browse	162.159.61.3
	rgIYxoflou.lnk	Get hash	malicious	Unknown	Browse	162.159.61.3
	N11R7lRasm.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
gbg1.ntp.netnod.se	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	Dr63BNDQN1.dll	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	test.zip	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	msimg32.dll	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
bg.microsoft.map.fastly.net	l.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	199.232.210.172
	net.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	199.232.210.172
	SplashWin.exe	Get hash	malicious	RedLine	Browse	199.232.210.172
	Technical_Requirements_for_Hosting.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	Technical_Requirements_for_Hosting.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	Order Details.js	Get hash	malicious	STRRAT	Browse	199.232.210.172
	Contract-Draft.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	Contract-Draft.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	PHQkmvtegO.exe	Get hash	malicious	AsyncRAT	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	194.58.203.20
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	194.58.203.20
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
SIDNNL	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	94.198.159.14
	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.14
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	msimg32.dll	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	94.198.159.10
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	94.198.159.10
HOSTCRAMHostCramLLCUS	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	45.91.193.85
	y8IUPclwL0.bat	Get hash	malicious	Unknown	Browse	23.160.168.174
	cloudflare.bat	Get hash	malicious	Unknown	Browse	23.160.168.174
	apep.arm.elf	Get hash	malicious	Unknown	Browse	23.160.176.82
	BpjVfMOJGI.elf	Get hash	malicious	Mirai	Browse	23.160.166.250
	6VXQ3TUNZo.elf	Get hash	malicious	Mirai	Browse	23.160.176.79
	opOQXr0GEN.elf	Get hash	malicious	Mirai	Browse	23.160.176.92
	Y0Kd3bQIb3.elf	Get hash	malicious	Mirai	Browse	23.160.176.81
	sG4LSBHICZ.elf	Get hash	malicious	Mirai	Browse	23.160.176.93
HETZNER-ASDE	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	95.216.224.46
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	mpsl.elf	Get hash	malicious	Mirai	Browse	88.198.80.109
	ppc.elf	Get hash	malicious	Mirai	Browse	88.99.35.243
	m68k.elf	Get hash	malicious	Mirai	Browse	88.198.222.245
	mips.elf	Get hash	malicious	Mirai	Browse	88.198.164.113
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
caec7ddf6889590d999d7ca1b76373b6	Mansion_setup.exe	Get hash	malicious	Unknown	Browse	45.91.193.85
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	45.91.193.85
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse	45.91.193.85
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.91.193.85
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.91.193.85
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	45.91.193.85
	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.91.193.85
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.91.193.85
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	45.91.193.85

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\d3dcompiler_47.dll	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse
	Mansion_setup.exe	Get hash	malicious	Unknown	Browse
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
	kf-dcp-download-setup.exe	Get hash	malicious	Unknown	Browse
	kf-dcp-download-setup.exe	Get hash	malicious	Unknown	Browse
	Warborns.msi	Get hash	malicious	Unknown	Browse
	ChromeSetup.exe (1).exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	WWa3isqanl.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:R0aEOBqCpKl:y1uqCkl
MD5:	D3BC8C81359B1218A59D0420AE2291F7
SHA1:	E5FE4DB126DC11A5DE991FF2D14885F897AE7224
SHA-256:	9110177F4A9B88F41BB8A6C6F2D3E0D197B448FAB63C96A123963714D36513AF
SHA-512:	09DA588778D92BB806BD415FFC002AAC6CE7AB6337B0E08A616185B8F245DFF5F8752E2E8086F7C94580BCE713DB35E6B819CA39F3E9647246AB8B09A154AD24
Malicious:	false
Preview:	(.....oy retne...........................X./.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ihFQyEe5q9x:ihFwmq9x
MD5:	8108D0A07EDB926E07F36F745FB08843
SHA1:	43221A3DC1B6BFFB30F3F389CEF347743F5F7E84
SHA-256:	A7A69450815961FEC676C91C1ADE0849B864BC75BC0C5D89A063B9096EEA3144
SHA-512:	D348401B2DEE61C13D3B2D94C087B5BAC21D92D5CDCB895C1448CBBBB56A9F82F7AB220ACB342E7A119444215FDBCB71A10DD3A2EDD43C4FA85E3308935BB6FC
Malicious:	false
Preview:	(...?..loy retne........................B..X./.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:07dX00EcFBp+:07dXg0Bs
MD5:	597F7ED5E1130DC6B8B4812038FE5981
SHA1:	85BD953F3DDC251BDCA6F8C8B28106E216DA6FA0
SHA-256:	0C67D472CB3A8F2BBB148084B442242826A35D225FA5F6394D12EE6B856E92F2
SHA-512:	BE0593FE97FF45FC3C1CEB613A1CFB92DCE7854C4FCD1C209C71BE004298887BD617F0984C9190F65C66B458509D2B9802162661DBF8B3E46B2800EDAF0C735E
Malicious:	false
Preview:	(...i^hXoy retne........................@`.X./.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:+N5N00Em2p+n:+rNg7p+
MD5:	F467259C1B36C5B40BD8B7D5211EC9AA
SHA1:	A1FC13F0A4FDB74B27DF57190FFFDC740129C99A
SHA-256:	D2E3E247D925DC4A623713187B972703097868324BFBE1D0070F1B5CB8E1A91D
SHA-512:	D5D76051D429FD89DEC47A85FC00079447E6BA4C92C56A1201EF30797428FF4C9F1D03CEE24E979BA76F51179E1EA7D64FAEB7B6F20434D1C65A9D1D84FDF729
Malicious:	false
Preview:	(....(:.oy retne.........................F.X./.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.515613270934311
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt99NoLKP6m1vyikZJdXBuBuwBM2aaNhGYXVQQRCYfYg:YuBqDPafL9bx5cgBzBM2XGYqB0
MD5:	1E11C4AADE73807D893AA04AB76E5218
SHA1:	CCEE6DE4D889C59B74C252562C54A2EA75C0BBAA
SHA-256:	ADBE24E83FD4C085451DE659EC5419DAB519E440F753E93BAE8AC3A40AEB230C
SHA-512:	559AF40D5E1DC09B68AAAF865DDD7840CC6062FEA12FA09BB6569C4C314E3F765FB206BC0343064AB01C4C954E6E43B011F4DC1ADA0CE44D7B931370EC5C792F
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAArpQyCwrq9T6VFcN4seFC2EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBnKzlR0pqNHG6DdtXOVyKjHAgeO5X/tiOKnoIrcqq9AAAAAAOgAAAAAIAACAAAAASs3bVsMHuhaMSFseQUSAlo1rfo0ja88RwUHlJiWVzxjAAAABuPG2NDchGpj5iWKx7S7eYvctHhHGoyGZdaDfyih8V3XZ54+2cA+QWFOsTT/I1gHpAAAAArAAYhKs9XPwJzAlEIOBlUGvuZoehdvFwVCE7pIBIjH+lPD7f7OeWfjI3KMKpauP4ZkXR3p8Wqla1pPjuEUcw+g=="},"profile":{"info_cache":{},"profile_counts_reported":"13384103127438190","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1739629527"},"user_experienc

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	8245721
Entropy (8bit):	4.70761969468716
Encrypted:	false
SSDEEP:	24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
MD5:	0E3E4362F785AFF0B9E1852B1064C0F1
SHA1:	A42CCB51E72BDCB5BB905A62EFAA28857DEF3A17
SHA-256:	BD3EE49A5AB19D15DDC44B421B0BDEFCE587790786989AE77CF3DDF1E6A2BA8D
SHA-512:	193B57EFC5F5971FBD9E4EA1A80B34AADCC2A814FF49C4C06AFE972BF327E98FF0498217A8BDEF984B10FDEC6E7858A6FB88C0B14936E0C6B404387A426B87F2
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\Mansion.exe

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163326464
Entropy (8bit):	6.732811108629311
Encrypted:	false
SSDEEP:
MD5:	92FD2FE1716B9F3E45B6AE30FFF45D8B
SHA1:	0B1FF7270ADE36A11A2C12026CFAFD01622271FB
SHA-256:	BE0C123E162520D9705CECDF2C596D2A3548EC230FF09F9DC501F0D34537F392
SHA-512:	65DC4D88EFED9D3A71BEBF2A4515B8BF18A814286B9798B6E6883C6BA7251206A3DEE0FF9E35E0651B2AA1CF03A8EEE291A196B3688D8E7D0AD26B1713C24030
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...+.oe.........."..................%........@..........................................`..........................................[..'...^.h................'A..........@...L..p.Q.....................PzQ.(... ...@.............^.`....@[......................text...'........................... ..`.rdata....n.......n.................@..@.data.....C...b.......b.............@....pdata...'A......(A...j.............@..@.00cfg..0..........................@..@.gxfg...pA.......B.................@..@.retplne..... .......$...................rodata......0.......&.............. ..`.tls.........P.......8..............@...CPADinfo8....`.......>..............@...LZMADEC......p.......@.............. ..`_RDATA..\............R..............@..@malloc_h.............T.............. ..`.rsrc................V..............@..@.reloc...L...@...N.................@..B................

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	135956
Entropy (8bit):	7.91603970812188
Encrypted:	false
SSDEEP:	3072:bKzwJCcIe4woKmWVlBL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:bKzwjIe41KmWVlNK18Gb0OV8ld0GecQu
MD5:	443C58245EEB233D319ABF7150B99C31
SHA1:	F889CE6302BD8CFBB68EE9A6D8252E58B63E492D
SHA-256:	99CA6947D97DF212E45782BBD5D97BFB42112872E1C42BAB4209CEEDF66DC760
SHA-512:	081F3EE4A5E40FDC8BB6F16F2CFD47EDDE2BD8F3B5349775526092A770B090C05308D4289ECDDA3D541CF7F0579AC64B529930FD128EDAD9B0991DFA00B0E9BC
Malicious:	false
Preview:	..................#.....:.....`.....a.~...b.....c.k...d.....e.....f.....g.\...h.V...i.....j.....k.o"..l..$..m.//..n..9..o..<..p..@..q.DD..r..F..s..G..t.,K..u..M..v.LO..w..S..x..V.....Y.....[.....\.....^...._....De.....j.....l....`n.....n.....o.....q.....r.....u.....x.....{................]....'....M..........................K.....I..........Y....\............................................&.....#...d...",....0....4....>...:A...I...vM....W...Na...e....g....o...ex...My...z...\|.........p.................@...........{.................-.....y...........$............................................(.....).U....7...+.....,.=...-........../.....0.....1.....2.....3.d...4.....5.....6.....7.....8.....9.r...;.6...<.....=.....>.....?.[...@.$...A.....B.....C.....D.....G...................o...........d...........[.................K............... .....!.....".X...#.....$.[...%.....&.q...'.....(..........+.g...,.....-.A........./."...0.....1.....2.g...3...

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	195935
Entropy (8bit):	7.941514552320428
Encrypted:	false
SSDEEP:	3072:A4DQYaE/N6gbrvy/+JPnKmWVlBafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+Hxf:A4DQYaSN6gnvyWnKmWVlSgx5GMRejnbA
MD5:	81B5B74FE16C7C81870F539D5C263397
SHA1:	27526CC2B68A6D2B539BD75317A20C9C5E43C889
SHA-256:	CB4FD141A5C4D188A3ECB203E9D41A3AFCA648724160E212289ADCAC666FBFF4
SHA-512:	B2670E2DFA495CCC7874C21D0413CFBEBFD4A2F14FC0217E823EC6A16AC1181F8E06BFE7C2D32543167BC3A2E929C7F0AF1A5F90182E95913BA2292FA7CADB80
Malicious:	false
Preview:	..................#.....:.....`.@...a.O...b.3...c.....d.6...e.1...f..%..g.++..h.;...i..5..j..9..k.?B..l..F..m..Z..n.[o..o..t..p..~..q.:...r....s.s...t.....u.....v.....w....x.................r..........l..............................................?.....3.....8.....w...........j....................................s............H...._R...$U....Y....c....e...Th....m....x...az..................l....N...................4....`............`.................a...................................3...........n.....E..............................!....#%.... ,....>/....W6.....=....IA....zh....pi....Pn..(.3s..).at...{v..+..w..,.Zx..-..y....`{../..\|..0.d~..1.....2.....3.d...4.R...5.3...6.....7.,...8.2...9....;.....<.....=.....>.0...?.T...@.u...A.i...B.=...C....D.....G._.....Y.................v.....!.....W.....0.................D............... .....!.....".....#.....$.....%.?...&.....'.p...(.....*.....+.....,.....-.k........./.....0.G...1.....2.E...3...

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FAIRSAFE_setup.exe, Detection: malicious, Browse Filename: Mansion_setup.exe, Detection: malicious, Browse Filename: Faersafe_setup.exe, Detection: malicious, Browse Filename: kf-dcp-download-setup.exe, Detection: malicious, Browse Filename: kf-dcp-download-setup.exe, Detection: malicious, Browse Filename: Warborns.msi, Detection: malicious, Browse Filename: ChromeSetup.exe (1).exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: WWa3isqanl.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2880000
Entropy (8bit):	6.699341888865714
Encrypted:	false
SSDEEP:	49152:EZ2KxYmwFfgQQs0ShPrF0/zO6R0gRhPj3hTUctrRhuwSnKxqgI5IN8N3lzl3hqzb:Aofp1Pyi54wnKxqg4INhhd
MD5:	D5E1F1E9D0CCFE7F21B5C3750B202B4D
SHA1:	74144AC93C0C58A9B9288BCE5D06814C9A1B1DC2
SHA-256:	E1AB367644F72EBCDC8EB3FCFE829FF51719559AC2A43A1600E712B16871AD65
SHA-512:	DCF70D43F1A83C424BE99C38E33E520C72115C3D30945980E5E394D460462251BDE309E543213B2B08DCBE9769D11D46792E1CC99AA42777FCC34D6F3361A3D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...+.oe.........." ......".................................................. B...........`A..................................................(.............@...............A..4....).......................).(...."#.@...........H..P............................text....."......."................. ..`.rdata........#.......#.............@..@.data...........".................@....pdata........@....................@..@.00cfg..8....pA.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...4....A..6....+.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	10544880
Entropy (8bit):	6.276833777601164
Encrypted:	false
SSDEEP:	98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
MD5:	2134E5DBC46FB1C46EAC0FE1AF710EC3
SHA1:	DBECF2D193AE575ABA4217194D4136BD9291D4DB
SHA-256:	EE3C8883EFFD90EDFB0FF5B758C560CBCA25D1598FCB55B80EF67E990DD19D41
SHA-512:	B9B50614D9BAEBF6378E5164D70BE7FE7EF3051CFFF38733FE3C7448C5DE292754BBBB8DA833E26115A185945BE419BE8DD1030FC230ED69F388479853BC0FCB
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@'..H..`.(..H...e).7H..0.).VH...).xH......H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	480256
Entropy (8bit):	6.336562556337067
Encrypted:	false
SSDEEP:	6144:s4itlpEJVqKqK5Z5UibKsBHI0Sfnx+lXGpeOQHA93GT3sm:s4itlpAqKqK5Z5U+jBolfnjIyG
MD5:	DD78B86B3C92D61C37B44EF5B157CFE0
SHA1:	4DCF9EBC3FF5CA552C0E83469B921153B29AEA1F
SHA-256:	E142752E073C0051A0BEB963981AF70263ED673959515545521A7941D3230838
SHA-512:	9D071568DC56DB2AB93D034D07A11A477AAB8AC50D9EA3C4DB3AC4866FCD3C2F3002BA7A3F2C55589A9D68463181FC7A03327DC164310D7E80E30CC6F6BF2423
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...+.oe.........." ..... ................................................................`A........................................P"......f0..(.......x........B..............................................(...@1..@............3...............................text...]........ .................. ..`.rdata..D....0.......$..............@..@.data....K..........................@....pdata...B.......D..................@..@.00cfg..8....`......................@..@.gxfg...`$...p...&..................@..@.retplne.............:...................tls....!............<..............@..._RDATA..\............>..............@..@.rsrc...x............@..............@..@.reloc...............F..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7418880
Entropy (8bit):	6.464870680207474
Encrypted:	false
SSDEEP:	49152:x2b3imtb1uWsvZRUCXQNMBbGUa/XFfOpvQnDwX+xjA7LAIgRg37QiI+id3pFJs7w:x7RWft4NV+sduHox6gWE5lHaFX
MD5:	AF3792B63AF63408A40604184EA6EF7F
SHA1:	B4D577E1C7CA0D4D3A34E2EDB919CF58E6B62952
SHA-256:	B0FF1BAD8E2F34B12DFCC4B5387BDC042F9BC2F963E11DEA1758397CA0E907EA
SHA-512:	D413C52F7C82DD17F06002F3CA6BC3EFCF4E11E88379D989D982B2F9F47B71643971C4988ABEE2DC1212027B2CEA148A8849BCB442DD4DBCD8E26EA892DD7A58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...+.oe.........." .....hV...........J......................................@r...........`A..........................................h.......i.d....Pq.......n.TR...........`q.....\=h.....................0<h.(.....V.@.............i..... .h.@....................text...egV......hV................. ..`.rdata..L.....V......lV.............@..@.data........pj......Pj.............@....pdata..TR....n..T....m.............@..@.00cfg..8.....p......(p.............@..@.gxfg....+....p..,...*p.............@..@.retplne..... q......Vp..................tls....:....0q......Xp.............@..._RDATA..\....@q......Zp.............@..@.rsrc........Pq......\p.............@..@.reloc.......`q......bp.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\locales\af.pak

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	390307
Entropy (8bit):	5.42897416012883
Encrypted:	false
SSDEEP:	6144:qu8SyRtgbfbjR985DhdxQ+ICGSBsjA636Zi2Jynq4UtUKnpgmhqxox7sfxSC2C8l:Ry0zbjREda+ICTsjA636Zi2Jynq4UtBz
MD5:	B293CC5EA7DB02649BD7D386B8FA0624
SHA1:	32169B9D009B7A0FB7ECDAF650C989E956291772
SHA-256:	7BB75ADEF02D28819F1BD3B42FA46ED56D6DFBEAE072341997B09B8C1F52D8DC
SHA-512:	496BC72E7B798D02E453EB96D20566B91405BAB774521527EF882C1FCB58F25E2D0718013DDC0D23F7FAD883F4CDE93B57C6CAAEBA8CD18A09665C9F6245F557
Malicious:	false
Preview:	..........=.h.N...i.V...j.b...k.q...l.\|...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}........................."..........1.....8.....?.....@.....A.....F.....s.............................................................................G.....Z.....z...........................................................,.....2.....<.....J.....Z.....h.......................................................................%.....@.....X.....q.......................................................................6.....F.....V.....r...........................................................$.....7.....E....._.....t.................................................................6.....j.....r.....................................................".....&.....5.....M.....b.....................................................%......... .7...".D...%.j...(..........+.....,.........../.....0.....1.#...3./...4.Q...5.l...6.....7.....8.....9.....<.....=.....>.....?.....@.-...A.^...C.....D...

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\locales\am.pak

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	634666
Entropy (8bit):	4.90303732149975
Encrypted:	false
SSDEEP:	12288:ihHb86uYwT8xiT1XF/gpwozFQd529+lV5ru4yPpx30jH8+A:MbIT8xCXFopwozFQd529+lV5nyPN
MD5:	4CB4B30911E9FBFE6C1DE688CCA821AB
SHA1:	58CC2D8E954B5C74A902F13C522D1F6836769623
SHA-256:	685ECDFF01D4AE92BE1D900EF00FD8632616BC41F18A56E682528F312D4A5167
SHA-512:	6629AF841C52463C46DBEB03E3B4B1CAD550C2DB790C75365D63512E039B3369CDD9F18316E9C50DCF3AA77AA4D2BECB6A87570F3B538B456AF3041D60393434
Malicious:	false
Preview:	........$.%.h.~...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z. ...\|.&...}.8.....@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y...................................0.....Z.....m.....u...................................#.....G.....S........................................=.....m.........................................N.....r.....~...............................................2.....K..................................0.....8.....?.....K.....^.....q.............................#.....<.....x.......................2.....N.....g...................................E.....e.................................................................].......................`............................................... .....).....I.....y......................g.........................................1... .I...".n...%.....(..........+.....,.".....3.../.U...0.o...1.....3.....4.....5.S...6.....7.....8.....9./...;.K...<.\...=.s...>.....?.....@.....A.....C.U.

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\locales\ar.pak

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	696385
Entropy (8bit):	4.9097761802335675
Encrypted:	false
SSDEEP:	12288:DpJ+LHvZtD9JAO08vYU3X1Y9kbMf5MNi/+det13zMgSENR5:tMqta45F+K
MD5:	7294148BA219909A4909613381EA45AC
SHA1:	A8A70E589760B5EAEAE1A95FE51723CCE48FCA87
SHA-256:	ACC1B352EA206C25AFE88A614346B468F4F78BF23F886883A38DAE905D121DC0
SHA-512:	CABF320E827067EF8EFB7C021FF098430054D125FB50540C06D12167C7D1C6D08449E6A1B33FA4A092CE6C81A600415711005E100B1B756A199E05CA18DBF3B7
Malicious:	false
Preview:	..........].h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....\|.....}...................................................................I.....b.........................................'.....M.....................................................0.....P.....g...............................................4.....O.....o...................................2.....<.....M.....W..................................U...............................................7.....k.....{.............................1.........................................?.....B.....].....\|.................................................................(.....v.................-.............................8.....\.....y.........................................\.....~.............................%.....:.....\.....m... .....".....%.....(......m...+.p...,.........../.....0.....1.!...3.6...4.]...5.....6.....7.....8.=...9.V...;.q...<.....=.....>.....?.....@.....A.....C.%...D.8...E.y...F...

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\resources.pak

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	5193850
Entropy (8bit):	7.9952704707488165
Encrypted:	true
SSDEEP:	98304:qg1zetaMcKWPxgWMp1W/ywNAWsh11fHcMtyrwr+oxPf0yO1WODHxSkLyz7ai6y:qgVetWxWF1pkshH8M4krFPf0FIG27sy
MD5:	043DBE3EAF0BDE424185A3843E321F83
SHA1:	580AC5FDE14E6D177D6F45D2E40D435CC7EDC8D0
SHA-256:	0C967CB604D5066F1AB609E81895C1271475A2E1B4B3D5930EEA720FC218781B
SHA-512:	44814AAEC681922594528D0ED1A4D2E935045220D09E065647B53455931EAEB3B737C87032B611D7EAD621379AE653A9C5D6D87C828C1961C54129124234EBC3
Malicious:	false
Preview:	............f........).....+....b/...8.A...8.J...8.M...8.`...8-i...8Hp...8.r...8-y...8.{...80}...8s....8e....8.....8.....8....8+....8W....8)....8....8.....8\|....8.....8;....8H....8.....8.....8y....8o....8z....8.....8.....8^....8.....9.....9.....9.....99....9.....9.....9\"...9.B...9kD...9.I...9.S...9.U...9.V...9\|W...9.Z...9.Z...9R[...9.`...9.f...9.w...9.....9x....9.....@.....@.....@....@.....@.....@.....@.....@`....@&....@.....@.....@.....@....8E....9EB...:EV...;E....<E."..=Eu-..>E....?E./..@E.0..AEQH..BEL....FSD...F.G...U4....UH....U/....U.....U.....U....U.....U5....U.....U.....U.....U.....U6....U.....U.....U.....U.....U.....U.....U.....VM....V^....V.....V.!...V.+...VJ2...V0A...V.D...V.J...Vi]...V.e...V.j...VK~...V....V.....Vn..."V....#Ve...$V,...%V....&V....'V(...(V....)V....*V>...+V@....W.....WUP...W}T.....V.....Y..........C.....y..........y.....j...........6N.....V....L^....Rc....$e....Dj.....o....1w...............................-.........../....0.....2.....3.....4.....5.4.

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	259202
Entropy (8bit):	4.177720672914121
Encrypted:	false
SSDEEP:	1536:N8eVec2PhNMqkPhmpILx3FtscrrDKrVTT9gXA4SuoveydoBaDEtu/wMHOdxpMKrF:76N6PkpILxHscrXeQZb0G0mvY6T
MD5:	3A4095538E021B84396B3CE25AFFAFC3
SHA1:	CFC20771227B3C1F3197FF6A91CEE68555AFB247
SHA-256:	C1C9145735032BFF20B2FFF50A4B92AE9CF47290F433E3F3B32E3B232D610C59
SHA-512:	7B71083180F237F5F37CBE7A9755F6606708B959986562F9C5880CCCEA17B80A5187649FC0CB6965A8B40526BCB2CB6D980D364BE528465290658B4D9084348E
Malicious:	false
Preview:	.........J.&11.4.183.29-electron.0..........................................h...B%...Y..........a........a........a........ar.......a........a..............].D.......M....`$.......m.D.......=....`$.......D.......M....`$.......u.D.......M....`$.........D.......A....`D.........D.......M....`$.......M.D.......M....`$.......D.......M....`$.......D.!.....M....`$.......q.D.%.....E....`$.......D.).....M....`$......ID.-.....M....`$.......D.1.....M....`$.......D.5.....M....`$....(Jb...(L.....@..F^......`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	data
Category:	dropped
Size (bytes):	578034
Entropy (8bit):	5.245532016724801
Encrypted:	false
SSDEEP:	6144:alKQ1+Ku6X5O8QgZbNg8zvEjbwTBH32jezyjPX:aV1oeLvs4mCG
MD5:	5DB8A5BB87C7999343F30128979057A1
SHA1:	C4177C2FE973A495DB59B6228AC26264EEC46A4D
SHA-256:	5B1F69F39F3D5865DCE13EE3BDBC1AF2938F5CC4C056DC9F9E213E9AF346AD4B
SHA-512:	DA2D516251376952729A33DE2CD23764290D400FAFC49642F2CCD799E3F989CCE4D5561A76D380A950B77B53B50148DEC9089C30DE6C3DC38666237E196E569B
Malicious:	false
Preview:	........ .R.11.4.183.29-electron.0...........................................p......*....y.........@p..a........a........aT.......ar.......a........a..............].D.......M....`$.......m.D.......=....`$.......D.......M....`$.......u.D.......M....`$.........D.......A....`D.........D.......M....`$.......M.D.......M....`$.......D.......M....`$.......D.!.....M....`$.......q.D.%.....E....`$.......D.).....M....`$......ID.-.....M....`$.......D.1.....M....`$.......D.5.....M....`$....(Jb...(L.....@..F^......`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5251072
Entropy (8bit):	6.34132445304703
Encrypted:	false
SSDEEP:	49152:Ab03fn3GIdr1DO1N8jvfWSrvOuyEE0+w7rz77gpxbhk0H4t38mvttDpSHUoeygs4:d3v3xDvRTGVgt38mvt1pSH0adU
MD5:	B06A97B925991EAC3832437D7DB078CD
SHA1:	CA32356BA0938ADA1233E13795860690712FBC14
SHA-256:	2DF870C1719AB057EA37AA15E3E379360C1DD8EAEA2EAA56CB7B026F5EE4F19F
SHA-512:	E1E61C28A28DFCF15D69E9CCC8E289DFE606B926E21756BBC0F21E15DF18D27B1926277FFC2BD6549CDFB17F11D71C2A9353392E58C33557209B781EC32CEF9E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...+.oe.........." ......?..z........9.......................................Q...........`A.........................................zK.~...f.K.P.....Q......@O.._........... Q.h}...8K......................7K.(...@.?.@.............K.P............................text.....?.......?................. ..`.rdata........?.......?.............@..@.data.........L......pL.............@....pdata..._...@O..`....N.............@..@.00cfg..8.....P......fO.............@..@.gxfg....,....P......hO.............@..@.retplne......P.......O..................tls....Q.....P.......O.............@..._RDATA..\.....Q.......O.............@..@.rsrc.........Q.......O.............@..@.reloc..h}... Q..~....O.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Temp\2sBmKhYkAMuETMmMTCVRNvTLAaj\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\Mansion_setup (1).exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	931840
Entropy (8bit):	6.566709725184446
Encrypted:	false
SSDEEP:	24576:FoHDVVdrfQ09CPKuy0O0Q6Z5W0DYsHA6g3P0zAk7s+:FuVdrI0GKuy066Z5W0DYsHA6g3P0zAkz
MD5:	D562628F9DF56AE61770FFDEF79C8D05
SHA1:	2423105A960FE0CEB038CA36D6A37638EBD32B6F
SHA-256:	5789CA1822F3A5A67CD2C24E6FF0307E688B76A2E99831050BDCF8B8D155956D
SHA-512:	739F9F41D8E3E48DBD20BFECFC5679F38E59B3FC8CB406A77C384FD5146F19EFAFA1E4F23F15071DBEAA1D0DC71E125966E19FB757FC39E6ABE953159669C096
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...+.oe.........." .....x................................................................`A........................................0...<!..l...P................o..............L...<....................... ...(...@...@............................................text....v.......x.................. ..`.rdata...............\|..............@..@.data....L....... ...d..............@....pdata...o.......p..................@..@.00cfg..8....@......................@..@.gxfg...P(...P.....................@..@.retplne............. ...................tls................."..............@..._RDATA..\............$..............@..@.rsrc................&..............@..@.reloc..L..........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\4a232a48-2f2a-49cf-a9e7-2b3bc58bccd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	5.479694253902002
Encrypted:	false
SSDEEP:	96:0q8NkGS1fL9bxi58rh/cI9URoDotoQ9BRhvhxC4JkUcrSDS4S4SDS26I4a:/8NBSFjLeoDUzzCYkUo
MD5:	B582605923D953FE9EFB5731A5FABC5F
SHA1:	CC20A922FD45707A0492A538F6B3E2ADA98B79B9
SHA-256:	CF31181CA57F7D8270D474EE30CDC4EF5B660E7D9B83E531B409E8287604A891
SHA-512:	3760ABC838CE6877BA22D2AB4148E768C2DB35C0AD388700B8A208BC685AC896BD0F05AD6DB75754C2B690391D43A40F8C32216ED3687BBBC9970C7DBC2E644F
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAArpQyCwrq9T6VFcN4seFC2EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBnKzlR0pqNHG6DdtXOVyKjHAgeO5X/tiOKnoIrcqq9AAAAAAOgAAAAAIAACAAAAASs3bVsMHuhaMSFseQUSAlo1rfo0ja88RwUHlJiWVzxjAAAABuPG2NDchGpj5iWKx7S7eYvctHhHGoyGZdaDfyih8V3XZ54+2cA+QWFOsTT/I1gHpAAAAArAAYhKs9XPwJzAlEIOBlUGvuZoehdvFwVCE7pIBIjH+lPD7f7OeWfjI3KMKpauP4ZkXR3p8Wqla1pPjuE

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\86412503-7e05-4631-b0e9-1d6eeb1f9e1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.515613270934311
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt99NoLKP6m1vyikZJdXBuBuwBM2aaNhGYXVQQRCYfYg:YuBqDPafL9bx5cgBzBM2XGYqB0
MD5:	1E11C4AADE73807D893AA04AB76E5218
SHA1:	CCEE6DE4D889C59B74C252562C54A2EA75C0BBAA
SHA-256:	ADBE24E83FD4C085451DE659EC5419DAB519E440F753E93BAE8AC3A40AEB230C
SHA-512:	559AF40D5E1DC09B68AAAF865DDD7840CC6062FEA12FA09BB6569C4C314E3F765FB206BC0343064AB01C4C954E6E43B011F4DC1ADA0CE44D7B931370EC5C792F
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAArpQyCwrq9T6VFcN4seFC2EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBnKzlR0pqNHG6DdtXOVyKjHAgeO5X/tiOKnoIrcqq9AAAAAAOgAAAAAIAACAAAAASs3bVsMHuhaMSFseQUSAlo1rfo0ja88RwUHlJiWVzxjAAAABuPG2NDchGpj5iWKx7S7eYvctHhHGoyGZdaDfyih8V3XZ54+2cA+QWFOsTT/I1gHpAAAAArAAYhKs9XPwJzAlEIOBlUGvuZoehdvFwVCE7pIBIjH+lPD7f7OeWfjI3KMKpauP4ZkXR3p8Wqla1pPjuEUcw+g=="},"profile":{"info_cache":{},"profile_counts_reported":"13384103127438190","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1739629527"},"user_experienc

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\BrowserMetrics\BrowserMetrics-67B0A3D7-1AF4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.23905206913353866
Encrypted:	false
SSDEEP:	1536:qXmOOqR70DKSoclORGvrDBWlMRGg1DRFFbqyRGPTuSJzkD/rE:UmhqV0DmclnzDBWl5g1HFbq77tzY/rE
MD5:	B00F86E97CFFA12AA47E92E852F25D1F
SHA1:	3586F6740200FAFD95942C615FE8BFFE460AB45B
SHA-256:	5899D9A9B2E4BAF395E192493FC5E53C4C3847D0FDA9A7F0BD1F8761FCAD3BB2
SHA-512:	400EF6095CDB452552A1046DBD606BA3F603CD717973589D963892768CE91C27F57B921204810110447A70D5B5A54E94DD763C654381D0B63CFEBC06822C0E65
Malicious:	false
Preview:	...@..@...@.....C.].....@................... ...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".vxoavg20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................1.....<.w..U..d.y.oK.>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Zd;.O.M@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered...

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	1.7957432736164074
Encrypted:	false
SSDEEP:	3:FiWWltlAYpST/dpvgCcaalll/:o1Mbv36t
MD5:	BC27604AD703083149A1D1097582CC55
SHA1:	0F63778575B6ECA71B7CBCC8C8E093334D471862
SHA-256:	15448E711B12AC486079E1FDF4E17781612BC2CE8277653E0B151B8E50952A50
SHA-512:	726016761F78EFF625BA3194A315A013DB2D93B579CD7C58687C707B0BADA043B3A27753097981335D66924B89CFB3F395269C7D1A22B659B38074BAB12E6D23
Malicious:	false
Preview:	sdPC.....................H.h$.I.o...._................................................................................................................................................................................................0ffc1428-e2d9-40f6-a76f-b49319c36a60............

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\07dba89d-89bd-40f3-a647-7fa64800cf22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\3c955b12-9675-4604-8faf-43cad8e2e83c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.012760698469074051
Encrypted:	false
SSDEEP:	3:MsFlYhEtlGJllVWSbgsn/t/19Zl/l/:/FiEXGWSbx9
MD5:	19B14352C50FE335989C06018C85F2F8
SHA1:	E7BE491A6589C61EAD0E80E845EF2434F57B89BB
SHA-256:	51B150314F50C622108A27FF215391411D8507624C8823FD46DE152BF067D215
SHA-512:	BF0EA1A886FC92FE13355A540C570E13313F6A120F6F1107AD5E4B7540B08E701E6396CB101004C1C482081641A5C4E118BDC36F90D8B6D27984B83257ABC3DF
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.028969023306840817
Encrypted:	false
SSDEEP:	12:U/BEGynbAEcdCIRrYfhbtZPC93OHjsqJm09MWPG:qx6bA3d/Rc1PCQHjTpM
MD5:	F92A0100CD4A0341F7CFC6CFBDD35EB1
SHA1:	EAC8887B8A39D58A3944122BB592959A1463C137
SHA-256:	AB1A9F05227677CB8296FE07CEF90C6D32C0C9AB508EDA7BD947CA456D4BE67B
SHA-512:	85FFB1B1CAC0E9BF8A67B20EB350EFA7D1D6ADF317BAB72B85FA0E5DF80B5BBC91D1CE85A45A07DFE49718FD0268BA7159EE67E6CA57A2579F96EEAC8B5E28C2
Malicious:	false
Preview:	................................................................................s.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsuln9gs:Ls89B
MD5:	FC504CABA61101612F2E4D06DE2F9534
SHA1:	9264ED688B414356C805553380FB1C866ACFA33B
SHA-256:	2DA25C48EB6DDB7E4A04A8A54FE1733B64CFD91492DC694ACB4D6830225F6191
SHA-512:	21D647CC3E02347DD535D1F386B4F54869D35709BE9D5201BB92159A0D972A8D6E18855EF537E432A15F5E59BB7CB7F7FD91845BC3041DB085E4CFBB1CF12D7A
Malicious:	false
Preview:	...........................................X./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:R0aEOBqCpKl:y1uqCkl
MD5:	D3BC8C81359B1218A59D0420AE2291F7
SHA1:	E5FE4DB126DC11A5DE991FF2D14885F897AE7224
SHA-256:	9110177F4A9B88F41BB8A6C6F2D3E0D197B448FAB63C96A123963714D36513AF
SHA-512:	09DA588778D92BB806BD415FFC002AAC6CE7AB6337B0E08A616185B8F245DFF5F8752E2E8086F7C94580BCE713DB35E6B819CA39F3E9647246AB8B09A154AD24
Malicious:	false
Preview:	(.....oy retne...........................X./.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ihFQyEe5q9x:ihFwmq9x
MD5:	8108D0A07EDB926E07F36F745FB08843
SHA1:	43221A3DC1B6BFFB30F3F389CEF347743F5F7E84
SHA-256:	A7A69450815961FEC676C91C1ADE0849B864BC75BC0C5D89A063B9096EEA3144
SHA-512:	D348401B2DEE61C13D3B2D94C087B5BAC21D92D5CDCB895C1448CBBBB56A9F82F7AB220ACB342E7A119444215FDBCB71A10DD3A2EDD43C4FA85E3308935BB6FC
Malicious:	false
Preview:	(...?..loy retne........................B..X./.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlY1:Ls3I
MD5:	817029622BF091E578D9F6C0C0C3729A
SHA1:	321D91DAADD11D84A245330F0301D2D1E1E43B07
SHA-256:	001813341163271774284F41ED56D51F5FB1B195D3DC39D42D6535EDCC726052
SHA-512:	9800BD90B77B96AB99C64A6C5E4995679762C91F27F90230AC69D1AD4B076C4CC3B872F2C7665177F628B30A346E62939FBFD958710681C1F9D38BA893E70485
Malicious:	false
Preview:	..........................................X./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.364242432273729
Encrypted:	false
SSDEEP:	6:iOXV2YfVN81e0i23fQflonG2tbB2KLl1V2YfNRM+q2Pe0i23fQflonG2tMsIFUv:7FYZ0l29VFLRxRM+vvZ0l29GFUv
MD5:	0B58BA2EDB2DF2ADF560E9D0335506A7
SHA1:	356D4DB9DB7CB07321F7EEE4BE524FEBFE5749A6
SHA-256:	15CA623889426C1DB855D6A642B71BC902577F683C201FB70FBBA94AAA6E8B04
SHA-512:	8F8DD7743225C3E304DB664D686029BD26E3BECEF8B36AEE0DB3FA4A386B99A02D5D2270423DA7AC447B8211FE5CB9F778CFA1BCB8F603120C49110B16533CDB
Malicious:	false
Preview:	2025/02/15-09:25:27.577 6fc Creating DB C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\EdgeCoupons/coupons_data.db since it was missing..2025/02/15-09:25:27.850 6fc Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.270359913714235
Encrypted:	false
SSDEEP:	6:iOXV2YfxFYfs1e0i23fQflo8aVdg2KLl1V2YfGF7Oq2Pe0i23fQflo8aPrqIFUv:7FtRZ0l9LRCF7OvvZ0lu3FUv
MD5:	3DF0509A138AD9635D3AE15C63E9E03A
SHA1:	D03BDDD6F34E7E42D04ACEA403AB26C28243C31E
SHA-256:	C06DA3A2053BC4763BD67415342891FA80D53C4067559661AE8A77D3A2992F32
SHA-512:	3B6CBBD4F087102370C23DE9D78A68237994D1329A62B18FAE6363C315ACBA44195D9B6B4517DFAFDB21F0068314EBFA3D419231F305B0A283FB8682F7D32147
Malicious:	false
Preview:	2025/02/15-09:25:27.610 1da0 Creating DB C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension Rules since it was missing..2025/02/15-09:25:27.701 1da0 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	275
Entropy (8bit):	5.285229495147885
Encrypted:	false
SSDEEP:	6:iOXV2Yf0s1e0i23fQflo86FB2KLl1V2YfXcq2Pe0i23fQflo865IFUv:7FNZ0laFFLR7cvvZ0laWFUv
MD5:	2F1E2130DCE85F649A57451C34887C42
SHA1:	1E3FBD578BFE60D3EA46FA9263D8884E9D68CD2F
SHA-256:	4296B329799384AD8494197281004C886C39571796C894FA42E2C848F91921F1
SHA-512:	E11D36F56051EBF319F21DB177300D3E33C7F68977454703B8C3D2246B506274B5D2F350EA21F7E6BB32F2F7DCD161A2EED8E80E038FECD6226C4C73B691C7B4
Malicious:	false
Preview:	2025/02/15-09:25:27.722 1da0 Creating DB C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension Scripts since it was missing..2025/02/15-09:25:27.865 1da0 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	5.30237848736001
Encrypted:	false
SSDEEP:	6:iOXV2YfQRM1e0i23fQflo8Yg2KLl1V2YfIQQVq2Pe0i23fQflo8NIFUv:7F8RkZ0lHLRhQVvvZ0l6FUv
MD5:	6B9955B0F09656665C9823DC4650A86B
SHA1:	0593265DA710C08BEE0A834C1FA833F5EA404255
SHA-256:	2377A74E6912B9D51D87749D53B96B25292C46266C50CB0C8511EA318345A259
SHA-512:	8C8153EE1FA06B04600A4ADD53B1AEB2BC8AC9B3A438EA0BF4C72DE72F6D857C360036CBC5CACCC99E5615F7B35F747DEB0EB407D03923DD66C0C2C4918DC8E0
Malicious:	false
Preview:	2025/02/15-09:25:28.280 4b4 Creating DB C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension State since it was missing..2025/02/15-09:25:28.305 4b4 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlOjX:Ls3OjX
MD5:	CF6554C6F301D972E0F6BF91C86C112C
SHA1:	E2604E2AA6FB4AB049D946DD80513DD480B49F6E
SHA-256:	67A8C07DF3DF024151163E1FAE893AFA1AD2AC5051A09E2B3730DF7563848A5E
SHA-512:	0F2138360BE84FB7CA927E8467E81D505EC396D0F6BBD96B58D17ED7AFE41E49936E1AB7C7E9B4D16C4761E5435D6150B404CDC4C27A5DE076A356BEDDAE005D
Malicious:	false
Preview:	........................................f.X./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.3908733823406
Encrypted:	false
SSDEEP:	6:iOXV2YfLTx4M1e0i23fQflo8age8Y55HEZzXELIx2KLl1V2YfE/q2Pe0i23fQflH:7F7SkZ0lLrcHEZrEkVLRyvvZ0lLrcHEz
MD5:	6C1088356F85205234D9F18472B1A6A8
SHA1:	20A52CFE1FC83A77C4BB0EF3AD747D6B9EF3EE52
SHA-256:	F37CEC22D85F75D5AB3B9CEDBDD5A9EBACA3B6D1A4E27114F47AA5DC4348019C
SHA-512:	73221358CE50E69DB90AFED75895F6048C4D413B7ED61457ADD7E43244327B568707D9DF2F81DA502E5D10F8D3C23C2BBD5D6915FBF05916F82A7C8AA4BFFC43
Malicious:	false
Preview:	2025/02/15-09:25:29.163 964 Creating DB C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2025/02/15-09:25:29.183 964 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.3419344617929845
Encrypted:	false
SSDEEP:	6:iOXV2Yf9q1e0i23fQflo8a2jM8B2KLl1V2YfD+q2Pe0i23fQflo8a2jMGIFUv:7FMZ0lLjFLR2vvZ0lLEFUv
MD5:	987A1CB6B1176F5DFEBDC5046A117898
SHA1:	4BB1895838DFD904C2B22ADBF0728750390D984F
SHA-256:	7F1FC1DE35A9B8C6F95FF2616EBFAB6D506A764397CB25795FA01FFB3DD7C2A5
SHA-512:	6CA74E22B75721DB1B7E28D2456BD3A845812C9016603DD148EF944344592F0FFB5F8B181714E2632DED9905CE4EDB0DDAEB94E5449DCEE93A51FF7249BF9FEC
Malicious:	false
Preview:	2025/02/15-09:25:27.958 3c8 Creating DB C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Local Storage\leveldb since it was missing..2025/02/15-09:25:27.979 3c8 Reusing MANIFEST C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Network\01c1c5ea-653b-4d20-b1c9-931c9ba221fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Network\1a1a860f-8981-40b9-9fcf-20a495b08312.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Temp\chr19FD.tmp\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	5.288185880619273
Encrypted:	false
SSDEEP:	6:iOXV2YfFrq1e0i23fQflorQM72KLl1V2YfKLN+q2Pe0i23fQflorQMxIFUv:7FZmZ0liLReLIvvZ0lRFUv
MD5:	A8F5AD40C2039CCAA28C5AE507D91811
SHA1:	E7460564B0F64B91FBC81FCAD3AC508F739BABC7
SHA-256:	5357193B2CFE266F3EA900B94383E3859D778B260E56F4DBE6ECFAE3FA812651

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Mansion_setup (1).exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Code Cache\js\index-dir\the-real-index (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Code Cache\wasm\index-dir\the-real-index (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension Rules\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension Scripts\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Extension State\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Local Storage\leveldb\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Network\SCT Auditing Pending Reports (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Session Storage\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Site Characteristics Database\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\Sync Data\LevelDB\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\shared_proto_db\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Default\shared_proto_db\metadata\CURRENT (copy)

C:\Users\user~1\AppData\Local\Temp\chr19FD.tmp\Local State (copy)

Windows Analysis Report
Mansion_setup (1).exe