Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2024 23:06
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240709-en
General
-
Target
setup.exe
-
Size
1.8MB
-
MD5
62784b54dca4829a61e16d31b8e30f87
-
SHA1
2323b4b01ea18b4478ecb41309e24d64ad52746d
-
SHA256
7886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd
-
SHA512
7e06144259680af23fabb3c225daaccaf930a7313ca3ccf9639addd119acf13a41b23c764be08259a1643077475d8edc51e08e46a699a75f61fc2ff07d2e56a3
-
SSDEEP
49152:tP1Dp0xtpy4XriZY20Tf7b7X34fYXmag9kUVVo:Z0vI4X2ZY20Tzb7XIf2GHo
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
25072023
185.215.113.67:40960
Extracted
redline
Logs
185.215.113.9:9137
Signatures
-
Detects Monster Stealer. 4 IoCs
resource yara_rule behavioral2/files/0x0007000000023516-334.dat family_monster behavioral2/memory/6824-562-0x00007FF6E1260000-0x00007FF6E249E000-memory.dmp family_monster behavioral2/memory/6824-676-0x00007FF6E1260000-0x00007FF6E249E000-memory.dmp family_monster behavioral2/memory/6824-690-0x00007FF6E1260000-0x00007FF6E249E000-memory.dmp family_monster -
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
resource yara_rule behavioral2/files/0x0007000000023554-543.dat family_redline behavioral2/memory/3504-585-0x0000000000540000-0x0000000000592000-memory.dmp family_redline behavioral2/files/0x0008000000023541-2107.dat family_redline behavioral2/memory/6680-2121-0x0000000000390000-0x00000000003E2000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
description pid Process procid_target PID 4360 created 3420 4360 Blsvr.exe 56 PID 4360 created 3420 4360 Blsvr.exe 56 PID 4360 created 3420 4360 Blsvr.exe 56 -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7361c3a552.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 6628 netsh.exe 7128 netsh.exe -
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7361c3a552.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7361c3a552.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation 26f002bfd6.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation 7361c3a552.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation setup.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 6928 cmd.exe 7108 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe 2020.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe 2020.exe -
Executes dropped EXE 24 IoCs
pid Process 832 explorti.exe 4692 26f002bfd6.exe 5292 78928192d3.exe 6052 explorti.exe 5840 7361c3a552.exe 2408 axplong.exe 6596 build.exe 6824 stub.exe 6716 crypteda.exe 5496 2.exe 6304 v0qLb4ypnh.exe 3504 25072023.exe 684 PqFKF4f69C.exe 7008 pered.exe 3972 pered.exe 6152 axplong.exe 7016 explorti.exe 3944 2020.exe 6272 2020.exe 6680 buildred.exe 4360 Blsvr.exe 7300 Authenticator.exe 7948 axplong.exe 7936 explorti.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine setup.exe Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine 7361c3a552.exe Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Wine explorti.exe -
Loads dropped DLL 64 IoCs
pid Process 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 6824 stub.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 3972 pered.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe 6272 2020.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\26f002bfd6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\26f002bfd6.exe" explorti.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 106 raw.githubusercontent.com 107 raw.githubusercontent.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 184 ipinfo.io 102 ip-api.com 183 ipinfo.io -
pid Process 5640 cmd.exe 6900 ARP.EXE -
Power Settings 1 TTPs 5 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 7000 cmd.exe 6316 powercfg.exe 8180 powercfg.exe 8144 powercfg.exe 8124 powercfg.exe -
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 6232 tasklist.exe 2484 tasklist.exe 2964 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 6384 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
pid Process 1924 setup.exe 832 explorti.exe 5292 78928192d3.exe 5292 78928192d3.exe 6052 explorti.exe 5840 7361c3a552.exe 2408 axplong.exe 5292 78928192d3.exe 3972 pered.exe 6152 axplong.exe 7016 explorti.exe 7948 axplong.exe 7936 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 6716 set thread context of 5772 6716 crypteda.exe 180 PID 4360 set thread context of 1264 4360 Blsvr.exe 253 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\explorti.job setup.exe File created C:\Windows\Tasks\axplong.job 7361c3a552.exe -
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5780 sc.exe 6388 sc.exe 6228 sc.exe 232 sc.exe 3964 sc.exe 6484 sc.exe -
Detects Pyinstaller 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023559-697.dat pyinstaller behavioral2/files/0x00070000000235be-2059.dat pyinstaller -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral2/files/0x000700000002353c-361.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
Program crash 2 IoCs
pid pid_target Process procid_target 5276 5292 WerFault.exe 124 6668 5496 WerFault.exe 178 -
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language v0qLb4ypnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language buildred.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7361c3a552.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26f002bfd6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78928192d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25072023.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PqFKF4f69C.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 5276 cmd.exe 6552 netsh.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 6920 NETSTAT.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 5528 WMIC.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 6316 ipconfig.exe 6920 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 6476 systeminfo.exe -
Kills process with taskkill 1 IoCs
pid Process 6656 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133667680298375849" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings firefox.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 25072023.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 25072023.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1924 setup.exe 1924 setup.exe 832 explorti.exe 832 explorti.exe 4860 msedge.exe 4860 msedge.exe 4544 chrome.exe 4544 chrome.exe 3272 msedge.exe 3272 msedge.exe 6052 explorti.exe 6052 explorti.exe 5840 7361c3a552.exe 5840 7361c3a552.exe 2408 axplong.exe 2408 axplong.exe 7108 powershell.exe 7108 powershell.exe 7108 powershell.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 684 PqFKF4f69C.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe 6304 v0qLb4ypnh.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3272 msedge.exe 4544 chrome.exe 4544 chrome.exe 3272 msedge.exe 3272 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeIncreaseQuotaPrivilege 5820 WMIC.exe Token: SeSecurityPrivilege 5820 WMIC.exe Token: SeTakeOwnershipPrivilege 5820 WMIC.exe Token: SeLoadDriverPrivilege 5820 WMIC.exe Token: SeSystemProfilePrivilege 5820 WMIC.exe Token: SeSystemtimePrivilege 5820 WMIC.exe Token: SeProfSingleProcessPrivilege 5820 WMIC.exe Token: SeIncBasePriorityPrivilege 5820 WMIC.exe Token: SeCreatePagefilePrivilege 5820 WMIC.exe Token: SeBackupPrivilege 5820 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1924 setup.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe 3508 firefox.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3508 firefox.exe 5292 78928192d3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 832 1924 setup.exe 91 PID 1924 wrote to memory of 832 1924 setup.exe 91 PID 1924 wrote to memory of 832 1924 setup.exe 91 PID 832 wrote to memory of 4692 832 explorti.exe 93 PID 832 wrote to memory of 4692 832 explorti.exe 93 PID 832 wrote to memory of 4692 832 explorti.exe 93 PID 4692 wrote to memory of 2360 4692 26f002bfd6.exe 94 PID 4692 wrote to memory of 2360 4692 26f002bfd6.exe 94 PID 2360 wrote to memory of 4544 2360 cmd.exe 185 PID 2360 wrote to memory of 4544 2360 cmd.exe 185 PID 2360 wrote to memory of 3272 2360 cmd.exe 98 PID 2360 wrote to memory of 3272 2360 cmd.exe 98 PID 2360 wrote to memory of 3900 2360 cmd.exe 99 PID 2360 wrote to memory of 3900 2360 cmd.exe 99 PID 4544 wrote to memory of 3964 4544 chrome.exe 186 PID 4544 wrote to memory of 3964 4544 chrome.exe 186 PID 3272 wrote to memory of 5072 3272 msedge.exe 101 PID 3272 wrote to memory of 5072 3272 msedge.exe 101 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3900 wrote to memory of 3508 3900 firefox.exe 102 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 PID 3508 wrote to memory of 4720 3508 firefox.exe 104 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 6444 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\1000020001\26f002bfd6.exe"C:\Users\Admin\AppData\Local\Temp\1000020001\26f002bfd6.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E0FA.tmp\E0FB.tmp\E0FC.bat C:\Users\Admin\AppData\Local\Temp\1000020001\26f002bfd6.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"6⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9e558cc40,0x7ff9e558cc4c,0x7ff9e558cc587⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1992,i,16333995500785900115,5702394619426270773,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1988 /prefetch:27⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1780,i,16333995500785900115,5702394619426270773,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2288 /prefetch:37⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,16333995500785900115,5702394619426270773,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2296 /prefetch:87⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,16333995500785900115,5702394619426270773,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3120 /prefetch:17⤵PID:5240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,16333995500785900115,5702394619426270773,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3160 /prefetch:17⤵PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4492,i,16333995500785900115,5702394619426270773,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4464 /prefetch:87⤵PID:5784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4740,i,16333995500785900115,5702394619426270773,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4836 /prefetch:87⤵PID:5776
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"6⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9da6746f8,0x7ff9da674708,0x7ff9da6747187⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,11395495160289204685,10023244198407797650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:27⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,11395495160289204685,10023244198407797650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:37⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,11395495160289204685,10023244198407797650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:87⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11395495160289204685,10023244198407797650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:17⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11395495160289204685,10023244198407797650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:17⤵PID:5260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11395495160289204685,10023244198407797650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:17⤵PID:6080
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"6⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account7⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1764 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c49f692d-eaca-426e-a548-4f9b773d80ee} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" gpu8⤵PID:4720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2400 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d87d0dc7-1528-4298-a624-0648613ecb79} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" socket8⤵PID:3096
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3280 -childID 1 -isForBrowser -prefsHandle 3392 -prefMapHandle 3456 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8490c31-00f4-4f0b-ac2c-7cf8aeab0eef} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" tab8⤵PID:5948
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3232 -childID 2 -isForBrowser -prefsHandle 2680 -prefMapHandle 2572 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e4f68a2-6a5b-4b0b-ad2f-028438607942} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" tab8⤵PID:5296
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3648 -childID 3 -isForBrowser -prefsHandle 3656 -prefMapHandle 2572 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cebd506e-bd0d-4349-aa19-09e1e2b55039} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" tab8⤵PID:5596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3836 -childID 4 -isForBrowser -prefsHandle 3844 -prefMapHandle 3848 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8438baaf-f7aa-4270-9bd6-b261b21c5d39} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" tab8⤵PID:5924
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"4⤵PID:5140
-
-
C:\Users\Admin\1000023002\78928192d3.exe"C:\Users\Admin\1000023002\78928192d3.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 11045⤵
- Program crash
PID:5276
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000027001\7361c3a552.exe"C:\Users\Admin\AppData\Local\Temp\1000027001\7361c3a552.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"6⤵
- Executes dropped EXE
PID:6596 -
C:\Users\Admin\AppData\Local\Temp\onefile_6596_133667680376918071\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6824 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵PID:7044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"8⤵PID:7124
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid9⤵
- Suspicious use of AdjustPrivilegeToken
PID:5820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"8⤵PID:7136
-
C:\Windows\system32\tasklist.exetasklist9⤵
- Enumerates processes with tasklist
PID:2964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""8⤵
- Hide Artifacts: Hidden Files and Directories
PID:6384 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"9⤵
- Views/modifies file attributes
PID:6444
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""8⤵PID:6476
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"8⤵PID:6464
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe9⤵
- Kills process with taskkill
PID:6656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"8⤵PID:6936
-
C:\Windows\system32\tasklist.exetasklist /FO LIST9⤵
- Enumerates processes with tasklist
PID:6232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"8⤵
- Clipboard Data
PID:6928 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard9⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:7108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"8⤵PID:6916
-
C:\Windows\system32\chcp.comchcp9⤵PID:6988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"8⤵PID:6944
-
C:\Windows\system32\chcp.comchcp9⤵PID:5292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"8⤵
- Network Service Discovery
PID:5640 -
C:\Windows\system32\systeminfo.exesysteminfo9⤵
- Gathers system information
PID:6476
-
-
C:\Windows\system32\HOSTNAME.EXEhostname9⤵PID:6540
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername9⤵
- Collects information from the system
PID:5528
-
-
C:\Windows\system32\net.exenet user9⤵PID:5396
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user10⤵PID:3568
-
-
-
C:\Windows\system32\query.exequery user9⤵PID:6736
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"10⤵PID:5848
-
-
-
C:\Windows\system32\net.exenet localgroup9⤵PID:4116
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup10⤵PID:5548
-
-
-
C:\Windows\system32\net.exenet localgroup administrators9⤵PID:3032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators10⤵PID:2200
-
-
-
C:\Windows\system32\net.exenet user guest9⤵PID:4976
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest10⤵PID:7056
-
-
-
C:\Windows\system32\net.exenet user administrator9⤵PID:6348
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator10⤵PID:6344
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command9⤵PID:6808
-
-
C:\Windows\system32\tasklist.exetasklist /svc9⤵
- Enumerates processes with tasklist
PID:2484
-
-
C:\Windows\system32\ipconfig.exeipconfig /all9⤵
- Gathers network information
PID:6316
-
-
C:\Windows\system32\ROUTE.EXEroute print9⤵PID:7108
-
-
C:\Windows\system32\ARP.EXEarp -a9⤵
- Network Service Discovery
PID:6900
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano9⤵
- System Network Connections Discovery
- Gathers network information
PID:6920
-
-
C:\Windows\system32\sc.exesc query type= service state= all9⤵
- Launches sc.exe
PID:5780
-
-
C:\Windows\system32\netsh.exenetsh firewall show state9⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6628
-
-
C:\Windows\system32\netsh.exenetsh firewall show config9⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:7128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"8⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:5276 -
C:\Windows\system32\netsh.exenetsh wlan show profiles9⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:6552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"8⤵PID:5856
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid9⤵PID:6588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"8⤵PID:4056
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid9⤵PID:5520
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5772 -
C:\Users\Admin\AppData\Roaming\v0qLb4ypnh.exe"C:\Users\Admin\AppData\Roaming\v0qLb4ypnh.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6304 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:5108
-
-
-
C:\Users\Admin\AppData\Roaming\PqFKF4f69C.exe"C:\Users\Admin\AppData\Roaming\PqFKF4f69C.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:684 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:4544
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:5496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 3527⤵
- Program crash
PID:6668
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:3504
-
-
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"6⤵
- Executes dropped EXE
PID:7008 -
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3972 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵PID:3552
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"6⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"7⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
PID:6272 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵PID:6204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI39442\Blsvr.exe8⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\_MEI39442\Blsvr.exeC:\Users\Admin\AppData\Local\Temp\_MEI39442\Blsvr.exe9⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4360
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6680
-
-
C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"6⤵
- Executes dropped EXE
PID:7300
-
-
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:6876
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:6388
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:6228
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:232
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:3964
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:6484
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
PID:7000 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
PID:6316
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
PID:8180
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
PID:8144
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
PID:8124
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:5592
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5828
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5292 -ip 52921⤵PID:4040
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:3964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5496 -ip 54961⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6152
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7016
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:6540
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7948
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7936
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1System Services
1Service Execution
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
8System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD519ed605eab6dc25e9ec281d8ad8c8464
SHA1d1c078ad1429245eff9dabaea3288588f4045f32
SHA25626658a7feddc605ffa381cd8b75096828f1d556554187a322145252863f59cf6
SHA51224175ff4259cbbb696d6e7271bf779fe9eaa3b2c2c6764a823abee8b9328f95fc2a3d14e6399aaeb04d6fabee1278074e5d98997a296837970598339b118af26
-
Filesize
649B
MD584b2c3280a2ccaab01bf3295cfcfd9cc
SHA17e5212ccf85ddb5b990507217f529a32d52a4498
SHA256f9b5695236cd01f93c39483093eaf9a79a150235a6f4ae45df3e22b52d13431b
SHA512498e286767f596a2f5596feb3f7e8083323b9fe9d846d904e8a173464cef8a5e82b0a2c962b086c688ef949b2290d976db5a9e80d5d8138063a9935491995a3a
-
Filesize
264B
MD5c581c34026d969b3c7ac8ce298b62485
SHA18269822cad8512edfd437c4dca08cb5194dfd416
SHA2567b39a9601803efb50ea184307a4a545409fb0bc50b93f2a784c4ce6feb8b9e69
SHA512f750dc79ddd544c511e89592b49f89744a72a829d0754f06afee39a6e63fef53b1ee534d86cefe5c854ccfb949911cd2bf060f2ae72f33983f831f49337d291b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5a891e0b1146be9a18eeac09bf3b1e2a0
SHA1fc07a39f9c51e85219e70a3f1e3b7ded2984ab24
SHA25661c68458eef1e94e45811b78e220a960b8667b65168618f6c3be5a9b79d06d91
SHA512be6d6d0f813873f35a2565ea89df1cd265f7803994d11b5613317d395daa16d833ece9ebe428dd8b008a30dc47254d48728ea376b848d87873e7a6a9b8e2276d
-
Filesize
9KB
MD5def9fd26cde57f82887065c1f2f00d5c
SHA17865639613632767c31dc204c59f349e169f1f86
SHA256d17fbe1364cf1ecadbab5a78944f5dec692efc2612dbe966205d5a0dc967fd7a
SHA5127ed7b189bf51c01e47c0439ac4dbf5163cd4a4c45972628f9f66a3485b819d1a95ea955ad6715d7642fcad0f67fbaffec682329440658d2e7e9b53d7a3ea528a
-
Filesize
9KB
MD5f05942dd8195d796c68fe483bfb4349e
SHA194bedad1c39e3a6491d08824dcd012bb5717d8b0
SHA2567df2c9e4c183be0156051a39476cf592d7a1b896e9f73aa804367c20445128e9
SHA512c9612734ecbf55d95bc25b24dfa62cd599ddb9291f2813234d494efd4449e4fde72d0471801063999e89332be7032adf887b81ae0944e0bbfc5e3393d4921319
-
Filesize
15KB
MD5bc0cd5958563c70956fe337d4f62ed9f
SHA1f4e12a22d873077f921918c53b646f21bc2ad0ca
SHA256b70f7c75c021bbd46187fa3ed27dad7a192b0f96e2c20060d5425d51585f3a2d
SHA5128bc09b914d5a8edcc396c39f43af45225bdcedc7a9afc51aaf32ce146b5fa2990927dfd1d865c094a4dc7ab3eeaef63dbc6bd9e1ef68a7954a81522aed7ea57b
-
Filesize
189KB
MD5c44361eabfc0788d80d4f584a76f824c
SHA15f17eb48f638f6a3ebf1e3aedbdd458d35d80c8f
SHA256bf226033b3c719411894e1166cbc73d03e7f253ba6a9de1a1edb197e7b3af5ae
SHA512d57a8859b23674897a6c7bc5cf3b4b7bb5d6f03cf9946e39bede8c6554a77c9608830593a6ad815ba5195c41ef6aa5f3287038ff15d4c8a15d6f9e2d981f3d49
-
Filesize
92KB
MD5210b709138061040956820a2141396d8
SHA1855016a9ba874311499d28c677d537bd1788284b
SHA2563440374ae623ca75ec77c07bda64e8c7e1a6711a5184c285dc7747465c893787
SHA512218d9e8e3afbb084c2c5070004cd82df17c51e5335d487193ba451615ecc52c7f339d27fc7f2b7fe482aa07418e3ffb0d9681534304184a3c8166c2778a0b7d0
-
Filesize
152B
MD554aadd2d8ec66e446f1edb466b99ba8d
SHA1a94f02b035dc918d8d9a46e6886413f15be5bff0
SHA2561971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
SHA5127e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
-
Filesize
152B
MD52f842025e22e522658c640cfc7edc529
SHA14c2b24b02709acdd159f1b9bbeb396e52af27033
SHA2561191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
SHA5126e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD55609946d094fd9638686c5442d23c2c9
SHA14fbc0adb45f4efd1a6935b4da046b7135023e944
SHA2562d911466b16b8a1b96aa4ed24f338a449ce5101d71e2c911b3125c4262c471f5
SHA512446e73f641288fc1736e7d1ab70c7a0ba9017b90fee300c4d250543ac5bac993af6a52558ae6a617a5d4b2810c3c3071d95097e223a4058da5448dce6077b425
-
Filesize
5KB
MD5052e88fbf6cd5e077a3d77e7f216153a
SHA1aa799bc553d0ae5d9416375c0af126c26a39cf81
SHA25668fec9736e9327680cf143546d20b5f1a10f0e9ba872efb450984af861cb42cb
SHA512298c8a4396901e82dc5d835679c170bcf84a7adc3a655237bfeee1e4881ccf58bb24016c4a3bc0bc3166486cdc2b412f8428f160a8d678c3f6dc5659bb7914b0
-
Filesize
6KB
MD501efd30db2b28fe7add4e160ab6516aa
SHA1fc85ad533f6e4fa0565e4cfd984ed1a744b32c97
SHA2567cb35705f4ccacf4cf9c2b363c2c7a39e50e242f0c3f615f75f65b7c392734b1
SHA51230640e21a22c3b864d477ff69e536b51ee29c291f7b217cbd7a50e2e5dcf8f3039a2e7a51ba73da22eab49f5f3f7a9f15d5f40406433bff82b32a160d3bb9306
-
Filesize
372B
MD55c553f1037a6fe0d8d273dd32a18ca80
SHA1884cfcd0d36fea16dc5aff339bab952402c483e7
SHA25645ea527e84acd73dd672033cdcc275a2c824da0a9257f71c6a02809bb8b8eedc
SHA5121a59338d93436b4d1aa17cd16c129b35dfc4e817d41421b143683eb8dbc07343ed176dc0674430df0ef1fe206bf8526d4fad890a06e3b3cd1cf9e4256f08ce38
-
Filesize
204B
MD586c92855d1cf076fbd10b4b6e143bb79
SHA1bf1fb4b9b54d84a12613281d53b7ba7e7e539ffd
SHA2563b5cc85ecf71dc2e6d5431f06d781594734f61d127715b45716833f247e1d4f0
SHA512a510c9c575cff540ae953980fe1b5baa31d04082000d7033b14446f36ed89d72e0200b322e928aa80cec338ff6cb561384db77a60eaea4cbfd613d3bde83fdd6
-
Filesize
10KB
MD5b22a39c2d4cc38d5f6719fac08a15838
SHA1c737c2a85b0dcfc689436718183d007aef1a4cdb
SHA2560d9b28e916e370e3393603612e4b42f9c87bb9d9618ad8d952e614353d9e29df
SHA51285579e2ffc407a52da09f72e512c161d02da7274679fde7c22a155fb84add12d75921ad9984cb3b0262522c2fa197364a060d314d511fb4f987ffa00969c03e1
-
Filesize
248KB
MD5d912c1870cc243b4207ee9aeeff147fa
SHA16ee385c425d2973b7d60ded86c793c6d81d305c4
SHA256482a9eaa66d830460a75fefcbee819b388ecac1fddd8e2b606238891a93ddc99
SHA512f25ddf233d82eb358c862bd7ea8e8a5f6cdb11ac8822174358463fb36449ba91bdabbd2fca2623acd64161d9e2ef5bdb9811b9b3dca03a84d723dc5df02dd23c
-
Filesize
1.8MB
MD562784b54dca4829a61e16d31b8e30f87
SHA12323b4b01ea18b4478ecb41309e24d64ad52746d
SHA2567886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd
SHA5127e06144259680af23fabb3c225daaccaf930a7313ca3ccf9639addd119acf13a41b23c764be08259a1643077475d8edc51e08e46a699a75f61fc2ff07d2e56a3
-
Filesize
10.7MB
MD5c8cf26425a6ce325035e6da8dfb16c4e
SHA131c2b3a26c05b4bf8dea8718d1df13a0c2be22ee
SHA2569f7be9bf913d8378f094b3f6416db9aa4c80c380000202f7cfaddadb6efc41b4
SHA5120321e48e185c22165ac6429e08afac1ccfdf393249436c8eac8a6d64794b3b399740aa5b2be23d568f57495d17e9220280ed1c2ea8f012b2c4021beb02cbc646
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
1.4MB
MD504e90b2cf273efb3f6895cfcef1e59ba
SHA179afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA51272aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555
-
Filesize
304KB
MD5a9a37926c6d3ab63e00b12760fae1e73
SHA1944d6044e111bbad742d06852c3ed2945dc9e051
SHA25627955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97
-
Filesize
10.9MB
MD5faf1270013c6935ae2edaf8e2c2b2c08
SHA1d9a44759cd449608589b8f127619d422ccb40afa
SHA2561011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
SHA5124a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098
-
Filesize
12.3MB
MD595606667ac40795394f910864b1f8cc4
SHA1e7de36b5e85369d55a948bedb2391f8fae2da9cf
SHA2566f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617
SHA512fab43d361900a8d7f1a17c51455d4eedbbd3aec23d11cdb92ec1fb339fc018701320f18a2a6b63285aaafafea30fa614777d30cdf410ffd7698a48437760a142
-
Filesize
89KB
MD519187e57aa6868f347d24af9f5e74669
SHA11d5e390f667475f2d9f46e443abedb4c84be38f7
SHA25688bbb152a8e51de0d3197bbe1877377c2fbafbe0ee0574547dfeaf5d2943c792
SHA5124b99ce5985f1d96a448d6e6dd9140b9fc4ab199c0c1484939375f9ead269f8ac53da89c77ec007d4d7330a2778f7747600fc06e64e75e2e7c8249794cb80bcb5
-
Filesize
1.8MB
MD5868603547212bdfc23c538129fae1e7b
SHA1471db8352a04289391a46ee0d62053a09c994796
SHA256af4bb0127493537beeddbe4dca095d47d907f69619598a5b10004b907c9c0431
SHA5122b0b63930f730a7ad7c06d7fa892f0ea93c489856905a00d2b500852a5683fc32e66544ac0a0ac3d0a74d8c0d6fcd8811d99fbb5456b2017316395588fa7ac08
-
Filesize
304KB
MD54e0235942a9cde99ee2ee0ee1a736e4f
SHA1d084d94df2502e68ee0443b335dd621cd45e2790
SHA256a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306
SHA512cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f
-
Filesize
11.0MB
MD5dae181fa127103fdc4ee4bf67117ecfb
SHA102ce95a71cadd1fd45351690dc5e852bec553f85
SHA256f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
SHA512d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f
-
Filesize
2KB
MD5de9423d9c334ba3dba7dc874aa7dbc28
SHA1bf38b137b8d780b3d6d62aee03c9d3f73770d638
SHA256a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698
SHA51263f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401
-
Filesize
6.9MB
MD5f918173fbdc6e75c93f64784f2c17050
SHA1163ef51d4338b01c3bc03d6729f8e90ae39d8f04
SHA2562c7a31dec06df4eec6b068a0b4b009c8f52ef34ace785c8b584408cb29ce28fd
SHA5125405d5995e97805e68e91e1f191dc5e7910a7f2ba31619eb64aff54877cbd1b3fa08b7a24b411d095edb21877956976777409d3db58d29da32219bf578ce4ef2
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
62KB
MD56eb3c9fc8c216cea8981b12fd41fbdcd
SHA15f3787051f20514bb9e34f9d537d78c06e7a43e6
SHA2563b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010
SHA5122027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
177KB
MD5ebb660902937073ec9695ce08900b13d
SHA1881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA25652e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA51219d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
47KB
MD57e6bd435c918e7c34336c7434404eedf
SHA1f3a749ad1d7513ec41066ab143f97fa4d07559e1
SHA2560606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4
SHA512c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
Filesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
18.0MB
MD51cf17408048317fc82265ed6a1c7893d
SHA19bfec40d6eb339c5a6c2ad6e5fa7cebc147654c5
SHA2561352ad9860a42137b096d9675a7b8d578fbc596d965de3cb352619cbe6aaf4e9
SHA51266322d7cb5931017acaa29970da48642d03ce35007f130511b2848b67169c1dd4167f1e5a31e5e1dfe5f7122846482bdb878b5cd695ac58009033fd620813a0f
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin
Filesize8KB
MD5295ef956919411706cb3100a35289364
SHA1bbe356d145c4f308506d0d219faa2087410d90e4
SHA256445bb713170d42b802c969cc689f8f3a6e3b17cfbc3b7283a97f850ed947489b
SHA512cf0df082d965170121eac21f41bbe0393afa219d387e921b8770b2f0ec9a7676bf4a937a59166a3f8f0e6456477310cdbd7cf49cb47ae0358a62bd41aeb356ab
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
9KB
MD51147bcc370ef739ee901fb11c91463d3
SHA15644f04a7e0737079312f74439ca4b52489720cd
SHA256c62f83496d440b9d3c859f2636d8244d543a9fb8b52aecfefda2bb0c4e65c3ae
SHA5121c0b1a839343c2fb1adb7c33b7c9160fe747a014555d6726c7837408d0fe99a016e679fe52f62c466be52a8589a7c1f10558f8bd87fcc2939fcfe970db91a3be
-
Filesize
8KB
MD5793a68ded07a9b2aeb365efc0beeb44e
SHA18aea27768cea2ada5f5c59cbbce2df70029b7054
SHA25649ed88f1899163c7019153e09a4bcad5300330835c3e512b33d41bdd2b95349d
SHA512c0383509dfa20649843d32385afb765f8329620c6b9aa23d54a63707dfff631d7d3f7688f380afd8080aba383b5279549b0fd88d7a263a85d73a195fc3c0f0f0
-
Filesize
503KB
MD52c2be38fb507206d36dddb3d03096518
SHA1a16edb81610a080096376d998e5ddc3e4b54bbd6
SHA2560c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e
SHA512e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316
-
Filesize
510KB
MD574e358f24a40f37c8ffd7fa40d98683a
SHA17a330075e6ea3d871eaeefcecdeb1d2feb2fc202
SHA2560928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6
SHA5121525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf