Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-07-2024 06:40
Static task
static1
Behavioral task
behavioral1
Sample
7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe
Resource
win11-20240709-en
General
-
Target
7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe
-
Size
1.8MB
-
MD5
1dce706f6aced6737a8f262475470bfe
-
SHA1
2de45d72a2fea7c89528f5283a9e0a9a0424d26f
-
SHA256
7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a
-
SHA512
be1ab223a46aae5d3661768a55571b57ba5ff69b4aa09478c11c1f82697387675cc9b5fd9b81ae2fe8a2ca8cd81a9dd867e419d86447c5f592ece98ef13ad70c
-
SSDEEP
49152:2OQZJFROaHrEEMue9iPwKC+BZM4ZiL+FB8h0o3FehrHxsklDM:MpCNKC+BZMoW3Fe5HSk
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
20.52.165.210:39030
Extracted
stealc
QLL2
http://85.28.47.70
-
url_path
/744f169d372be841.php
Extracted
redline
25072023
185.215.113.67:40960
Signatures
-
Detects Monster Stealer. 2 IoCs
resource yara_rule behavioral2/files/0x000200000002ab5d-554.dat family_monster behavioral2/memory/2916-733-0x00007FF626E10000-0x00007FF62804E000-memory.dmp family_monster -
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral2/memory/1128-650-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral2/files/0x000300000002a66e-857.dat family_redline behavioral2/memory/5876-869-0x00000000000F0000-0x0000000000142000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 76da9f66bd.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 6000 netsh.exe 2760 netsh.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 76da9f66bd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 76da9f66bd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 1436 cmd.exe 5280 powershell.exe -
Executes dropped EXE 17 IoCs
pid Process 2204 explorti.exe 1232 a78a7ef122.exe 6112 79393a14bf.exe 4944 explorti.exe 4492 76da9f66bd.exe 4220 axplong.exe 2400 axplong.exe 4716 explorti.exe 3588 build.exe 2916 stub.exe 1408 GOLD.exe 5308 343dsxs.exe 5268 crypteda.exe 3924 uBsBTD3tcf.exe 4800 ZsoCvR1JtO.exe 3492 2.exe 5876 25072023.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe Key opened \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine 76da9f66bd.exe Key opened \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Wine explorti.exe -
Loads dropped DLL 35 IoCs
pid Process 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2916 stub.exe 2548 RegAsm.exe 2548 RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Microsoft\Windows\CurrentVersion\Run\79393a14bf.exe = "C:\\Users\\Admin\\1000029002\\79393a14bf.exe" explorti.exe Set value (str) \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000\Software\Microsoft\Windows\CurrentVersion\Run\a78a7ef122.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\a78a7ef122.exe" explorti.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 74 raw.githubusercontent.com 86 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 ip-api.com -
pid Process 3992 cmd.exe 2464 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 2636 tasklist.exe 6000 tasklist.exe 2684 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 4808 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2164 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe 2204 explorti.exe 6112 79393a14bf.exe 4944 explorti.exe 4492 76da9f66bd.exe 4220 axplong.exe 2400 axplong.exe 4716 explorti.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1408 set thread context of 1128 1408 GOLD.exe 174 PID 5308 set thread context of 2548 5308 343dsxs.exe 194 PID 5268 set thread context of 2388 5268 crypteda.exe 212 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Tasks\explorti.job 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe File opened for modification C:\Windows\SystemTemp chrome.exe File created C:\Windows\Tasks\axplong.job 76da9f66bd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4080 sc.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral2/files/0x000100000002ab81-568.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
Program crash 2 IoCs
pid pid_target Process procid_target 5680 6112 WerFault.exe 125 1888 3492 WerFault.exe 220 -
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76da9f66bd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79393a14bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 343dsxs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uBsBTD3tcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZsoCvR1JtO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25072023.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a78a7ef122.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2560 netsh.exe 4668 cmd.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 2772 NETSTAT.EXE -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 5532 WMIC.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 776 timeout.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3344 ipconfig.exe 2772 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4176 systeminfo.exe -
Kills process with taskkill 1 IoCs
pid Process 3124 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133667952801591310" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings firefox.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2164 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe 2164 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe 2204 explorti.exe 2204 explorti.exe 4704 msedge.exe 4704 msedge.exe 3392 msedge.exe 3392 msedge.exe 4956 chrome.exe 4956 chrome.exe 5856 identity_helper.exe 5856 identity_helper.exe 5448 msedge.exe 5448 msedge.exe 4944 explorti.exe 4944 explorti.exe 4492 76da9f66bd.exe 4492 76da9f66bd.exe 4220 axplong.exe 4220 axplong.exe 2400 axplong.exe 2400 axplong.exe 4716 explorti.exe 4716 explorti.exe 5280 powershell.exe 5280 powershell.exe 5280 powershell.exe 2548 RegAsm.exe 2548 RegAsm.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 1128 RegAsm.exe 3924 uBsBTD3tcf.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 4956 chrome.exe 4956 chrome.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe Token: SeShutdownPrivilege 4956 chrome.exe Token: SeCreatePagefilePrivilege 4956 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2164 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 3772 firefox.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe 4956 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3772 firefox.exe 6112 79393a14bf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2204 2164 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe 82 PID 2164 wrote to memory of 2204 2164 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe 82 PID 2164 wrote to memory of 2204 2164 7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe 82 PID 2204 wrote to memory of 1232 2204 explorti.exe 84 PID 2204 wrote to memory of 1232 2204 explorti.exe 84 PID 2204 wrote to memory of 1232 2204 explorti.exe 84 PID 1232 wrote to memory of 4648 1232 a78a7ef122.exe 109 PID 1232 wrote to memory of 4648 1232 a78a7ef122.exe 109 PID 4648 wrote to memory of 4956 4648 cmd.exe 89 PID 4648 wrote to memory of 4956 4648 cmd.exe 89 PID 4648 wrote to memory of 3392 4648 cmd.exe 90 PID 4648 wrote to memory of 3392 4648 cmd.exe 90 PID 4648 wrote to memory of 776 4648 cmd.exe 91 PID 4648 wrote to memory of 776 4648 cmd.exe 91 PID 4956 wrote to memory of 1780 4956 chrome.exe 92 PID 4956 wrote to memory of 1780 4956 chrome.exe 92 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 776 wrote to memory of 3772 776 firefox.exe 93 PID 3392 wrote to memory of 652 3392 msedge.exe 94 PID 3392 wrote to memory of 652 3392 msedge.exe 94 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 PID 3772 wrote to memory of 3976 3772 firefox.exe 95 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 776 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe"C:\Users\Admin\AppData\Local\Temp\7a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1000020001\a78a7ef122.exe"C:\Users\Admin\AppData\Local\Temp\1000020001\a78a7ef122.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1E12.tmp\1E13.tmp\1E14.bat C:\Users\Admin\AppData\Local\Temp\1000020001\a78a7ef122.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"5⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa64b2cc40,0x7ffa64b2cc4c,0x7ffa64b2cc586⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,17503203773332383962,17991915511290540902,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1824 /prefetch:26⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2088,i,17503203773332383962,17991915511290540902,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2100 /prefetch:36⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,17503203773332383962,17991915511290540902,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2184 /prefetch:86⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,17503203773332383962,17991915511290540902,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3144 /prefetch:16⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,17503203773332383962,17991915511290540902,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3400 /prefetch:16⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4612,i,17503203773332383962,17991915511290540902,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4620 /prefetch:86⤵PID:5928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4812,i,17503203773332383962,17991915511290540902,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4784 /prefetch:86⤵PID:6028
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa64853cb8,0x7ffa64853cc8,0x7ffa64853cd86⤵PID:652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2044 /prefetch:26⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:86⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:16⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:16⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:16⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:16⤵PID:6008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:16⤵PID:6016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:16⤵PID:5396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:16⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
PID:5448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,16532106394908213752,14986095263806095195,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:26⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"5⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc22cb4b-d35d-4385-be14-a0fba9c1dac7} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" gpu7⤵PID:3976
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d636ae0f-bd14-41b4-8155-8d3a62370aba} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" socket7⤵PID:2196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3604 -childID 1 -isForBrowser -prefsHandle 2796 -prefMapHandle 3476 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbc68e2d-eb99-4558-b09f-aab38a8a06e0} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab7⤵PID:3700
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3596 -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 3204 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {104ae41b-9416-4f0d-b5e9-27697f54efcd} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab7⤵PID:5632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3412 -childID 3 -isForBrowser -prefsHandle 3380 -prefMapHandle 3328 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f9bdf9b-2340-44c6-931c-71140ca86e57} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab7⤵PID:5644
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2956 -childID 4 -isForBrowser -prefsHandle 2924 -prefMapHandle 2904 -prefsLen 22739 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4737d79f-1b67-4ee8-9109-46754c9cc7c6} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab7⤵PID:5656
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"3⤵PID:5956
-
-
C:\Users\Admin\1000029002\79393a14bf.exe"C:\Users\Admin\1000029002\79393a14bf.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 11764⤵
- Program crash
PID:5680
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000030001\76da9f66bd.exe"C:\Users\Admin\AppData\Local\Temp\1000030001\76da9f66bd.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"5⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\onefile_3588_133667953889062527\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵PID:6008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵PID:4332
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵PID:1820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"7⤵PID:5280
-
C:\Windows\system32\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
PID:2636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""7⤵
- Hide Artifacts: Hidden Files and Directories
PID:4808 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"8⤵
- Views/modifies file attributes
PID:776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""7⤵PID:3312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"7⤵PID:1400
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe8⤵
- Kills process with taskkill
PID:3124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"7⤵PID:1684
-
C:\Windows\system32\tasklist.exetasklist /FO LIST8⤵
- Enumerates processes with tasklist
PID:6000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"7⤵
- Clipboard Data
PID:1436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard8⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:5280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"7⤵PID:2076
-
C:\Windows\system32\chcp.comchcp8⤵PID:4980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"7⤵PID:5728
-
C:\Windows\system32\chcp.comchcp8⤵PID:1848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"7⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4668 -
C:\Windows\system32\netsh.exenetsh wlan show profiles8⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"7⤵
- Network Service Discovery
PID:3992 -
C:\Windows\system32\systeminfo.exesysteminfo8⤵
- Gathers system information
PID:4176
-
-
C:\Windows\system32\HOSTNAME.EXEhostname8⤵PID:6052
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername8⤵
- Collects information from the system
PID:5532
-
-
C:\Windows\system32\net.exenet user8⤵PID:1864
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user9⤵PID:5400
-
-
-
C:\Windows\system32\query.exequery user8⤵PID:5564
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"9⤵PID:2396
-
-
-
C:\Windows\system32\net.exenet localgroup8⤵PID:1244
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup9⤵PID:4716
-
-
-
C:\Windows\system32\net.exenet localgroup administrators8⤵PID:2416
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators9⤵PID:2076
-
-
-
C:\Windows\system32\net.exenet user guest8⤵PID:232
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest9⤵PID:5040
-
-
-
C:\Windows\system32\net.exenet user administrator8⤵PID:2764
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator9⤵PID:3280
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command8⤵PID:1912
-
-
C:\Windows\system32\tasklist.exetasklist /svc8⤵
- Enumerates processes with tasklist
PID:2684
-
-
C:\Windows\system32\ipconfig.exeipconfig /all8⤵
- Gathers network information
PID:3344
-
-
C:\Windows\system32\ROUTE.EXEroute print8⤵PID:388
-
-
C:\Windows\system32\ARP.EXEarp -a8⤵
- Network Service Discovery
PID:2464
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano8⤵
- System Network Connections Discovery
- Gathers network information
PID:2772
-
-
C:\Windows\system32\sc.exesc query type= service state= all8⤵
- Launches sc.exe
PID:4080
-
-
C:\Windows\system32\netsh.exenetsh firewall show state8⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2760
-
-
C:\Windows\system32\netsh.exenetsh firewall show config8⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵PID:3456
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵PID:5444
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵PID:4300
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵PID:6036
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1408 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵PID:3416
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1128
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000003001\343dsxs.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\343dsxs.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵PID:4820
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit7⤵
- System Location Discovery: System Language Discovery
PID:4012 -
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:776
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5268 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:1244
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Users\Admin\AppData\Roaming\uBsBTD3tcf.exe"C:\Users\Admin\AppData\Roaming\uBsBTD3tcf.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3924
-
-
C:\Users\Admin\AppData\Roaming\ZsoCvR1JtO.exe"C:\Users\Admin\AppData\Roaming\ZsoCvR1JtO.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 3886⤵
- Program crash
PID:1888
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5876
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:832
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:3524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6112 -ip 61121⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3492 -ip 34921⤵PID:2276
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD553769c267e2a9e8c343a25ceb485a70f
SHA16c454e54f86ced337a53fcdbae9819440b569f9f
SHA25671aeeec3e80b545c94e6367981165049ffd43b676bed1e40d26f73ceaa8f6c58
SHA5125b9e28f6c077b9aa31df11bd1799e6eb0ea6915101372d2e6ab500bd195f8facea9ca66bd58c15afda52ebcf99eaf54f91c67865a50c37b745751b68fdf30bde
-
Filesize
112KB
MD587210e9e528a4ddb09c6b671937c79c6
SHA13c75314714619f5b55e25769e0985d497f0062f2
SHA256eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.5MB
MD572230d8efc579eaab4852e555f410c00
SHA15650597c7f86092b999b284b9364b083f3a140e8
SHA256fec0c11ef40a4bffb95b80f18e445dfaac26d65650e235bd1f181219823d943c
SHA512a198b9a0a26961d96da5e0d4c0a55ea54ec084306a476c93a9663d5d45eb0b46c75cedffe9613cae993782e242fc737cdca150a018876ec9363ac95fbe1f3fd1
-
Filesize
649B
MD58552cf323955daff3c1b36aaa0fa14f0
SHA1556c00adb628dcced8b22a9ba0c1d8608a65f3a8
SHA256870d9c05ecfca1f43225da9fff02dcf5c763cec1c70e340f97a8482190de08e3
SHA51274622a28b6db2260fe03a13d6f4b330e832e6315413be95f08ffc38a718cd25f1f10e7b78b7c1fd114311fc8c9f052f257421b161050183f58915526ab35b0fd
-
Filesize
264B
MD5b720b111252673dd97dcba5bcbce11b4
SHA187ea9aaa2e5fe0c4a125acda4b2fe92cf90395bd
SHA256f86a153396edaa1fe2fda8964b18f37b793681a73b1b904a8a9260695ff186ec
SHA512c016c2172bd067508938394f1b2bf326783ceeff4a3b1fa763e98f32f77c9e80cb6433a44f6ace80ca892bfe5aa6489014a7842667dbb5e82f1032ccb59195b4
-
Filesize
3KB
MD560f7249a4cc6824c9036a09bc56b549b
SHA1e68c7fbfe591ba6f23f6ff6aba2bd90786cc7cee
SHA2560dd047b34dd8e4f91fdda3148509055c36bff1c6a465e3dd1169bd33b490005f
SHA5123fd48d5de2b7f8cdebc906ee0c5c55a9a0f1556c74427d6d8d26abe8e2ea947c392a741dfdd77f726964a1c3cb29cccb9b51e9cf0285bec6fbd2e92bc0b817ca
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
692B
MD5c558a4144e21c5ec2230034f4479e1f4
SHA125ef5ecd75ce5d7484f7190b7c444bf9dde91f53
SHA2566ba813a224a6cd3ba4c70956e159499cfa6e2ab9f3985038f7f7d5024060e2d5
SHA51248e8b2bbe34554cee9f9a2ab12e38f35ebac1fbf6bd2f993b0e75c520ebf33255020ab7bda5ca0cb9bf55857ef698d39c78915b3eeca997e59d7c5f6d5e07910
-
Filesize
9KB
MD5d5a2f622445c0d97701ec8a7877523d5
SHA18d60f6acbfb25713f09334b73dc317bea75b49bf
SHA256bf31ed0a0f61f92ded8426e5ea58933310aea2c96de900cf74a18774ab7a1bbc
SHA51288731470f26fe4ed84e6dad787f0b3bc433dd9880b1c09dbe83b36b3e123e75023d2192dfb9edfb64bc9942ce5635db371e813110cfd3fd5f9d8bfc6e1608c7a
-
Filesize
9KB
MD57a3bbcc1f647ccba13cab4b864a08136
SHA16f17accdfa19ca417dc5825451f05a817d6fbc40
SHA256efe0bef69ef18ce2ab86dadeab68270e378c717363315ce12d4cf7d064716e7b
SHA5121c3be2cfef8bbdade80cf0527ec99067ace69774d926a72d5788f9a0cd3b5800991f7462e0c64c156508390c5814b1186c37506f043f4d09a57ade797da26fe2
-
Filesize
9KB
MD5e9ac8146ab97053d297b295c3e1ad1b1
SHA11d337a8ca97083d14ee6a083bd6298593b1582c2
SHA2569230bbb6247eb16084ec92be18b1ba81d4891212514c9f024708ae69c68086fe
SHA512986498bf861de1bdebc13e5110f8fc7ba84a2913773e1a15af16307be9afe8051757c2ad9f3ab4fdd3ad3e5c3898762d4a40e9ae1724c8153abf17cebbec4dfa
-
Filesize
9KB
MD52191f41f8875bf923d974fd9453a7601
SHA1a82c4cd90e43897716fd30be60114c382c728d14
SHA25629a5883176296064b939d5aa98b4a99a9302e330bb4feb90bcd0f3e412470fbf
SHA5122388ddcb51b5a4cb3e91b6db4f885ef6baa4936cd2463049db8285f3e67963d50e6189cb176c84def3e158ede4d58404b9eacd1e42158446627cc17c27671a39
-
Filesize
9KB
MD532971d53866d8376ab48abcaed4a01ba
SHA1c8fee92ed0fbbc790dcdec58b0d2ab0952d57efb
SHA2561df65ad92d11b5787e5147df64916dcf63139140626c1332be95c050f534b58a
SHA512071d83d5e1fd82fd1909dea3a6e8c5826db946dea846f4d70d79027a271436d0f5219886b5284f5057938e3eae79d305a55cd943a737d3a1568ebe71625385d2
-
Filesize
9KB
MD5c7fce5dd095d42db18ab54dea96d120d
SHA1c9fe57c8577b322bb0829ce68dda066dd0446291
SHA256a49a9ed50a831bfb985912529a0356d09784767ea916b05aa5fa3207bbc12039
SHA5124d7fe13c1757a4e5266dd81ecb6171b5e770a27404a641418087bfdb63a69141698b98919ea253185fc6ee730c89382c5bb32f2bf1254f557dde72da0cb42c8b
-
Filesize
9KB
MD53f64797e5d80fb4425c17a635537475c
SHA1ed9129cdd93df55412a178689bf7981c48c847ee
SHA256b57cb8b29f7925f76bf80d6d5c88fc4052fddc119cdbfbc34c8426a3df4a5e7b
SHA5126d6a624fb9356e15d65b4c3cad3635a75b570437647c52dc840f882a09cdb340abd6fe300f2bbb946220d3bfebf14cb8e219eff45d16c860877e951b7fe2b540
-
Filesize
15KB
MD5c0cb74c3124ba446d81f812431ea67f0
SHA1b90dfbb57dcc06665dfa5f53a22e8b67fbdea3c6
SHA2564794fc6b21ada97cfd1f1bac8cddfa81598b4a9e2743b2c4aa11fd07f85e2f49
SHA512aa21a40001b74c702219dd063f456e116275d6f8841f0ef066989e5e204bda01274580fe1fe553306bf59163a6684f9299bf53404c3c99495b7ece3dcd8cf895
-
Filesize
189KB
MD57df9446f15ce161b9b14f94e54c64a4f
SHA10de9031b8ebd88fe922b41e76d1834a5b0aba85d
SHA256cdba49265276696c3709ca2cdc96213060ba1df39218a6d536eb93d321ef8a30
SHA5121393f29577bcf8fd7bd098ed442805fc97ef031a4a9a63b2ae0b7d2eb00481113a8dc275b4ac2757097042a6c84876a15a4d27c26f7fc8741dac571912c491c3
-
Filesize
189KB
MD595af426cf36dc391cf0345cf4d8db66f
SHA1d2e81cdccaffd3a8e9295d8b9f44cde17585686c
SHA2569a5094ab5dc9a3f83618e58c03ce07e6ff771b4a2f216dc4888adc1f6e506756
SHA5129d76184657725540b17ef55c2032b3719349ea25b4fba5bac541cd03bfd07705d4ca414732ae311d992dc337bc5b156268f8128ee2fe85a1821bc273bbc62dba
-
Filesize
152B
MD5562b59fd3a3527ef4e850775b15d0836
SHA1ffd14d901f78138fc2eece97c5e258b251bc6752
SHA2560a64863cb40f9d3b13a7b768b62e8b4707dfee1d3e86a07e999acb87bd7d3430
SHA512ef9fd3d83ab85b18cf0e0d17e2c7d71936f783e3ae38005e5c78742560332f88be7c4c936d4dc4179e93fde0240d2882d71ef7038289c8cbddbfc4790c0603c2
-
Filesize
152B
MD5c1ff2a88b65e524450bf7c721960d7db
SHA1382c798fcd7782c424d93262d79e625fcb5f84aa
SHA2562d12365f3666f6e398456f0c441317bc8ad3e7b089feacc14756e2ae87379409
SHA512f19c08edf1416435a7628064d85f89c643c248d0979ece629b882f600956f0d8cd93efbe253fa3ec61ad205233a8804807600f845e53e5ed8949290b80fe42d3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize240B
MD51a1c12fb150cbdde41d314e254b8f9ac
SHA1a7d6df4ebd49464bc86325e8a135cd2b13ad8f11
SHA256b8b07a9bd62f74a7bab81b9fec6ea1f1531db4d6d9c96feef8b3858f9c4b6ae1
SHA512e2f6f5e1fa59d5a0700a6b3eac75815a7e9fd1b8376bb0a90992eb78eb97987325e10de3b80ea82d0123167bbd6aef4ed0ef6149744dfaeebce01086e347a906
-
Filesize
1KB
MD553976440051a30368de0031b853479fb
SHA1095633567fd2e5282ecf0c08a702f3eeb38149c7
SHA25680ba2b934e4ae17c75c40e0fad961173913a3e10b3c31a46f913fcfa4770e046
SHA51242c9efe943d1100d77d7d76ca8cb5435592934d9d3cd6e0d78c8cb70a21062dc91f0e12cc7459da36e1f4a764ed1871efcf02a8bef01401622dfd7c22380c5d4
-
Filesize
5KB
MD54e2e7ebaf0e6fbb6bce6d238654064a4
SHA17b751345bb3d114c8ae558efe2dfcffd34d974cd
SHA256da9148381ac32f461cf766722d234bf8aa7152f82db874e60aab7688c7985a86
SHA51223378218c2cf6499eea52e586a8ac468c85ccd72f594d2652bb1532dd0cdb6f071c7863428ca5012b1251cf87147c5a384365ee2c6c369b235ac8489d9d1c824
-
Filesize
6KB
MD52b3a8bb6ac646397689957df58ff1b58
SHA180ee023c7233ac988fda1151c4b723c8e66bfd5f
SHA256989e0123a32b0dae23cf95a0846678a29d48d6e9ed77d4bafb91086f6508ae8d
SHA512cd71fff3315642deb7e535fcad5af6407406c1f33277fcae2ccf46bd8b06bf7f4e024c7ee62e78074436e07a7d77d16178d0b228ed1c2a9d3c49000009ed8154
-
Filesize
6KB
MD554406ffa814bf5de3a40d0ada3678bde
SHA1e5f25a82198003872fa08bd730d1564906fffed7
SHA25622a1747b7a8e0705cfd14715432fd5ca2fb89226414fc92eb18a2013a173f143
SHA51292fd36f45567f9faf0dadbc8cdf48c109ecfe890fd87f81d10bd54a98e66b4ffde8a1654b43db427f4a8d653b5c5ec6ef2071ef3063fdee6a3b36e480f4de4a1
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5776824201ba93239e2a0d69a75eb809c
SHA1d1976c35f81087c1fe08c8b6434b4d3dae885c17
SHA25632d161b6c1e394da320f70d7dfcf370b30fa1b7a46773301108270e1fc735fae
SHA5125774cdc81951088551ac424fd0f19495f969469dcd781822472ef17b7ec07dbbf3b9023ea2d5914dcadca89f194510c248e4b16d1314711a555802551261d6a5
-
Filesize
1.8MB
MD51dce706f6aced6737a8f262475470bfe
SHA12de45d72a2fea7c89528f5283a9e0a9a0424d26f
SHA2567a96f4f4cd4766c6e7319321aed7c42933e7c84327a1b4d8cae713b5d411353a
SHA512be1ab223a46aae5d3661768a55571b57ba5ff69b4aa09478c11c1f82697387675cc9b5fd9b81ae2fe8a2ca8cd81a9dd867e419d86447c5f592ece98ef13ad70c
-
Filesize
10.7MB
MD5c8cf26425a6ce325035e6da8dfb16c4e
SHA131c2b3a26c05b4bf8dea8718d1df13a0c2be22ee
SHA2569f7be9bf913d8378f094b3f6416db9aa4c80c380000202f7cfaddadb6efc41b4
SHA5120321e48e185c22165ac6429e08afac1ccfdf393249436c8eac8a6d64794b3b399740aa5b2be23d568f57495d17e9220280ed1c2ea8f012b2c4021beb02cbc646
-
Filesize
529KB
MD5d3e3cfe96ef97f2f14c7f7245d8e2cae
SHA136a7efd386eb6e4eea7395cdeb21e4653050ec0c
SHA256519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b
SHA512ee87bcf065f44ad081e0fb2ed5201fefe1f5934c4bbfc1e755214b300aa87e90158df012eec33562dc514111c553887ec9fd7420bfcf7069074a71c9fb6c0620
-
Filesize
413KB
MD57b0a50d5495209fa15500df08a56428f
SHA1ab792139aaa0344213aa558e53fa056d5923b8f0
SHA256d7f591f60eea358649cd97b73296b31a682e22fc5784df440026c3086de3d835
SHA512c1fe0cb875124c9069f01fc3ef44d864ec82cfad49ee733edecd8b9b5e021594937362641aa33d865aa8a3ec376e46162c988906b0cb7bd0666e873988fe3661
-
Filesize
1.4MB
MD504e90b2cf273efb3f6895cfcef1e59ba
SHA179afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA51272aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555
-
Filesize
138KB
MD5826897ca5ccce947f4438b5fe40f474c
SHA1fdd4b4d4becdf6c4b00e839fedfac2c9b28d38c5
SHA25678429d3756f7492ab1edb60fe821386e1c52b13f6ca4fcbea44f8d2d7087370b
SHA512617788d734bdf17b39e3aa25fee94c1545ee20bb247eccf8dd78cdb2ebd2abd6dab32f90c996d3f09d0c2f8bf69e91f5c541e1712e789bd740102c9dd28b4ef5
-
Filesize
304KB
MD5a9a37926c6d3ab63e00b12760fae1e73
SHA1944d6044e111bbad742d06852c3ed2945dc9e051
SHA25627955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97
-
Filesize
89KB
MD5fe8201c151054a291f95acf6d5f4ac43
SHA1b57ad5c2422631ad2ab8941f317985bcfab36a6a
SHA2560b5172279fc60860e1d9c64b34b53db42fbf8fd629f98671cf68fbb4c160c09f
SHA51229e95d94a13090417f8439c04e02495530a14e9d3d02bddb339e84f047d23ca32741b933d479d4d8c04b4e14f816a8c936d604f939f9295e1661c78c95e263c7
-
Filesize
1.8MB
MD5949b0567d960c8a3b4a6360ebdcdadb2
SHA1082be7e0d2e9a6365d8d06148b9006a42bc9f0aa
SHA256e5825ed69e841dff506db64b4b90cb0a3bdc8a7fef677b99fe915152a975f9e0
SHA512e9a867140485c57b185f8876d5a6579ed99bf2dc6ebeafb7edce5e7dd78156c2296b101581ccda018af0efeb776a26c7fdc0f240db453a1dd3b6ba40902742f6
-
Filesize
2KB
MD5de9423d9c334ba3dba7dc874aa7dbc28
SHA1bf38b137b8d780b3d6d62aee03c9d3f73770d638
SHA256a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698
SHA51263f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
177KB
MD5ebb660902937073ec9695ce08900b13d
SHA1881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA25652e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA51219d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
Filesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
C:\Users\Admin\AppData\Local\Temp\onefile_3588_133667953889062527\cryptography\hazmat\bindings\_rust.pyd
Filesize6.9MB
MD5f918173fbdc6e75c93f64784f2c17050
SHA1163ef51d4338b01c3bc03d6729f8e90ae39d8f04
SHA2562c7a31dec06df4eec6b068a0b4b009c8f52ef34ace785c8b584408cb29ce28fd
SHA5125405d5995e97805e68e91e1f191dc5e7910a7f2ba31619eb64aff54877cbd1b3fa08b7a24b411d095edb21877956976777409d3db58d29da32219bf578ce4ef2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
Filesize
18.0MB
MD51cf17408048317fc82265ed6a1c7893d
SHA19bfec40d6eb339c5a6c2ad6e5fa7cebc147654c5
SHA2561352ad9860a42137b096d9675a7b8d578fbc596d965de3cb352619cbe6aaf4e9
SHA51266322d7cb5931017acaa29970da48642d03ce35007f130511b2848b67169c1dd4167f1e5a31e5e1dfe5f7122846482bdb878b5cd695ac58009033fd620813a0f
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\AlternateServices.bin
Filesize8KB
MD570fdcea4b7577069ac1b350de977f52e
SHA1b1ddfc5ea985fd443f0ec88cb114aac4ab780f40
SHA2567945b903d294351afff73d92d371831c5d1cd8ca9a6bbc923097f9ec0be2bd2c
SHA512638ec7e95fa06ab596c562af9fced1172e1ae3a42fc87f5c6a731505ac4b1fc7ac2def09b59e0f0753369f83d1f17dc204dda27a9b91bc4a7d64587b463e1e1d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b0ht3gr0.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
9KB
MD554be9f783c18636f67b3fe4604197d30
SHA14eee9edd1bdb5367fb4705547ec39409f0fd893d
SHA2568f8781a81441a50561a967b58d2024cfd2bf87b934af367b9a5f84ad8fd2b346
SHA512ea6a8a99975076ee357e7a74850c51acc1d0011c8095869ac58c8f6fee867c30a91ac32691a5d5cfafa04efc77e99de75348265fc67d847045ea53013bdbc5ec
-
Filesize
503KB
MD52c2be38fb507206d36dddb3d03096518
SHA1a16edb81610a080096376d998e5ddc3e4b54bbd6
SHA2560c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e
SHA512e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316
-
Filesize
510KB
MD574e358f24a40f37c8ffd7fa40d98683a
SHA17a330075e6ea3d871eaeefcecdeb1d2feb2fc202
SHA2560928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6
SHA5121525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf
-
Filesize
2KB
MD5db60b3a6694e48e31736faa1b2648f35
SHA108f970e84e71059c9ec47b0ca650b9a558ca23f3
SHA256428e4b833e7738a4459d3250616005843af7efbb683a478a35a82a4e6d578800
SHA5122ffbf2235484ae6a3255037cd7a1ff8e722dfef7675467b9b0020758ccf6bfbfd4254e0f554997910fa339ce687320fcc12cd89b762f1ecf7f1cb5f455022700
-
Filesize
2KB
MD573cb17d01b3c2071dba6f331048cee95
SHA15b3554e8e0b7bc910f03ca370ce393f6f9cd8f30
SHA256170906b5554614f5057e3e067b7c8466b2a28c46842a6b01cb1f01ef1703aa2a
SHA512093fb3f48e4aa5c920a3ffb9e0d6cb189e7b09b1bd28a207f84f9b5215de176e4bfbffd0b06bcdf9406fa8032f6b45892c895304c7ab7da5a843ac859181c1d0