Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe
Resource
win10v2004-20240802-en
General
-
Target
29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe
-
Size
1.8MB
-
MD5
9ca88a66e64760c3338dc5c1928c80be
-
SHA1
5ae47c67c6b046a6e807dddb6178dbfad43c888e
-
SHA256
29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910
-
SHA512
b666767bc65801202abb4ff5a2a25f9d720b7b0f65c9207384adf6e0c095964b1c9cee14780f9ea1ced8dc55053a128e59fae34164b5662539a7990d05e02fb3
-
SSDEEP
49152:uoFhH1etnXQLvIg/IuLfuc15xGq/sZgRvDS9nPk3UrQ:xhVetALvI3uSc1iXeRvGxs
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.163.21:29257
Extracted
redline
@CLOUDYTTEAM
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
62.113.117.95:4449
hwelcvbupaqfzors
-
delay
10
-
install
false
-
install_folder
%AppData%
Extracted
amadey
4.41
a51500
http://api.garageserviceoperation.com
-
install_dir
0cf505a27f
-
install_file
ednfovi.exe
-
strings_key
0044a8b8e295529eaf3743c9bc3171d2
-
url_paths
/CoreOPT/index.php
Signatures
-
Detects ZharkBot payload 1 IoCs
ZharkBot is a botnet written C++.
resource yara_rule behavioral2/files/0x00090000000234cb-446.dat zharkcore -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral2/memory/2352-44-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral2/files/0x0007000000023471-114.dat family_redline behavioral2/memory/2272-122-0x00000000006F0000-0x0000000000742000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 4004 created 3496 4004 Beijing.pif 56 PID 4004 created 3496 4004 Beijing.pif 56 -
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x00070000000234a6-356.dat family_asyncrat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3d8c52e5b6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 135 2416 cmd.exe 136 2416 cmd.exe 138 2416 cmd.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 6096 powershell.exe 5760 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3d8c52e5b6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3d8c52e5b6.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation contorax.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Hkbsse.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation runtime.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Beijing.pif Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation exbuild.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation build2.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation axplong.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url cmd.exe -
Executes dropped EXE 34 IoCs
pid Process 1856 axplong.exe 3964 GOLD.exe 2180 crypteda.exe 4156 ygk4RZvubb.exe 2272 Y9UvgsJYOn.exe 412 setup2.exe 1716 axplong.exe 3964 stealc_default2.exe 464 Set-up.exe 3204 runtime.exe 4004 Beijing.pif 4184 XClient_protected.exe 2772 BitcoinCore.exe 2416 whiteheroin.exe 1656 kitty.exe 4552 build2.exe 2076 contorax.exe 3296 winmsbt.exe 4808 3546345.exe 3720 meta.exe 1204 GOLD.exe 4784 crypteda.exe 2672 LrNUfdgNLn.exe 2884 IFyt1Dfy19.exe 3060 exbuild.exe 4080 Hkbsse.exe 5528 axplong.exe 5540 Hkbsse.exe 5584 Hkbsse.exe 5872 3d8c52e5b6.exe 6080 Office2024.exe 5756 rzyyvjydedax.exe 1148 Channel1.exe 5368 axplong.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine 3d8c52e5b6.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine axplong.exe -
Loads dropped DLL 3 IoCs
pid Process 3964 stealc_default2.exe 3964 stealc_default2.exe 2416 whiteheroin.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Subsystem Framework = "\"C:\\ProgramData\\Microsoft Subsystem Framework\\winmsbt.exe\"" winmsbt.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 87 pastebin.com 88 pastebin.com 136 pastebin.com -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 5428 powercfg.exe 2652 powercfg.exe 5548 powercfg.exe 216 powercfg.exe 4444 powercfg.exe 4720 powercfg.exe 3124 powercfg.exe 5484 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe Office2024.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe rzyyvjydedax.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3060 tasklist.exe 3720 tasklist.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 412 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe 1856 axplong.exe 1716 axplong.exe 5528 axplong.exe 5872 3d8c52e5b6.exe 5368 axplong.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 3964 set thread context of 2352 3964 GOLD.exe 92 PID 2180 set thread context of 2072 2180 crypteda.exe 97 PID 2416 set thread context of 4560 2416 whiteheroin.exe 144 PID 1204 set thread context of 3892 1204 GOLD.exe 157 PID 3720 set thread context of 1344 3720 meta.exe 158 PID 4784 set thread context of 3444 4784 crypteda.exe 164 PID 5756 set thread context of 4128 5756 rzyyvjydedax.exe 274 PID 5756 set thread context of 2416 5756 rzyyvjydedax.exe 278 -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\TreeProfessor runtime.exe File opened for modification C:\Windows\HostelGalleries runtime.exe File created C:\Windows\Tasks\Hkbsse.job build2.exe File created C:\Windows\Tasks\axplong.job 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe File opened for modification C:\Windows\EquationExplorer runtime.exe File opened for modification C:\Windows\ConfiguringUps runtime.exe File opened for modification C:\Windows\ExplorerProprietary runtime.exe File created C:\Windows\Tasks\Hkbsse.job exbuild.exe File opened for modification C:\Windows\ChestAntique runtime.exe File opened for modification C:\Windows\SysOrleans runtime.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5288 sc.exe 5988 sc.exe 6028 sc.exe 5732 sc.exe 6072 sc.exe 2092 sc.exe 2520 sc.exe 4640 sc.exe 5364 sc.exe 5400 sc.exe 5724 sc.exe 3696 sc.exe 5608 sc.exe 5700 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 27 IoCs
pid pid_target Process procid_target 4056 412 WerFault.exe 102 4836 464 WerFault.exe 111 3108 1656 WerFault.exe 145 4116 4552 WerFault.exe 148 2180 4552 WerFault.exe 148 2756 4552 WerFault.exe 148 5180 4552 WerFault.exe 148 5224 4552 WerFault.exe 148 5308 4552 WerFault.exe 148 5368 4552 WerFault.exe 148 5428 4552 WerFault.exe 148 5492 4552 WerFault.exe 148 5720 4552 WerFault.exe 148 2180 5540 WerFault.exe 189 5172 5540 WerFault.exe 189 5380 5540 WerFault.exe 189 2652 5584 WerFault.exe 190 5496 5540 WerFault.exe 189 5384 5540 WerFault.exe 189 5652 5540 WerFault.exe 189 5704 5540 WerFault.exe 189 5340 5540 WerFault.exe 189 5756 5540 WerFault.exe 189 1104 5540 WerFault.exe 189 4396 5540 WerFault.exe 189 5820 5540 WerFault.exe 189 5376 1148 WerFault.exe 256 -
System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runtime.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3546345.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Y9UvgsJYOn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Beijing.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language whiteheroin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFyt1Dfy19.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d8c52e5b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ygk4RZvubb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LrNUfdgNLn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Set-up.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kitty.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Channel1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language exbuild.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup2.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Channel1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Channel1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe -
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs cmd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs cmd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT cmd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates cmd.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3148 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 412 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe 412 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe 1856 axplong.exe 1856 axplong.exe 1716 axplong.exe 1716 axplong.exe 3964 stealc_default2.exe 3964 stealc_default2.exe 4156 ygk4RZvubb.exe 4156 ygk4RZvubb.exe 2272 Y9UvgsJYOn.exe 2272 Y9UvgsJYOn.exe 2272 Y9UvgsJYOn.exe 2272 Y9UvgsJYOn.exe 2352 RegAsm.exe 2352 RegAsm.exe 3964 stealc_default2.exe 3964 stealc_default2.exe 2272 Y9UvgsJYOn.exe 2272 Y9UvgsJYOn.exe 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 2352 RegAsm.exe 4184 XClient_protected.exe 4184 XClient_protected.exe 4184 XClient_protected.exe 4184 XClient_protected.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4156 ygk4RZvubb.exe Token: SeBackupPrivilege 4156 ygk4RZvubb.exe Token: SeSecurityPrivilege 4156 ygk4RZvubb.exe Token: SeSecurityPrivilege 4156 ygk4RZvubb.exe Token: SeSecurityPrivilege 4156 ygk4RZvubb.exe Token: SeSecurityPrivilege 4156 ygk4RZvubb.exe Token: SeDebugPrivilege 2352 RegAsm.exe Token: SeDebugPrivilege 2272 Y9UvgsJYOn.exe Token: SeDebugPrivilege 3060 tasklist.exe Token: SeDebugPrivilege 3720 tasklist.exe Token: SeDebugPrivilege 4184 XClient_protected.exe Token: SeDebugPrivilege 4560 MSBuild.exe Token: SeBackupPrivilege 4560 MSBuild.exe Token: SeSecurityPrivilege 4560 MSBuild.exe Token: SeSecurityPrivilege 4560 MSBuild.exe Token: SeSecurityPrivilege 4560 MSBuild.exe Token: SeSecurityPrivilege 4560 MSBuild.exe Token: SeDebugPrivilege 2076 contorax.exe Token: SeDebugPrivilege 3296 winmsbt.exe Token: SeDebugPrivilege 3720 meta.exe Token: SeDebugPrivilege 1344 regasm.exe Token: SeBackupPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeDebugPrivilege 2672 LrNUfdgNLn.exe Token: SeBackupPrivilege 2672 LrNUfdgNLn.exe Token: SeSecurityPrivilege 2672 LrNUfdgNLn.exe Token: SeSecurityPrivilege 2672 LrNUfdgNLn.exe Token: SeSecurityPrivilege 2672 LrNUfdgNLn.exe Token: SeSecurityPrivilege 2672 LrNUfdgNLn.exe Token: SeDebugPrivilege 3892 RegAsm.exe Token: SeBackupPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeBackupPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeSecurityPrivilege 1344 regasm.exe Token: SeDebugPrivilege 2884 IFyt1Dfy19.exe Token: SeDebugPrivilege 6096 powershell.exe Token: SeShutdownPrivilege 5428 powercfg.exe Token: SeCreatePagefilePrivilege 5428 powercfg.exe Token: SeShutdownPrivilege 5548 powercfg.exe Token: SeCreatePagefilePrivilege 5548 powercfg.exe Token: SeShutdownPrivilege 2652 powercfg.exe Token: SeCreatePagefilePrivilege 2652 powercfg.exe Token: SeShutdownPrivilege 5484 powercfg.exe Token: SeCreatePagefilePrivilege 5484 powercfg.exe Token: SeDebugPrivilege 5760 powershell.exe Token: SeShutdownPrivilege 216 powercfg.exe Token: SeCreatePagefilePrivilege 216 powercfg.exe Token: SeLockMemoryPrivilege 2416 cmd.exe Token: SeShutdownPrivilege 4720 powercfg.exe Token: SeCreatePagefilePrivilege 4720 powercfg.exe Token: SeShutdownPrivilege 4444 powercfg.exe Token: SeCreatePagefilePrivilege 4444 powercfg.exe Token: SeShutdownPrivilege 3124 powercfg.exe Token: SeCreatePagefilePrivilege 3124 powercfg.exe Token: SeBackupPrivilege 1344 regasm.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 412 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 2076 contorax.exe 3296 winmsbt.exe 4552 build2.exe 3296 winmsbt.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 4004 Beijing.pif 4004 Beijing.pif 4004 Beijing.pif 2076 contorax.exe 3296 winmsbt.exe 3296 winmsbt.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4184 XClient_protected.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 1856 412 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe 89 PID 412 wrote to memory of 1856 412 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe 89 PID 412 wrote to memory of 1856 412 29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe 89 PID 1856 wrote to memory of 3964 1856 axplong.exe 91 PID 1856 wrote to memory of 3964 1856 axplong.exe 91 PID 1856 wrote to memory of 3964 1856 axplong.exe 91 PID 3964 wrote to memory of 2352 3964 GOLD.exe 92 PID 3964 wrote to memory of 2352 3964 GOLD.exe 92 PID 3964 wrote to memory of 2352 3964 GOLD.exe 92 PID 3964 wrote to memory of 2352 3964 GOLD.exe 92 PID 3964 wrote to memory of 2352 3964 GOLD.exe 92 PID 3964 wrote to memory of 2352 3964 GOLD.exe 92 PID 3964 wrote to memory of 2352 3964 GOLD.exe 92 PID 3964 wrote to memory of 2352 3964 GOLD.exe 92 PID 1856 wrote to memory of 2180 1856 axplong.exe 95 PID 1856 wrote to memory of 2180 1856 axplong.exe 95 PID 1856 wrote to memory of 2180 1856 axplong.exe 95 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2180 wrote to memory of 2072 2180 crypteda.exe 97 PID 2072 wrote to memory of 4156 2072 RegAsm.exe 99 PID 2072 wrote to memory of 4156 2072 RegAsm.exe 99 PID 2072 wrote to memory of 4156 2072 RegAsm.exe 99 PID 2072 wrote to memory of 2272 2072 RegAsm.exe 100 PID 2072 wrote to memory of 2272 2072 RegAsm.exe 100 PID 2072 wrote to memory of 2272 2072 RegAsm.exe 100 PID 1856 wrote to memory of 412 1856 axplong.exe 102 PID 1856 wrote to memory of 412 1856 axplong.exe 102 PID 1856 wrote to memory of 412 1856 axplong.exe 102 PID 1856 wrote to memory of 3964 1856 axplong.exe 107 PID 1856 wrote to memory of 3964 1856 axplong.exe 107 PID 1856 wrote to memory of 3964 1856 axplong.exe 107 PID 1856 wrote to memory of 464 1856 axplong.exe 111 PID 1856 wrote to memory of 464 1856 axplong.exe 111 PID 1856 wrote to memory of 464 1856 axplong.exe 111 PID 1856 wrote to memory of 3204 1856 axplong.exe 112 PID 1856 wrote to memory of 3204 1856 axplong.exe 112 PID 1856 wrote to memory of 3204 1856 axplong.exe 112 PID 3204 wrote to memory of 2268 3204 runtime.exe 113 PID 3204 wrote to memory of 2268 3204 runtime.exe 113 PID 3204 wrote to memory of 2268 3204 runtime.exe 113 PID 2268 wrote to memory of 3060 2268 cmd.exe 115 PID 2268 wrote to memory of 3060 2268 cmd.exe 115 PID 2268 wrote to memory of 3060 2268 cmd.exe 115 PID 2268 wrote to memory of 3660 2268 cmd.exe 116 PID 2268 wrote to memory of 3660 2268 cmd.exe 116 PID 2268 wrote to memory of 3660 2268 cmd.exe 116 PID 2268 wrote to memory of 3720 2268 cmd.exe 117 PID 2268 wrote to memory of 3720 2268 cmd.exe 117 PID 2268 wrote to memory of 3720 2268 cmd.exe 117 PID 2268 wrote to memory of 2008 2268 cmd.exe 118 PID 2268 wrote to memory of 2008 2268 cmd.exe 118 PID 2268 wrote to memory of 2008 2268 cmd.exe 118 PID 2268 wrote to memory of 2156 2268 cmd.exe 119 PID 2268 wrote to memory of 2156 2268 cmd.exe 119 PID 2268 wrote to memory of 2156 2268 cmd.exe 119 PID 2268 wrote to memory of 4456 2268 cmd.exe 120
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe"C:\Users\Admin\AppData\Local\Temp\29db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Roaming\ygk4RZvubb.exe"C:\Users\Admin\AppData\Roaming\ygk4RZvubb.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
C:\Users\Admin\AppData\Roaming\Y9UvgsJYOn.exe"C:\Users\Admin\AppData\Roaming\Y9UvgsJYOn.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\setup2.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\setup2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 3525⤵
- Program crash
PID:4056
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3964
-
-
C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 9565⤵
- Program crash
PID:4836
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3660
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2008
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 403656⤵
- System Location Discovery: System Language Discovery
PID:2156
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "HopeBuildersGeniusIslam" Sonic6⤵
- System Location Discovery: System Language Discovery
PID:4456
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Mr + ..\Minister + ..\Template + ..\Dietary + ..\Speak + ..\Mobile + ..\Zinc + ..\Continue s6⤵
- System Location Discovery: System Language Discovery
PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\40365\Beijing.pifBeijing.pif s6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\1000064001\kitty.exe"C:\Users\Admin\AppData\Local\Temp\1000064001\kitty.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1656 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 4928⤵
- Program crash
PID:3108
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000142101\build2.exe"C:\Users\Admin\AppData\Local\Temp\1000142101\build2.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 7528⤵
- Program crash
PID:4116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 7768⤵
- Program crash
PID:2180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 8688⤵
- Program crash
PID:2756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 8768⤵
- Program crash
PID:5180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 8808⤵
- Program crash
PID:5224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 9408⤵
- Program crash
PID:5308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 11248⤵
- Program crash
PID:5368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 11328⤵
- Program crash
PID:5428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 12008⤵
- Program crash
PID:5492
-
-
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe"8⤵
- Executes dropped EXE
PID:5584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 4409⤵
- Program crash
PID:2652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 7848⤵
- Program crash
PID:5720
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe"C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2076 -
C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3296
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe"C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4808
-
-
C:\Users\Admin\AppData\Local\Temp\1000194001\meta.exe"C:\Users\Admin\AppData\Local\Temp\1000194001\meta.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3720 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"8⤵PID:3776
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"8⤵PID:3680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000219001\GOLD.exe"C:\Users\Admin\AppData\Local\Temp\1000219001\GOLD.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4784 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵PID:4116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵PID:4888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Users\Admin\AppData\Roaming\LrNUfdgNLn.exe"C:\Users\Admin\AppData\Roaming\LrNUfdgNLn.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Users\Admin\AppData\Roaming\IFyt1Dfy19.exe"C:\Users\Admin\AppData\Roaming\IFyt1Dfy19.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe"C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\1000004001\Office2024.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\Office2024.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6080 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart10⤵PID:2780
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart11⤵PID:4836
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc10⤵
- Launches sc.exe
PID:3696
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc10⤵
- Launches sc.exe
PID:4640
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv10⤵
- Launches sc.exe
PID:5288
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits10⤵
- Launches sc.exe
PID:5364
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc10⤵
- Launches sc.exe
PID:5400
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 010⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5484
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 010⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5428
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 010⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 010⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5548
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QKJNEQWA"10⤵
- Launches sc.exe
PID:5608
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"10⤵
- Launches sc.exe
PID:5700
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog10⤵
- Launches sc.exe
PID:5724
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QKJNEQWA"10⤵
- Launches sc.exe
PID:5732
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000223001\3d8c52e5b6.exe"C:\Users\Admin\AppData\Local\Temp\1000223001\3d8c52e5b6.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5872
-
-
C:\Users\Admin\AppData\Local\Temp\1000235001\Channel1.exe"C:\Users\Admin\AppData\Local\Temp\1000235001\Channel1.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1148 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 6928⤵
- Program crash
PID:5376
-
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
PID:552
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000190001\XClient_protected.exe"C:\Users\Admin\AppData\Local\Temp\1000190001\XClient_protected.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"4⤵
- Executes dropped EXE
PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\1000192001\whiteheroin.exe"C:\Users\Admin\AppData\Local\Temp\1000192001\whiteheroin.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3148
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & echo URL="C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 412 -ip 4121⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 464 -ip 4641⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1656 -ip 16561⤵PID:2160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4552 -ip 45521⤵PID:3820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4552 -ip 45521⤵PID:4640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4552 -ip 45521⤵PID:3908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4552 -ip 45521⤵PID:5152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4552 -ip 45521⤵PID:5208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4552 -ip 45521⤵PID:5288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4552 -ip 45521⤵PID:5348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4552 -ip 45521⤵PID:5408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4552 -ip 45521⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5528
-
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 5562⤵
- Program crash
PID:2180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 6002⤵
- Program crash
PID:5172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 6082⤵
- Program crash
PID:5380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 8242⤵
- Program crash
PID:5496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 8562⤵
- Program crash
PID:5384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 8922⤵
- Program crash
PID:5652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 9322⤵
- Program crash
PID:5704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 9642⤵
- Program crash
PID:5340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 9722⤵
- Program crash
PID:5756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 11002⤵
- Program crash
PID:1104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 11402⤵
- Program crash
PID:4396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 13242⤵
- Program crash
PID:5820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4552 -ip 45521⤵PID:5592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5540 -ip 55401⤵PID:5316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5540 -ip 55401⤵PID:5140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5540 -ip 55401⤵PID:5396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5584 -ip 55841⤵PID:5420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5540 -ip 55401⤵PID:5508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5540 -ip 55401⤵PID:5536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5540 -ip 55401⤵PID:5632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5540 -ip 55401⤵PID:5680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5540 -ip 55401⤵PID:5724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5540 -ip 55401⤵PID:5344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5540 -ip 55401⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5540 -ip 55401⤵PID:5792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5540 -ip 55401⤵PID:2752
-
C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exeC:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:5756 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:1992
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:6044
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:6072
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2092
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:5988
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2520
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:6028
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4128
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Blocklisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1148 -ip 11481⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5368
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
42B
MD584cfdb4b995b1dbf543b26b86c863adc
SHA1d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA256d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
SHA512485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
-
Filesize
2KB
MD5e34b053c93dcb4160094249280888117
SHA1bd7cd93042c200c5fb012bccf3cd9f72d7e79cef
SHA2562bc71ddd63acfb9d101892e29033c75b4023727e1cadc489ecb2421c1960eaa8
SHA512f8753ec3f9f413e1fac84caa1905509a978dfc63211dcd0a889a4283840ae2e6e9101e1f7ee7d582acc5e0ae722fdab8f6047aa02cee28869a094b4f494897f2
-
Filesize
323KB
MD5d6fca3cd57293390ccf9d2bc83662dda
SHA194496d01aa91e981846299eeac5631ab8b8c4a93
SHA25674e0bf30c9107fa716920c878521037db3ca4eeda5c14d745a2459eb14d1190e
SHA5123990a61000c7dad33e75ce1ca670f5a7b66c0ce1215997dccfca5d4163fedfc7b736bca01c2f1064b0c780eccb039dd0de6be001c87399c1d69da0f456db2a8e
-
Filesize
2.7MB
MD5df92abd264b50c9f069246a6e65453f0
SHA1f5025a44910ceddf26fb3fffb5da28ea93ee1a20
SHA256bc7d010eb971dbc9cbeedc543f93bb1b6924d57597e213dbe10c2c1efd8d0296
SHA512a3f48831efa65cea6a2cf313f698b59d84119023196e11b1266d937a5b4c05aa4aab67c6d40450bef5c9245b46316980906fa73196d892f2880abc2b1b863455
-
Filesize
1.1MB
MD58e74497aff3b9d2ddb7e7f819dfc69ba
SHA11d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA5129aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97
-
Filesize
350KB
MD5d78d85135f584e455f692923d9feb804
SHA17bf6d4d00326ecfa3e48644896d3407ab473a9d5
SHA25641582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404
SHA5121fb4e040511f3bbf8c04459942d1a5915b5f8fe78dd169b932e04dc7ccdb227aee42327a8071136b27a368f2fe8b8b5de3c9187d4b3cc5354cbba0a1d89d26bb
-
Filesize
319KB
MD50ec1f7cc17b6402cd2df150e0e5e92ca
SHA18405b9bf28accb6f1907fbe28d2536da4fba9fc9
SHA2564c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4
SHA5127caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
6.3MB
MD5ee1442544088c8a6ac94e0a849cbcce2
SHA1e66fcd37d0a4abc6168a15eec6213b22491dc5f3
SHA256544771f1f73c63161ae6a231ff4ee4a4109882f331d0f8b627ccadcd64c3dd41
SHA51229d662ef64951ea1140e481960b93703f94b69519006b2a214ce8c371290accf0c2b4b83b4ed5db0f05b77309b4a8cd0c4d25eb1635f9a6f8c025297538ba2b5
-
Filesize
481KB
MD5f9a4f6684d1bf48406a42921aebc1596
SHA1c9186ff53de4724ede20c6485136b4b2072bb6a6
SHA256e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042
SHA51267294a47dfef6aba404939497c403f93318841e9c5ee28b706f7506b5dff2630381e28e86f6dcbfdff2427092a515db1dc0a04e334e7f8de8b0b682269ff88fd
-
Filesize
1.1MB
MD57adfc6a2e7a5daa59d291b6e434a59f3
SHA1e21ef8be7b78912bed36121404270e5597a3fe25
SHA256fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
SHA51230f56bd75fe83e8fb60a816c1a0322bc686863d7ab17a763fff977a88f5582c356b4fcfe7c0c9e3e5925bfee7fc44e4ea8b96f82a011ed5e7cd236253187181b
-
Filesize
102KB
MD5771b8e84ba4f0215298d9dadfe5a10bf
SHA10f5e4c440cd2e7b7d97723424ba9c56339036151
SHA2563f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0
SHA5122814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164
-
Filesize
2.7MB
MD5fd2defc436fc7960d6501a01c91d893e
SHA15faa092857c3c892eab49e7c0e5ac12d50bce506
SHA256ba13da01c41fa50ec5e340061973bc912b1f41cd1f96a7cae5d40afc00ff7945
SHA5129a3e1f2dc5104d8636dc27af4c0f46bdb153fcfada98831b5af95eeb09bb7ef3c7e19927d8f06884a6837e10889380645b6138644f0c08b9cb2e59453041ec42
-
Filesize
157B
MD5f37047396ee6e74238979c49846279fa
SHA15b7da2b0bcb3f843d7692fdb947d4f83a2021ba9
SHA25628054dc9c5ce60d0a4e689140103fbf249dd04512cf49170b0f9264993325e98
SHA5120e866b927b07ce31fc39498ead3d553d19d0c5e6cc02264e54c5f17dbbbb54016463f01b75f11200500e266a758144babada67140bd06919bc554ab2366bdd15
-
Filesize
111KB
MD5c27417453090d3cf9a3884b503d22c49
SHA117938ece6999bc94d651743063c3f989e38547b4
SHA256d330b3cec745ce7bf9856e3cdce277a52fe7ad09874d519fa7b9b080a61a7407
SHA51227d115974702510f9ef7eb841d359764197429ed9d233f98facec317fdaa8b4ec4e481103d8b950ee2f10711280e7296457107d928603af2174b586233abb443
-
Filesize
10.0MB
MD5304a5a222857d412cdd4effbb1ec170e
SHA134924c42524ca8e7fcc1fc604626d9c5f277dba2
SHA256d67fb52973c445a3488a9d6a9a9ff3ebebb05b1c0e853cebfa8bba1a5953f0d6
SHA512208b39436b520e909eb8262f68314dcb93852ea5f00a1d4ce8bd682dd5e20ad313e65ff293c8062bfed95ffe101f6ead3d7da4886e779031101329a3764b855f
-
Filesize
729KB
MD5ca0a3f23c4743c84b5978306a4491f6f
SHA158cf2b0555271badc3802e658569031666cb7d7e
SHA256944113e85a7cf29d41fbbb30f87ea2554d036448a0bdb1e4e2b2ade3f99a9359
SHA5129767f2afbe92eddc46a5654f7f8d6eb10da305df5b009d7407ba9822e5d0f9cc374728900e5ebed15e9849f155a77f44d96f16b4bcca650a42257bdca7f29cbd
-
Filesize
2.7MB
MD53aace51d76b16a60e94636150bd1137e
SHA1f6f1e069df72735cb940058ddfb7144166f8489b
SHA256b51004463e8cdfe74c593f1d3e883ff20d53ad6081de7bf46bb3837b86975955
SHA51295fb1f22ed9454911bfca8ada4c8d0a6cf402de3324b133e1c70afaa272a5b5a54302a0d1eb221999da9343ba90b3cac0b2daecf1879d0b9b40857330a0d0f4e
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
1.8MB
MD593e485e746f5dfe5034d50a2a4a62f78
SHA17a54aad18a8e9ca3d36d0b229d9be82280c437ae
SHA256d07c0460b855edb6d5e38d17281ed96f37264c77178106fd2956e69d2e2b5d9c
SHA512cb3f4841ad888b08bcd5053b0bb12ec9ad0c0316d8a5c5fc0c80f1e817cead082ec661bb8af49744f69bb313e2e53d5531237c85cc873d46524b3755f2958f1e
-
Filesize
17B
MD5c965aa525ae4cfbc3b45c6b7e9271a59
SHA13a84d4c1c9277173b530263107af4caf1f61213f
SHA25650ea6c698e72e13b8132b66bbca9479b7f4815ebb2f8adb3ca1cfec79523107e
SHA512bfddf9f5cb766b20f564b6a94048d1779431794b02cbd0993f4f3554b46b1a4e17bd3def58200da665fd991d1480b22992181ef543413d8013a19889484c3f1c
-
Filesize
6.3MB
MD564b0e365519bfe5ee9b12ec6bfd341de
SHA169026f5a65e5f78adfd243b3ff0a62252270fc1e
SHA25672cd0a37629c770f970c56a65cbd68728ed7e5f358feb5ec514151b0e8bfa734
SHA5128789b0c501eed8d29985a84da8d7d5287d81ac89c76876faf365dfe044b6ff083da0909f82a1416692a3e8d13ccc6270d30a41e205c3257c86262a15fdb34f9d
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
554KB
MD530ab54ae1c615436d881fc336c264fef
SHA17e2a049923d49ae5859d2a0aa3a7dd092e672bd1
SHA256ff64ae2a70b07eba7678241a8fa20f3569a03cc5cdc087306a4451acd97ee2db
SHA5121af06fd6d67c59df3a32fbc4c12e8788f5e3b46a1ca2e1ddc8bc9926d1bacb0b702f2d88e950fc04145d3b904e60e8910acf6fc0f87bd676459b10fc25707be9
-
Filesize
1.8MB
MD59ca88a66e64760c3338dc5c1928c80be
SHA15ae47c67c6b046a6e807dddb6178dbfad43c888e
SHA25629db4d6bce2297d878cfef9b5ffc452dc7299a25b53219fa215cce7f7bdd3910
SHA512b666767bc65801202abb4ff5a2a25f9d720b7b0f65c9207384adf6e0c095964b1c9cee14780f9ea1ced8dc55053a128e59fae34164b5662539a7990d05e02fb3
-
Filesize
76KB
MD5b49981b596333f3f9b18bb360d7185b9
SHA17806ed06bd3ed01b97216b9e9669a527134b543c
SHA256e19cb0dc66d800a279554f4aa4ecc679eb7c12632a3250367d3e62ae551db27f
SHA512fcc0ac65b352ede8a7905c044449a673c0a3cc5ae5b1d20b8012ad7dfdf1095fb210089ce783feabe7f852c4dce3d62b50dec3c9fb47c2a090cbf35e0d58b245
-
Filesize
31KB
MD56184a8fc79d602bc18c0badb08598580
SHA1de3a273e7020d43729044e41272c301118cc3641
SHA256a8181f349864c6c9a216935894392b75d0d1430d43a255ff3a9ad56c325487e7
SHA51241687b30ecd957eb1b6d332133f1c1d7e01cc1c8bf56526dfa20de3937ed549133e93872380e3b51b63b33134c62d4df91c7e08e908ca18b3e6f9d52e89378cb
-
Filesize
14KB
MD52226738a67da04cef580c99f70b9a514
SHA148bbfbfdce94231ebc1833b87ff6e79aa716e3b4
SHA256e04a1b86ce1a5352f7c3a5ddb8b500993f4342ef4e188ed156009e5271795af1
SHA512c653aafd3aa2d320eef1d5b9cf9e58372e778c41147c3d85bcb6e231c8703d19f410ebb2f58f2a9f0671f027fce2baeeec70252e926bb9880128ba6dcedfdb08
-
Filesize
871KB
MD57eb7312237cf8653a876136046ce8b3e
SHA1250d61e72b9a6d0d436e04b569459bb69bb2ab9e
SHA256fa349d460b066e9b325db200251ae35892353462c352728cfb0fa405c293f725
SHA512778fbbec7cd5c9d2aa3623f73604fd7a6e98d3673b50ab7e8ac54c8aa3d955c103d7cdc0838e00f256ade000c979860bf54d3d2b36dd3dcd4fe8fca9f1c82699
-
Filesize
89KB
MD530a3ed3849e36b4c26a02cf030ea985a
SHA1d3d29d3ba2c033d0abb6105cd274001e65d07f4e
SHA2566d86469ced96b57db84de11f9eac77c8076a3bfa65942776f7cc50625fbd31ca
SHA512158aabac6f79393a2a7faed30693f78191bf97771a6125229873abedceef71d5df7d5bb934fdfa1ff4c683df49a158e5ba3efea9a4dd10dce8ba24b3c4fc507d
-
Filesize
98KB
MD597dd60ac57e3f1873f3120688d47cd3d
SHA1e8941900dac0dd9b9ac4b7a08d3ace40c3cc9736
SHA256526b6cbf430fc40eb8d23cd2c4ee1c81e04a2c9e01167370527f19465f67c452
SHA512831eb3f1bd352173db735e4f5e2a4c9380006e3146ecd466b415d7ef7e2c0a345b4da0ebc0415043a9599859e2fb2a131e8d3fc5012d1ccc7473b0ebd4fd076a
-
Filesize
76KB
MD5b81b3a6c6725be1cdd528e5fb3a9aa07
SHA1069d5fd30b48bf5345d21c2af0106325e9372c8f
SHA25608e8e54417a8e7007aeedb0399f4e549fc31aaf6031416c8d30306fe350c1f84
SHA5127a04ee23c0b3d832fa518390253c0153829e7ab0907209dc67c5eae687ad648ab18aa7d064e544c1da3b03cc610ed10fe63a73fc5aaa129402a561843aa975e2
-
Filesize
86KB
MD50c3f23378f256b116fca366d08dbd146
SHA1c6c92667dea09b7a4b2b00193ee043278854db1e
SHA2565defb1b1225282e2ab46d4257416334b5344e5b0a020b4b7900436c59684de65
SHA5120db03b484ce0849bd005ec962e69fea3f8b728739e622ad57519e9411d5257026938b9eb8db050bb355a624f34b19bfe0e0fb8af888bab99d4febb5ec89381f3
-
Filesize
982B
MD51b5bba21607d9a9c3293ff564ecf4f1a
SHA1de790d57fbfae12e649bf65fd9695e36a266696a
SHA256fc6ba37a8bfe546d8186e92c2f729080b00d4371ef2e8e3a18ec66acc1cf199e
SHA512b9e23dd79986397c9fe5c1ac150c60c8993f89488645f06e0865abb2491dc3b9949867753d76cab34352445459601c339a6f78ff8b48323951638f9666d6a74a
-
Filesize
55KB
MD50e16cafd2403c552149e325d90637d12
SHA1efe1e6af41751ca9978c3a21c82ef135a8846f21
SHA25693ddbcd9109129656049162e3f6a8d9fffdc5a3da262e0a2bf2bc4624014f7b0
SHA5120251de7abb9a4457cf16dab0b1e88d0897c5b6655cdf27b9c298c1796925ea2514cd2f065106eccd56b97a6804e84f459806d528837bf9718c7c9e525f7159ec
-
Filesize
56KB
MD50e70f873cb8f5615dd364325b714895a
SHA1089a8f5d7d90e7eedd6d02e30aa458440c89d7a7
SHA2564734d4d0626e140398a788226a5985e814bbd674f4218b60a89fd2da8f4ceb94
SHA512867dbac35991b2222f5fb4f5fc6dca4640b386356dff12322fdc06bb05b8af7c438e15f9fc6b4d4cedc27f081480d4187c1b4007831d9a052c3beda8d3c56ac4
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
63KB
MD551143491656ae2ee983d709c45a41861
SHA11cf8eb8d13246195cfc6168524d212c9a65b4681
SHA256dc4aac8b9eb62788bd04316293cde7e3d839e828e3e3082a2d81922ca8a94c81
SHA512239f2903b3b5177b32971ae3eb3eab2cc4c3d7856a3839f184c7f59b7e3cd53de4dac3363519e82acd183e564ae688dc8a7e5097c1283699714584ee13bed67d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\76b53b3ec448f7ccdda2063b15d2bfc3_32404286-a0b5-4a93-9620-6f13fd83251a
Filesize2KB
MD5ca4b1f4574ecad2b73400af3c6947e4c
SHA1dfbcf48142a6e674be5568056dd153fea18767ec
SHA256431ad7e46293e07e79fffdaea8ac7964fa68b1f184e390b9cf44a92db938927d
SHA5128b1e7d3db0c0206d233bd926470e201cafaa6a540b6e2c832787e736a8e5df192e881c6252ee7c5e7feb2eba3cd366ed95b97438e8cd09029a42022f930b80a0
-
Filesize
304KB
MD530f46f4476cdc27691c7fdad1c255037
SHA1b53415af5d01f8500881c06867a49a5825172e36
SHA2563a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f
-
Filesize
765KB
MD54bb92f145d95b180e356baf280e283f0
SHA105e6167c0af3ef8c01724469f1ad815f3b6a665d
SHA2567438b6d40f44532a6fdb0bf2e4c936d672a10e5b3f8f3011d37736c51767f949
SHA512548b9080c7ab9227c4a6f41507b5488b1bb2652537596fff9208a40131fd59f890e4b97773b511353679c934c3a869666c79ba3a26600cb30df5e1e5d84b9644
-
Filesize
544KB
MD588367533c12315805c059e688e7cdfe9
SHA164a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA5127a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714
-
Filesize
2KB
MD506e1e80e3387a1ea2a203aa389c5713d
SHA1da6938750eaf64542a87387a2bd15f2906d4800e
SHA256285c47b97d100a74e1ea3ae12cac9823130bdfb6915786afd7c480f93630b50e
SHA51267ab5c69787dfce4a2dd0bf196a448571c6df8a210721f3eaa69a4f94bac3b2357027132d44893f84ee257bc123b5def836ccea55c40b936db85de45bd5543c1
-
Filesize
2KB
MD5cbc85597948ecc33d8d03b73f4341a81
SHA192890d4c2adc1bd7420b42eea9f626976fd31873
SHA2561f1e73474cd5ef69bd9d858f4c113e8aff568460a21339eec40b47cb85e8a1d2
SHA512e657869cab5eb57d558c38bcb7fdfca1a60adc5eac46ff2d794b507cb718ccc7f75e24a9bbff3e1d73b1a8f1e9e89f0b2154545faa5deddf6a4de7287bd1cacc