Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
1.9MB
-
MD5
49a9681922ad571a4a24b42465e5cdc4
-
SHA1
f710153121bcde5e6acd4760001d916675973475
-
SHA256
c66b9636df8b16d69170b47f28611d70194925cd941c0a7ed49a6f35a599dad6
-
SHA512
adcb2e990a433e69468c21bc2f0089d147aad354bb3d637f280383f5d31913f4ad80a8c121a565a89b36946df0df02b142955681e257dd4bca66470146b976f3
-
SSDEEP
49152:GJd564fdAN+fobpaJztfWOoh1jpt1zeO67:khgfb8tt/oNtcOI
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
lumma
https://reinforcenh.shop/api
https://stogeneratmns.shop/api
https://fragnantbui.shop/api
https://drawzhotdog.shop/api
https://vozmeatillu.shop/api
https://offensivedzvju.shop/api
https://ghostreedmnu.shop/api
https://gutterydhowi.shop/api
https://lootebarrkeyn.shop/api
Extracted
redline
@LOGSCLOUDYT_BOT
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
redline
TG CLOUD @RLREBORN Admin @FATHEROFCARDERS
89.105.223.196:29862
Extracted
stealc
default
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
redline
newbundle2
185.215.113.67:15206
Extracted
xworm
5.0
188.190.10.161:4444
TSXTkO0pNBdN2KNw
-
install_file
USB.exe
Extracted
stealc
save
http://185.215.113.37
-
url_path
/e2b1563c6670f193.php
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://gutterydhowi.shop/api
https://ghostreedmnu.shop/api
https://offensivedzvju.shop/api
https://vozmeatillu.shop/api
https://drawzhotdog.shop/api
https://fragnantbui.shop/api
https://stogeneratmns.shop/api
https://reinforcenh.shop/api
https://ballotnwu.site/api
https://defenddsouneuw.shop/api
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2956-1589-0x0000000000400000-0x000000000042E000-memory.dmp family_xworm -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/2888-44-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\RgVZLng65o.exe family_redline behavioral2/memory/3956-141-0x0000000000400000-0x00000000004DE000-memory.dmp family_redline behavioral2/memory/4276-147-0x0000000000BD0000-0x0000000000C22000-memory.dmp family_redline behavioral2/memory/716-383-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe family_redline behavioral2/memory/3568-438-0x0000000000480000-0x00000000004D2000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
rstxdhuj.exedescription pid process target process PID 4776 created 3444 4776 rstxdhuj.exe Explorer.EXE -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
Processes:
451d11c0a8.exe17f0cc2c9e.exed9134a7da9.exeskotes.exeaxplong.exef73f0d2672.exec7bcaf45fa.exeskotes.exeaxplong.exeaxplong.exefile.exeskotes.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 451d11c0a8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 17f0cc2c9e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d9134a7da9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f73f0d2672.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c7bcaf45fa.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Processes:
powershell.exepowershell.exepowershell.exepid process 4480 powershell.exe 5488 powershell.exe 2180 powershell.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 24 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
d9134a7da9.exeaxplong.exefile.exec7bcaf45fa.exeskotes.exe451d11c0a8.exef73f0d2672.exeskotes.exe17f0cc2c9e.exeaxplong.exeskotes.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d9134a7da9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c7bcaf45fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 451d11c0a8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f73f0d2672.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f73f0d2672.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d9134a7da9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 17f0cc2c9e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 17f0cc2c9e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c7bcaf45fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 451d11c0a8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exeaxplong.exeNework.exeHkbsse.exe9c8f5d3d64.exeRegAsm.exec7bcaf45fa.exeskotes.exeneon.exeneon.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Nework.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Hkbsse.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 9c8f5d3d64.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation c7bcaf45fa.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation neon.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation neon.exe -
Executes dropped EXE 35 IoCs
Processes:
axplong.exegold.exe12dsvc.exeNework.exeOwXiJRRFxG.exeRgVZLng65o.exeHkbsse.exestealc_default2.exestories.exestories.tmpfidovideorecorder32_64.exeneedmoney.exepenis.execrypted.exeLummaC222222.exesvchost015.exenewbundle2.exerstxdhuj.execccc2.exef73f0d2672.exec7bcaf45fa.exeskotes.exeneon.exe451d11c0a8.exe17f0cc2c9e.exe9c8f5d3d64.exed9134a7da9.exeHkbsse.exeskotes.exeaxplong.exeneon.exeneon.exeHkbsse.exeaxplong.exeskotes.exepid process 2056 axplong.exe 1568 gold.exe 432 12dsvc.exe 848 Nework.exe 2772 OwXiJRRFxG.exe 4276 RgVZLng65o.exe 2488 Hkbsse.exe 2088 stealc_default2.exe 4040 stories.exe 1708 stories.tmp 4932 fidovideorecorder32_64.exe 4324 needmoney.exe 5116 penis.exe 3608 crypted.exe 3808 LummaC222222.exe 3664 svchost015.exe 3568 newbundle2.exe 4776 rstxdhuj.exe 4316 cccc2.exe 800 f73f0d2672.exe 3300 c7bcaf45fa.exe 4348 skotes.exe 5240 neon.exe 5400 451d11c0a8.exe 3144 17f0cc2c9e.exe 3936 9c8f5d3d64.exe 1624 d9134a7da9.exe 2100 Hkbsse.exe 3384 skotes.exe 5832 axplong.exe 4148 neon.exe 2312 neon.exe 6016 Hkbsse.exe 6084 axplong.exe 1528 skotes.exe -
Identifies Wine through registry keys 2 TTPs 12 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
file.exeaxplong.exef73f0d2672.exeskotes.exeaxplong.exeaxplong.exec7bcaf45fa.exe451d11c0a8.exe17f0cc2c9e.exed9134a7da9.exeskotes.exeskotes.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine f73f0d2672.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine c7bcaf45fa.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine 451d11c0a8.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine 17f0cc2c9e.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine d9134a7da9.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine skotes.exe -
Loads dropped DLL 3 IoCs
Processes:
stories.tmpstealc_default2.exepid process 1708 stories.tmp 2088 stealc_default2.exe 2088 stealc_default2.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.211.247.248 -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
skotes.exereg.exerstxdhuj.exeaxplong.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9c8f5d3d64.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000028001\\9c8f5d3d64.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe" rstxdhuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f73f0d2672.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\f73f0d2672.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c7bcaf45fa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\c7bcaf45fa.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\451d11c0a8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\451d11c0a8.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\17f0cc2c9e.exe = "C:\\Users\\Admin\\1000026002\\17f0cc2c9e.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 184 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000028001\9c8f5d3d64.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
file.exeaxplong.exef73f0d2672.exec7bcaf45fa.exeskotes.exe451d11c0a8.exe17f0cc2c9e.exed9134a7da9.exeskotes.exeaxplong.exeaxplong.exeskotes.exepid process 2504 file.exe 2056 axplong.exe 800 f73f0d2672.exe 3300 c7bcaf45fa.exe 4348 skotes.exe 5400 451d11c0a8.exe 3144 17f0cc2c9e.exe 1624 d9134a7da9.exe 3384 skotes.exe 5832 axplong.exe 6084 axplong.exe 1528 skotes.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
gold.exe12dsvc.execrypted.exeneedmoney.exerstxdhuj.execccc2.exeneon.exedescription pid process target process PID 1568 set thread context of 2888 1568 gold.exe RegAsm.exe PID 432 set thread context of 3956 432 12dsvc.exe RegAsm.exe PID 3608 set thread context of 716 3608 crypted.exe RegAsm.exe PID 4324 set thread context of 3664 4324 needmoney.exe svchost015.exe PID 4776 set thread context of 2956 4776 rstxdhuj.exe InstallUtil.exe PID 4316 set thread context of 5796 4316 cccc2.exe RegAsm.exe PID 5240 set thread context of 4852 5240 neon.exe InstallUtil.exe PID 5240 set thread context of 2320 5240 neon.exe InstallUtil.exe -
Drops file in Windows directory 3 IoCs
Processes:
file.exeNework.exec7bcaf45fa.exedescription ioc process File created C:\Windows\Tasks\axplong.job file.exe File created C:\Windows\Tasks\Hkbsse.job Nework.exe File created C:\Windows\Tasks\skotes.job c7bcaf45fa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5800 3808 WerFault.exe LummaC222222.exe -
System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
needmoney.execccc2.exed9134a7da9.exeNework.execrypted.exef73f0d2672.exeneon.exeaxplong.exe12dsvc.exestories.exestories.tmpneon.exeRegAsm.exestealc_default2.exerstxdhuj.exeRegAsm.exepowershell.exepowershell.exefile.exe451d11c0a8.exenewbundle2.exec7bcaf45fa.exe9c8f5d3d64.exeHkbsse.exefidovideorecorder32_64.exepenis.exeRegAsm.exeLummaC222222.exeRegAsm.exeOwXiJRRFxG.exeRgVZLng65o.exesvchost015.exeInstallUtil.exeskotes.exe17f0cc2c9e.exegold.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language needmoney.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cccc2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9134a7da9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f73f0d2672.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12dsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stories.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stories.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rstxdhuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 451d11c0a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language newbundle2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7bcaf45fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c8f5d3d64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fidovideorecorder32_64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language penis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LummaC222222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OwXiJRRFxG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RgVZLng65o.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17f0cc2c9e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gold.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
PING.EXEcmd.exepid process 3712 PING.EXE 3988 cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
stealc_default2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exechrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
chrome.exechrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133718771912386733" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Processes:
RegAsm.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
InstallUtil.exepid process 2956 InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exeaxplong.exestealc_default2.exestories.tmpRegAsm.exeRgVZLng65o.exepenis.exerstxdhuj.exeRegAsm.exenewbundle2.exef73f0d2672.exepowershell.exec7bcaf45fa.exeskotes.exeneon.exepowershell.exe451d11c0a8.exeInstallUtil.exe17f0cc2c9e.exechrome.exed9134a7da9.exepid process 2504 file.exe 2504 file.exe 2056 axplong.exe 2056 axplong.exe 2088 stealc_default2.exe 2088 stealc_default2.exe 1708 stories.tmp 1708 stories.tmp 2888 RegAsm.exe 2888 RegAsm.exe 2888 RegAsm.exe 2888 RegAsm.exe 2088 stealc_default2.exe 2088 stealc_default2.exe 2888 RegAsm.exe 2888 RegAsm.exe 4276 RgVZLng65o.exe 4276 RgVZLng65o.exe 4276 RgVZLng65o.exe 4276 RgVZLng65o.exe 4276 RgVZLng65o.exe 4276 RgVZLng65o.exe 5116 penis.exe 5116 penis.exe 4776 rstxdhuj.exe 4776 rstxdhuj.exe 716 RegAsm.exe 716 RegAsm.exe 716 RegAsm.exe 716 RegAsm.exe 716 RegAsm.exe 716 RegAsm.exe 3568 newbundle2.exe 3568 newbundle2.exe 800 f73f0d2672.exe 800 f73f0d2672.exe 5488 powershell.exe 5488 powershell.exe 5488 powershell.exe 3300 c7bcaf45fa.exe 3300 c7bcaf45fa.exe 3568 newbundle2.exe 3568 newbundle2.exe 3568 newbundle2.exe 3568 newbundle2.exe 4348 skotes.exe 4348 skotes.exe 5240 neon.exe 5240 neon.exe 5240 neon.exe 2180 powershell.exe 2180 powershell.exe 2180 powershell.exe 5400 451d11c0a8.exe 5400 451d11c0a8.exe 2956 InstallUtil.exe 2956 InstallUtil.exe 3144 17f0cc2c9e.exe 3144 17f0cc2c9e.exe 5712 chrome.exe 5712 chrome.exe 5240 neon.exe 5240 neon.exe 1624 d9134a7da9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9c8f5d3d64.exepid process 3936 9c8f5d3d64.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exechrome.exepid process 5712 chrome.exe 5712 chrome.exe 5268 chrome.exe 5268 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
penis.exeRegAsm.exeRgVZLng65o.exerstxdhuj.exeRegAsm.exenewbundle2.exeInstallUtil.exepowershell.exeneon.exepowershell.exechrome.exedescription pid process Token: SeDebugPrivilege 5116 penis.exe Token: SeBackupPrivilege 5116 penis.exe Token: SeSecurityPrivilege 5116 penis.exe Token: SeSecurityPrivilege 5116 penis.exe Token: SeSecurityPrivilege 5116 penis.exe Token: SeSecurityPrivilege 5116 penis.exe Token: SeDebugPrivilege 2888 RegAsm.exe Token: SeDebugPrivilege 4276 RgVZLng65o.exe Token: SeDebugPrivilege 4776 rstxdhuj.exe Token: SeDebugPrivilege 4776 rstxdhuj.exe Token: SeDebugPrivilege 716 RegAsm.exe Token: SeDebugPrivilege 3568 newbundle2.exe Token: SeDebugPrivilege 2956 InstallUtil.exe Token: SeDebugPrivilege 5488 powershell.exe Token: SeDebugPrivilege 5240 neon.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeDebugPrivilege 2956 InstallUtil.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe Token: SeCreatePagefilePrivilege 5712 chrome.exe Token: SeShutdownPrivilege 5712 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
file.exestories.tmp9c8f5d3d64.exechrome.exepid process 2504 file.exe 1708 stories.tmp 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
9c8f5d3d64.exechrome.exepid process 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe 3936 9c8f5d3d64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 2956 InstallUtil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exeaxplong.exegold.exe12dsvc.exeRegAsm.exeNework.exeHkbsse.exestories.exestories.tmpcrypted.exedescription pid process target process PID 2504 wrote to memory of 2056 2504 file.exe axplong.exe PID 2504 wrote to memory of 2056 2504 file.exe axplong.exe PID 2504 wrote to memory of 2056 2504 file.exe axplong.exe PID 2056 wrote to memory of 1568 2056 axplong.exe gold.exe PID 2056 wrote to memory of 1568 2056 axplong.exe gold.exe PID 2056 wrote to memory of 1568 2056 axplong.exe gold.exe PID 1568 wrote to memory of 2888 1568 gold.exe RegAsm.exe PID 1568 wrote to memory of 2888 1568 gold.exe RegAsm.exe PID 1568 wrote to memory of 2888 1568 gold.exe RegAsm.exe PID 1568 wrote to memory of 2888 1568 gold.exe RegAsm.exe PID 1568 wrote to memory of 2888 1568 gold.exe RegAsm.exe PID 1568 wrote to memory of 2888 1568 gold.exe RegAsm.exe PID 1568 wrote to memory of 2888 1568 gold.exe RegAsm.exe PID 1568 wrote to memory of 2888 1568 gold.exe RegAsm.exe PID 2056 wrote to memory of 432 2056 axplong.exe 12dsvc.exe PID 2056 wrote to memory of 432 2056 axplong.exe 12dsvc.exe PID 2056 wrote to memory of 432 2056 axplong.exe 12dsvc.exe PID 2056 wrote to memory of 848 2056 axplong.exe Nework.exe PID 2056 wrote to memory of 848 2056 axplong.exe Nework.exe PID 2056 wrote to memory of 848 2056 axplong.exe Nework.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 432 wrote to memory of 3956 432 12dsvc.exe RegAsm.exe PID 3956 wrote to memory of 2772 3956 RegAsm.exe OwXiJRRFxG.exe PID 3956 wrote to memory of 2772 3956 RegAsm.exe OwXiJRRFxG.exe PID 3956 wrote to memory of 2772 3956 RegAsm.exe OwXiJRRFxG.exe PID 3956 wrote to memory of 4276 3956 RegAsm.exe RgVZLng65o.exe PID 3956 wrote to memory of 4276 3956 RegAsm.exe RgVZLng65o.exe PID 3956 wrote to memory of 4276 3956 RegAsm.exe RgVZLng65o.exe PID 848 wrote to memory of 2488 848 Nework.exe Hkbsse.exe PID 848 wrote to memory of 2488 848 Nework.exe Hkbsse.exe PID 848 wrote to memory of 2488 848 Nework.exe Hkbsse.exe PID 2056 wrote to memory of 2088 2056 axplong.exe stealc_default2.exe PID 2056 wrote to memory of 2088 2056 axplong.exe stealc_default2.exe PID 2056 wrote to memory of 2088 2056 axplong.exe stealc_default2.exe PID 2488 wrote to memory of 4040 2488 Hkbsse.exe stories.exe PID 2488 wrote to memory of 4040 2488 Hkbsse.exe stories.exe PID 2488 wrote to memory of 4040 2488 Hkbsse.exe stories.exe PID 4040 wrote to memory of 1708 4040 stories.exe stories.tmp PID 4040 wrote to memory of 1708 4040 stories.exe stories.tmp PID 4040 wrote to memory of 1708 4040 stories.exe stories.tmp PID 1708 wrote to memory of 4932 1708 stories.tmp fidovideorecorder32_64.exe PID 1708 wrote to memory of 4932 1708 stories.tmp fidovideorecorder32_64.exe PID 1708 wrote to memory of 4932 1708 stories.tmp fidovideorecorder32_64.exe PID 2056 wrote to memory of 4324 2056 axplong.exe needmoney.exe PID 2056 wrote to memory of 4324 2056 axplong.exe needmoney.exe PID 2056 wrote to memory of 4324 2056 axplong.exe needmoney.exe PID 2056 wrote to memory of 5116 2056 axplong.exe penis.exe PID 2056 wrote to memory of 5116 2056 axplong.exe penis.exe PID 2056 wrote to memory of 5116 2056 axplong.exe penis.exe PID 2056 wrote to memory of 3608 2056 axplong.exe crypted.exe PID 2056 wrote to memory of 3608 2056 axplong.exe crypted.exe PID 2056 wrote to memory of 3608 2056 axplong.exe crypted.exe PID 3608 wrote to memory of 716 3608 crypted.exe RegAsm.exe PID 3608 wrote to memory of 716 3608 crypted.exe RegAsm.exe PID 3608 wrote to memory of 716 3608 crypted.exe RegAsm.exe PID 3608 wrote to memory of 716 3608 crypted.exe RegAsm.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Roaming\OwXiJRRFxG.exe"C:\Users\Admin\AppData\Roaming\OwXiJRRFxG.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Users\Admin\AppData\Roaming\RgVZLng65o.exe"C:\Users\Admin\AppData\Roaming\RgVZLng65o.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\is-DGLE2.tmp\stories.tmp"C:\Users\Admin\AppData\Local\Temp\is-DGLE2.tmp\stories.tmp" /SL5="$80284,2980754,56832,C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe"C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe" -i8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:716 -
C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 12485⤵
- Program crash
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe"C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵PID:5980
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵PID:5924
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵PID:5848
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\1000354001\f73f0d2672.exe"C:\Users\Admin\AppData\Local\Temp\1000354001\f73f0d2672.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:800 -
C:\Users\Admin\AppData\Local\Temp\1000355001\c7bcaf45fa.exe"C:\Users\Admin\AppData\Local\Temp\1000355001\c7bcaf45fa.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\1000023001\451d11c0a8.exe"C:\Users\Admin\AppData\Local\Temp\1000023001\451d11c0a8.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5400 -
C:\Users\Admin\1000026002\17f0cc2c9e.exe"C:\Users\Admin\1000026002\17f0cc2c9e.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\1000028001\9c8f5d3d64.exe"C:\Users\Admin\AppData\Local\Temp\1000028001\9c8f5d3d64.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3936 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd7⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdcc5acc40,0x7ffdcc5acc4c,0x7ffdcc5acc588⤵PID:4464
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,3705112020844960679,10340356639872452215,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1932 /prefetch:28⤵PID:4956
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1944,i,3705112020844960679,10340356639872452215,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2520 /prefetch:38⤵PID:6060
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2116,i,3705112020844960679,10340356639872452215,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2648 /prefetch:88⤵PID:4788
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,3705112020844960679,10340356639872452215,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3160 /prefetch:18⤵PID:4776
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,3705112020844960679,10340356639872452215,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:18⤵PID:5464
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4632,i,3705112020844960679,10340356639872452215,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4644 /prefetch:88⤵PID:1660
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4516,i,3705112020844960679,10340356639872452215,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4692 /prefetch:88⤵PID:3496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd7⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5268 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdcc5acc40,0x7ffdcc5acc4c,0x7ffdcc5acc588⤵PID:1528
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2056,i,14533383155879553814,7728814897700299367,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=2052 /prefetch:28⤵PID:4988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1836,i,14533383155879553814,7728814897700299367,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=2416 /prefetch:38⤵PID:3976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2068,i,14533383155879553814,7728814897700299367,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=2604 /prefetch:88⤵PID:3248
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,14533383155879553814,7728814897700299367,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=3192 /prefetch:18⤵PID:3820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,14533383155879553814,7728814897700299367,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=3356 /prefetch:18⤵PID:3152
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,14533383155879553814,7728814897700299367,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=4652 /prefetch:88⤵PID:1784
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4784,i,14533383155879553814,7728814897700299367,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=4800 /prefetch:88⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\1000029001\d9134a7da9.exe"C:\Users\Admin\AppData\Local\Temp\1000029001\d9134a7da9.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5240 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3988 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3712 -
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"6⤵
- Adds Run key to start application
PID:4972 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"5⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\neon.exe"C:\Users\Admin\AppData\Local\Temp\neon.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\neon.exe"C:\Users\Admin\AppData\Local\Temp\neon.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"5⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2320 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵
- Command and Scripting Interpreter: PowerShell
PID:4480 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵PID:5160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2956 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5488 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3808 -ip 38081⤵PID:4380
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3384
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:2100
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5832
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:6016
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6084
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1528
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:6124
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:5456
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Query Registry
7Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
3.0MB
MD5b19555358f3c9abc6157b2b7aab2f658
SHA1177fda0d1d0444e6cf1ca8a915f5f2212bd092e1
SHA2562b0062e5ef0c0bbc9034ba09296f47b26dd0528dd8131dccfd10009a516b1104
SHA5126bff37eb0c5617fab6512c9a31e701f04abfe1b5eb1fa70b93c83de9a118e434ecb1f49c6e7baf5335ae32d8b04b296835f028ca8eee7858c11a4797e07d64b0
-
Filesize
40B
MD5af2ac817e91cbbc9f636481382b93e59
SHA1894ef7346e32f322bb069e7b352e501bdfe9d60b
SHA256a792c41e8f33b310d4702758b37ab67a8ee262d24a8d1c85121f4a00ccbc0b6a
SHA512d8a5a59f87ac493f187a0609972e1e5b05ce579c1879df5172f24c66429d58d7f587b5dc440c3fea3a7b568ff1455f8aa73e8524ebf4d03b537c63b8850dd932
-
Filesize
649B
MD503be124be883facf0d6ccdf0f93edb48
SHA1ebd718e2dc68fe053a753e27fcb2b7626731708b
SHA25670d30bbfe8a4262b5e070afcf1ced67e93b9429c5ef6ec6e347795540fca9f74
SHA5120b824a40236960a5e3c06e4efe4b81143e6828c82268b3601e0abab543cf72e43b66dae04bb9c822e05ab37e8798179a46d8f0a2aade432bb852704b3a24fb7b
-
Filesize
264B
MD51fe23242f30ae46e8bf2b82a299f993b
SHA1218a298dd1b47c678332e96920515e36cc660c02
SHA256bdf8eadba07030677ad16fa72700fd581c281a56974a31fb2d47b1dfd62b214f
SHA5126ec47e9e2247478a4e914e06e544e2388341051ffc0f5173f30224d95cd21f1cccaefc1c2bf8298b5f624372901c345c2cf4a3bbd5f3be92ebcc45798c5ded26
-
Filesize
432B
MD5add871648b689f99569f27eef460b639
SHA19ad00e8a0da68346295d9fc7ad5bc4db81075e25
SHA2560e6854095929da988a1ac59cc03b534a130eedec828f194ea1df207971b1428a
SHA51265f484a8fe5a9c9ca6c9ec7db309d27df182f43c935b96ffb7f4e0708e11312c0b6cff983813aa18793f1721283d5fd7979b6b6104954edae2f002a4b65a1267
-
Filesize
2KB
MD59483f355286482a8f9f2ecb782617700
SHA17789c3ac1dafdb0b833e54afcf5cadd075459da6
SHA25635d6d6ed60f2667326b4fcd67754c43e828ef4efc8d51aeb3ca3be91499c650e
SHA51210956c1521879f96413b9e0e4ade05ccd8b20cc969dee41f27d2c8ba908fe42653cd80a54a55c264dd4b1f4ca5b4049790fe6057750b686fd50280967b419cfc
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD57b68290ef802079d11413b1648ca3d01
SHA15e6c644be674d396304cb4a61aa7dc9c500c9acd
SHA256ab77ac4f590ff46eb22a3cb1e5cdadb150ccfaa7638262b0080109874abf3c16
SHA5121459216a5f062ca60be1fc0609c08f7f3b76ff8c097f006ab557787f4ed6f430b2041472b3f16951f78066014a49a1bf176a54c197229c25c2a8432898198d3e
-
Filesize
859B
MD551d6b7a30c83c5ed365388824a5de556
SHA1ebb0a6254e7c33a4a3f94b5f6a9198fabf426ddd
SHA25658204ec36121263880a29413a93538f40470b3b92ee909555819915b6f36cbc4
SHA512cfd138dc813d5034e0d2a1ac4ab9a719e5e1bc5c76af1cdb137d4bc87aa9d3645388c3336a06b28c75ea9a9f0d9770074c0f847cd88bc0dd67e5e7a6d74d6eff
-
Filesize
9KB
MD5f3d683131f9d52f7efeb05350d04e6ed
SHA155bad8c529f1c3c3a2c35ebc39f03196cdca38d6
SHA256b378e3c4be0218a62803187ddd2618a2f01319198cfab32cc56cbc4ba1ffe9d2
SHA512a464f404c2d74410517d1a335b372076c1df767e6c3916a95fb3497d2a6ed8de9b2b72a2c74218a504760e3336e60ed6d8fe2b9f19f9207604e7ed509af813e9
-
Filesize
10KB
MD53291e05e013e48eba7fd04bdd77a900b
SHA136a349037c6acdac243a3c77a84b33d4d067d44b
SHA25644528df33e65982c81fb6cd041412470f69494032beb79731a49d348b6d90e6e
SHA51290381a3002586ccc34cd91a7b215d094e59be87b756eee471ad2e6ac0cb1ad183e232b1398eee8d3de23a2beb46482132ad1140a05000cd4c2234144007c5176
-
Filesize
10KB
MD581a07cceddedf8018c468bf28f42a7a0
SHA13923e0cc900d627442d323cfcb2847ff8fee0594
SHA256d775eab2b24a5e805b2c4b6fb1b71cdffa01a21f1d7ae9e10c6ce7fe1df7e9b7
SHA51253bf9baea7dc294bed99205bc0276e9c9dd17557489d9f32597ecc671c1759f82cfb1ddb9e7fb1eeb594319f3f5ba257591f098dcab0e438542863046b54c578
-
Filesize
9KB
MD507529f456e70b10bab3f82318df3a345
SHA12eb9040f87c2e5fd342f53eb6323fc9f7667da12
SHA2568c837085ad71518174ade64d54dfd4e74f7cbf9949ea49151cc3479e375163b2
SHA512a0c219d9428edbbee7b79fe6371aae94a6071acfb21253d001cefb41c34ccd168d9c778574ec5edc9a194b3a1cb137d6bcc9c4ac396838296ae084f8ee9c75b8
-
Filesize
9KB
MD52d1515697006087d23741c56ef71972b
SHA128369cd8c6b8d063276616acdd20cda13845ecc8
SHA25656516e19284646f2b3d94227bd11c19b1c546c11c4a78d5c2d9f288bcd137ef0
SHA512fd9ad27b7e75083d6c44fbff90ab2d4038f949159ba72964eb773acb343560f6e090d2a0c203f1ef9e493ddc4f5e7c9ce6e9a468c7a7de26cb6bea15925207ef
-
Filesize
15KB
MD5c0f3b56c3777e729f7979937761bf0f2
SHA153c9784d3d88abe62c030ec2816facf8802f2aa0
SHA2565efcaafa36edbf2e670e1004fdf1ec723f1f2fee18bd075634f9e50cdedda2b8
SHA5121d1a7c54e1c61476ed07e08b148ed3a230c69a14500d843674f56e642fe01b19b5b3e64b89777747a3747aa20bf992c112ff891e946e9add10dee9e383b20615
-
Filesize
116KB
MD50c21e607925283d9d22632fabaabb588
SHA17514be937be4ffc36093d792929c23bd32bd6ea4
SHA256adc65c16e12ae087333087f4491d885661d57eb2db8abd5b0117c07f8ea34dba
SHA51222e5066abb7efbb527216bb6d2eae4ef8fb99c0e031159a78631e2c5f403ee29030a173b149740236993df67fafa426b03ea8476573d29a4fda3c30cf0a80e8d
-
Filesize
211KB
MD52215b79635070ef16e4124b77963fa6c
SHA1db0b5920dba761759ff4515af754e85d183a46fc
SHA256d78f6f3388d5b3d4ce75fe7ec1cd9ef2091d93dd283cb064e2a19762d3d3759b
SHA5124474a66121a4e6b245501a750674eb2e7d3560549a1744d95e259a73a44f6f2f2106b8f3919d82e81301fe5745a9f6f9aeaef3e312b36b884d81f17c60a5b2e9
-
Filesize
211KB
MD5773d4b2ad2a23c88dcf2a73278644fdd
SHA1480d07148a8ce8fffca81fcd768a82ca664e58ac
SHA256972acdf053dfb9bc00714718b5bdac946a3aa6368c0b1366bc2705cfa350b91d
SHA512f840ab194b0af1eaf6d6d264a93288394247f852032f348edf4c9a1b9e49671446ae6869f400abd12f22292d7c158ad0b10ac5ff417497abce31eb1bbe107345
-
Filesize
2KB
MD554758638183b1f0e9b1310fb17c026c6
SHA1f8ac3d78496f44bba9f68b40cc463964b7ad4eb9
SHA256a77066557f80edcdb12a4c7588a3c88bbb282ee30f93dc6b4f7a71c0b93a342c
SHA51286e7762c96643b55cd8fcf674aa85dd4ec11b2c6019d7e936461dc81a702b95136e7a352b63028b8e6d975b06c3edcbc62506e5ce8c3ae31801a14abc6460a6d
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5f52c4e030cbd95953b12ab973b5c9533
SHA1cb44305c8f45123cac8c66d973ecb6491f4f8011
SHA256a5e3d9fd15484e7728c65eadb86618132aad96b1405d4368d00f122869ab51dd
SHA5125f45168caf135e44f15d5e231fbfb12b13c5437929d9b80f812d6fed486bad9554515a8a4a34d63b2a21233465726f97d7959d3c922ce2aaba113e84284f7f48
-
Filesize
312KB
MD5389881b424cf4d7ec66de13f01c7232a
SHA1d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA2569d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA5122b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96
-
Filesize
882KB
MD584263ab03b0a0f2b51cc11b93ec49c9f
SHA1e6457eb0e0131bec70a2fd4d4a943314f0bd28d4
SHA2567d6e4e01c452dd502361640ee095e2bee35e3f55fd11edc9e94c3580d2c132b5
SHA512db35a02345b5166077e300524675c523a8b4082fa62fc151c0797141348cae5e173eeaec5ad1e95556e048ea6ed34a78b90b1184420557c53cd91f351417ebb2
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
1.1MB
MD55baa3de084e72ad338296d855d10991d
SHA130d9d8c65877e0c3bed6a856506cbe654d5151e8
SHA25651f2c4aeef6c70baecac345fdd0e5c905560f07252bc6e61898d3dd3c596048a
SHA51247e0a1bc486fa468ab6297344b3e7b265dc8dffedb1bb2558ee725b94c32caaeb9c1cb3f8ddbf2abfa602226829a3305196d3eebdda875cf30987efc6eb4a13b
-
Filesize
3.1MB
MD5bb4417d907e43503f714273f1ae9cf44
SHA1973ff5333f859fcf8fd7281509a9bd19d155d82c
SHA256a1a117e8110faca90e94f5edd93e0ad4a5d7f49485e30bfa332db573464c7908
SHA512ab80a72c2e805052084ffc360d9189db4f5f5797c36ade71d09a951843455d936fcff18e85819b48dba82332f142b34c26320f8d1ce8df08874829b276bc3018
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
4.1MB
MD57fa5c660d124162c405984d14042506f
SHA169f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c
-
Filesize
409KB
MD5a21700718c70ec5e787ad373cb72a757
SHA1027554ab5ff3245e7617f3b83d6548bf7919f92e
SHA25687e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
SHA512ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b
-
Filesize
314KB
MD5ff5afed0a8b802d74af1c1422c720446
SHA17135acfa641a873cb0c4c37afc49266bfeec91d8
SHA25617ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
SHA51211724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac
-
Filesize
352KB
MD52f1d09f64218fffe7243a8b44345b27e
SHA172553e1b3a759c17f54e7b568f39b3f8f1b1cdbe
SHA2564a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2
SHA5125871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909
-
Filesize
304KB
MD558e8b2eb19704c5a59350d4ff92e5ab6
SHA1171fc96dda05e7d275ec42840746258217d9caf0
SHA25607d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
SHA512e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
-
Filesize
963KB
MD51ef39c8bc5799aa381fe093a1f2d532a
SHA157eabb02a7c43c9682988227dd470734cc75edb2
SHA2560cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
SHA51213a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682
-
Filesize
359KB
MD56b470f7251aa9c14d7daea8f6446e217
SHA1a256c54d4dd7e0a7a1582d8fdfef5807bc3c4af4
SHA2568b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f
SHA512fdc553c9d2ff19343dd99b0b34c875752df4fa0cbd494096aeb51d859bd102448f1a5043a53a808045ae52077f180546a134b1aa69db4dc04aff2610fadeaca4
-
Filesize
1.7MB
MD5904925a03f5e62b7b67ee30d22e9c7cf
SHA1acec73d1e47b2dddf74addc3529345254135062f
SHA256d5f6c82d696b68c10f33762a2fd0628afd233b0d07c99654b186f699446d990b
SHA512688660f97c278e2fad8167af3c75ccf41e432d7962f0ea242b01d410026541fb140f723a1a42622515c987b692e207c79eb83493cce7ba73f189cf83e2a4fea3
-
Filesize
1.8MB
MD5e0828e289dfbd343733236c6cfcee121
SHA1d55235aae5323348069ad77a8edcd77d5e45d2a7
SHA256c1c76c99ff4c06d6b9e252d52b397a0fa281e1aa1a51555193324decfc0cbca8
SHA512cc1940ed569d48ab671e16b05cd2a34e03485220a25abdd3f8e4d615717a6ee4465368b929ba18563cdb051a39df803cebd545ffaa8b07b6e07fdbf42e1849c4
-
Filesize
3.5MB
MD5b3fd0e1003b1cd38402b6d32829f6135
SHA1c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA51204692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1
-
Filesize
1.9MB
MD549a9681922ad571a4a24b42465e5cdc4
SHA1f710153121bcde5e6acd4760001d916675973475
SHA256c66b9636df8b16d69170b47f28611d70194925cd941c0a7ed49a6f35a599dad6
SHA512adcb2e990a433e69468c21bc2f0089d147aad354bb3d637f280383f5d31913f4ad80a8c121a565a89b36946df0df02b142955681e257dd4bca66470146b976f3
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
692KB
MD5c8afa039fc2a7f032512686fb50692df
SHA13fce9102949fa0fac312574e6d3756f26735c000
SHA256123e40b411ba32e768103090c2eb1c3b874f2c933f7e9f30717185b41f232332
SHA512f185aa5a85570dd2172752d59278fd6b2b61dba48890deb48ec2803f3e3e10573cf600ee91f1af1a77b56f2f44a52b16873ba5e6df2d85c097c16d8ebac98666
-
Filesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
Filesize
2.9MB
MD5b826dd92d78ea2526e465a34324ebeea
SHA1bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA2567824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA5121ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625
Filesize2KB
MD56382d727f2df6220ce91c843072686f6
SHA1278d51d74939063a21caa50296f91e8577b32070
SHA256917da3e3b37d93f24617818f8bca46c71461a375ca1a4010c7293baf029e2fe2
SHA5129fac677c751d1353d7023f672a2e1d4947621b3120d968359e2e17c36d52ec7bed05caaf0b2275267e366daaa0fa257efe0c02a261cbf3a1f67ed626ee4f60d6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625
Filesize2KB
MD51670a483db5596a7f01602f9e1fca36f
SHA1e5cea1e8f1c57c709a77cbbaa53e430133bd3d2a
SHA256d45b57adff088a425322e947612cebef7e5ef39aaac85dfa90725007b01acda0
SHA51279bcbd8330ee1d1ba9b34a9f5758fd1a3cd35d5fba5323a9a8a8f21ca6e877ae8999c8c916f3769c880fb7284d3e9e631b2cde53c07b4d745d608ad8913937d0
-
Filesize
356KB
MD5a3ef9920a91b891837705e46bb26de17
SHA19cfbcd0f46ec86fb57d3d6d74a064f9098adf117
SHA256171cef885f6c285e995ce3ec5960c5ea4e4ed049cec362745058fee39e4136cc
SHA512c65e91091b95c3aba0af7df4ed6543d26bcb5b54d6fab82f9d2ac1ba156f475f98124a1a0e8851d69be23b1dc945c76c075cd32515203273260802e1224dbd6e
-
Filesize
304KB
MD54e60f3fd76d9eab244f9dc00f7765b0b
SHA11a154d6e837e7105c551793131cde89f157c4330
SHA256d6945846cc23c01b9c9ad2b97d35b5a14c01f1a4cc2ec651a596f06777ba4fec
SHA51244727e25781f448579ac35aab94aff550ed9fe5ac58d95bd394569c62892dc78216ac687baa43cef66187ebe629f5dd9cd63ea274222d11dbef3440ec4d7f77a
-
Filesize
2KB
MD5aa60d7755d5a23aaba15d7e1555aa410
SHA186161ac3fc74599ef77c21e6d4525d4d2407a330
SHA256a9d7cb990c537410262c28d8017bd8c2ffbdcc9850133a81bf3cc5100f090e4e
SHA5122e51315c3704d082686ee84b93ea15e623e785280051e6482e172ddd9fa76c0234303132dbdff4174972877c00b004c43289782e1b27417ab863d852c8ae35e2
-
Filesize
2KB
MD5fba612eeb015040e2746998f014d48bb
SHA16a0b6255fd631eeb7a3e5c8378e71410464608a6
SHA256efed14402dbda73ef60c40cde4d6095269dd87531980a735f3bb35ad4b598a89
SHA5123370be0f65c58366664475d361be58253ad5eb8e8924f820c36b7f5a6980f420548152e2962efd4e2f20435b7e1003c896cc00f2df2185947edcb4ca6d34d1db