Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 07:48
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
1.8MB
-
MD5
2dbfc6089fd5e3b1aa8a004508a16a37
-
SHA1
20331e184251ff628c6e3593511fc6ab93349058
-
SHA256
99bc61afdb7382ac8d7f9da3bb87ca552fe8596ded65bf39a81d2f7839bbc3d6
-
SHA512
03f5390778ce28d28d6e4c60af50f0ee32f1e4adf1b0ea1958bd9897db919f63817f1a0df8b4b4ae03ac90d4e797a2a1db380f9fce9d6ef33575101c4a640629
-
SSDEEP
24576:ySGWE0vnM17jABV0J7rSGvvLVQCT40WfUKNZvesfmT96XtzqYH6s0lc8WmL:yPcnOsK7rpvL2240Wdvesfw9i7HB4Wo
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
lumma
https://reinforcenh.shop/api
https://stogeneratmns.shop/api
https://fragnantbui.shop/api
https://drawzhotdog.shop/api
https://vozmeatillu.shop/api
https://offensivedzvju.shop/api
https://ghostreedmnu.shop/api
https://gutterydhowi.shop/api
https://lootebarrkeyn.shop/api
Extracted
redline
@LOGSCLOUDYT_BOT
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
stealc
default
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
redline
TG CLOUD @RLREBORN Admin @FATHEROFCARDERS
89.105.223.196:29862
Extracted
redline
newbundle2
185.215.113.67:15206
Extracted
xworm
5.0
188.190.10.161:4444
TSXTkO0pNBdN2KNw
-
install_file
USB.exe
Extracted
stealc
save
http://185.215.113.37
-
url_path
/e2b1563c6670f193.php
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://gutterydhowi.shop/api
https://ghostreedmnu.shop/api
https://offensivedzvju.shop/api
https://vozmeatillu.shop/api
https://drawzhotdog.shop/api
https://fragnantbui.shop/api
https://stogeneratmns.shop/api
https://reinforcenh.shop/api
https://ballotnwu.site/api
https://defenddsouneuw.shop/api
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/6896-1599-0x0000000000630000-0x000000000065E000-memory.dmp family_xworm -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1540-45-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\CFvbTXbM2h.exe family_redline behavioral2/memory/4748-137-0x0000000000400000-0x00000000004DE000-memory.dmp family_redline behavioral2/memory/5572-146-0x0000000000C90000-0x0000000000CE2000-memory.dmp family_redline behavioral2/memory/820-393-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe family_redline behavioral2/memory/1688-449-0x00000000005E0000-0x0000000000632000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
rstxdhuj.exedescription pid process target process PID 5012 created 3388 5012 rstxdhuj.exe Explorer.EXE -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
Processes:
skotes.exeaxplong.exeecad5f0362.exeskotes.exe6b0f3adeb2.exe78305aca71.exeskotes.exeaxplong.exefile.exef160aea806.exe917086e598.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ecad5f0362.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6b0f3adeb2.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 78305aca71.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f160aea806.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 917086e598.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Processes:
powershell.exepowershell.exepowershell.exepid process 1780 powershell.exe 2740 powershell.exe 4756 powershell.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 24 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplong.exeskotes.exeaxplong.exef160aea806.exeskotes.exeskotes.exe78305aca71.exeaxplong.exeecad5f0362.exe6b0f3adeb2.exe917086e598.exefile.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f160aea806.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f160aea806.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 78305aca71.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ecad5f0362.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6b0f3adeb2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 78305aca71.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ecad5f0362.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 917086e598.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 917086e598.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6b0f3adeb2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
skotes.exeb034620509.exefile.exeaxplong.exeRegAsm.exeHkbsse.exeNework.exeecad5f0362.exeneon.exeneon.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation b034620509.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation Hkbsse.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation Nework.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation ecad5f0362.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation neon.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation neon.exe -
Executes dropped EXE 35 IoCs
Processes:
axplong.exegold.exe12dsvc.exeNework.exetpK5jyT5Rd.exeCFvbTXbM2h.exeHkbsse.exestealc_default2.exestories.exestories.tmpneedmoney.exepenis.exegerdaplay3se.execrypted.exesvchost015.exeLummaC222222.exenewbundle2.exerstxdhuj.execccc2.exef160aea806.exeecad5f0362.exeskotes.exe917086e598.exeneon.exe6b0f3adeb2.exeb034620509.exe78305aca71.exeskotes.exeHkbsse.exeaxplong.exeneon.exeneon.exeaxplong.exeskotes.exeHkbsse.exepid process 6136 axplong.exe 5948 gold.exe 5436 12dsvc.exe 5988 Nework.exe 5252 tpK5jyT5Rd.exe 5572 CFvbTXbM2h.exe 2776 Hkbsse.exe 3052 stealc_default2.exe 2568 stories.exe 1796 stories.tmp 3920 needmoney.exe 4872 penis.exe 5896 gerdaplay3se.exe 3020 crypted.exe 1968 svchost015.exe 3440 LummaC222222.exe 1688 newbundle2.exe 5012 rstxdhuj.exe 6756 cccc2.exe 7120 f160aea806.exe 4316 ecad5f0362.exe 6160 skotes.exe 1892 917086e598.exe 6204 neon.exe 2792 6b0f3adeb2.exe 2092 b034620509.exe 4808 78305aca71.exe 2484 skotes.exe 5852 Hkbsse.exe 4940 axplong.exe 1932 neon.exe 1036 neon.exe 3232 axplong.exe 6512 skotes.exe 4452 Hkbsse.exe -
Identifies Wine through registry keys 2 TTPs 12 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
file.exeaxplong.exeskotes.exe917086e598.exe6b0f3adeb2.exe78305aca71.exeaxplong.exeaxplong.exef160aea806.exeecad5f0362.exeskotes.exeskotes.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine 917086e598.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine 6b0f3adeb2.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine 78305aca71.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine f160aea806.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine ecad5f0362.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine skotes.exe -
Loads dropped DLL 5 IoCs
Processes:
stories.tmpstealc_default2.exepid process 1796 stories.tmp 1796 stories.tmp 1796 stories.tmp 3052 stealc_default2.exe 3052 stealc_default2.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.211.247.248 -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
axplong.exeskotes.exereg.exerstxdhuj.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ecad5f0362.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\ecad5f0362.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\917086e598.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\917086e598.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b0f3adeb2.exe = "C:\\Users\\Admin\\1000026002\\6b0f3adeb2.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b034620509.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000028001\\b034620509.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe" rstxdhuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f160aea806.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\f160aea806.exe" axplong.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 194 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000028001\b034620509.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
file.exeaxplong.exef160aea806.exeecad5f0362.exeskotes.exe917086e598.exe6b0f3adeb2.exe78305aca71.exeaxplong.exeskotes.exeaxplong.exeskotes.exepid process 3920 file.exe 6136 axplong.exe 7120 f160aea806.exe 4316 ecad5f0362.exe 6160 skotes.exe 1892 917086e598.exe 2792 6b0f3adeb2.exe 4808 78305aca71.exe 4940 axplong.exe 2484 skotes.exe 3232 axplong.exe 6512 skotes.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
gold.exe12dsvc.exeneedmoney.execrypted.exerstxdhuj.execccc2.exeneon.exedescription pid process target process PID 5948 set thread context of 1540 5948 gold.exe RegAsm.exe PID 5436 set thread context of 4748 5436 12dsvc.exe RegAsm.exe PID 3920 set thread context of 1968 3920 needmoney.exe svchost015.exe PID 3020 set thread context of 820 3020 crypted.exe RegAsm.exe PID 5012 set thread context of 6896 5012 rstxdhuj.exe InstallUtil.exe PID 6756 set thread context of 4568 6756 cccc2.exe RegAsm.exe PID 6204 set thread context of 4436 6204 neon.exe InstallUtil.exe PID 6204 set thread context of 5604 6204 neon.exe InstallUtil.exe -
Drops file in Windows directory 3 IoCs
Processes:
file.exeNework.exeecad5f0362.exedescription ioc process File created C:\Windows\Tasks\axplong.job file.exe File created C:\Windows\Tasks\Hkbsse.job Nework.exe File created C:\Windows\Tasks\skotes.job ecad5f0362.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 7024 3440 WerFault.exe LummaC222222.exe -
System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Nework.exeHkbsse.exegerdaplay3se.exeLummaC222222.exeInstallUtil.exeRegAsm.execccc2.exef160aea806.exeneon.exe12dsvc.exestealc_default2.exestories.exenewbundle2.exerstxdhuj.exepowershell.exepowershell.exeneedmoney.exepenis.exeRegAsm.exe917086e598.exe78305aca71.exeRegAsm.exeskotes.exetpK5jyT5Rd.exeCFvbTXbM2h.exesvchost015.exeecad5f0362.exe6b0f3adeb2.exeb034620509.exefile.exeRegAsm.exestories.tmpcrypted.exeaxplong.exegold.exeneon.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gerdaplay3se.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LummaC222222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cccc2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f160aea806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12dsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stories.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language newbundle2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rstxdhuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language needmoney.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language penis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 917086e598.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78305aca71.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpK5jyT5Rd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFvbTXbM2h.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecad5f0362.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b0f3adeb2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b034620509.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stories.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gold.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neon.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid process 4036 cmd.exe 3476 PING.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
stealc_default2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exechrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
chrome.exechrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133718969322561339" chrome.exe -
Processes:
RegAsm.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
InstallUtil.exepid process 6896 InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exeaxplong.exestealc_default2.exestories.tmpCFvbTXbM2h.exepid process 3920 file.exe 3920 file.exe 6136 axplong.exe 6136 axplong.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 1796 stories.tmp 1796 stories.tmp 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 3052 stealc_default2.exe 3052 stealc_default2.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe 5572 CFvbTXbM2h.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
b034620509.exepid process 2092 b034620509.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exechrome.exepid process 5756 chrome.exe 5756 chrome.exe 7024 chrome.exe 7024 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
penis.exeCFvbTXbM2h.exerstxdhuj.exeInstallUtil.exeRegAsm.exepowershell.exenewbundle2.exepowershell.exeneon.exechrome.exedescription pid process Token: SeDebugPrivilege 4872 penis.exe Token: SeBackupPrivilege 4872 penis.exe Token: SeSecurityPrivilege 4872 penis.exe Token: SeSecurityPrivilege 4872 penis.exe Token: SeSecurityPrivilege 4872 penis.exe Token: SeSecurityPrivilege 4872 penis.exe Token: SeDebugPrivilege 5572 CFvbTXbM2h.exe Token: SeDebugPrivilege 5012 rstxdhuj.exe Token: SeDebugPrivilege 5012 rstxdhuj.exe Token: SeDebugPrivilege 6896 InstallUtil.exe Token: SeDebugPrivilege 820 RegAsm.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeDebugPrivilege 1688 newbundle2.exe Token: SeDebugPrivilege 2740 powershell.exe Token: SeDebugPrivilege 6896 InstallUtil.exe Token: SeDebugPrivilege 6204 neon.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe Token: SeShutdownPrivilege 5756 chrome.exe Token: SeCreatePagefilePrivilege 5756 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
file.exeNework.exestories.tmpb034620509.exechrome.exepid process 3920 file.exe 5988 Nework.exe 1796 stories.tmp 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
b034620509.exechrome.exepid process 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 5756 chrome.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe 2092 b034620509.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 6896 InstallUtil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exeaxplong.exegold.exe12dsvc.exeRegAsm.exeNework.exeHkbsse.exestories.exestories.tmpneedmoney.exedescription pid process target process PID 3920 wrote to memory of 6136 3920 file.exe axplong.exe PID 3920 wrote to memory of 6136 3920 file.exe axplong.exe PID 3920 wrote to memory of 6136 3920 file.exe axplong.exe PID 6136 wrote to memory of 5948 6136 axplong.exe gold.exe PID 6136 wrote to memory of 5948 6136 axplong.exe gold.exe PID 6136 wrote to memory of 5948 6136 axplong.exe gold.exe PID 5948 wrote to memory of 1540 5948 gold.exe RegAsm.exe PID 5948 wrote to memory of 1540 5948 gold.exe RegAsm.exe PID 5948 wrote to memory of 1540 5948 gold.exe RegAsm.exe PID 5948 wrote to memory of 1540 5948 gold.exe RegAsm.exe PID 5948 wrote to memory of 1540 5948 gold.exe RegAsm.exe PID 5948 wrote to memory of 1540 5948 gold.exe RegAsm.exe PID 5948 wrote to memory of 1540 5948 gold.exe RegAsm.exe PID 5948 wrote to memory of 1540 5948 gold.exe RegAsm.exe PID 6136 wrote to memory of 5436 6136 axplong.exe 12dsvc.exe PID 6136 wrote to memory of 5436 6136 axplong.exe 12dsvc.exe PID 6136 wrote to memory of 5436 6136 axplong.exe 12dsvc.exe PID 6136 wrote to memory of 5988 6136 axplong.exe Nework.exe PID 6136 wrote to memory of 5988 6136 axplong.exe Nework.exe PID 6136 wrote to memory of 5988 6136 axplong.exe Nework.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 5436 wrote to memory of 4748 5436 12dsvc.exe RegAsm.exe PID 4748 wrote to memory of 5252 4748 RegAsm.exe tpK5jyT5Rd.exe PID 4748 wrote to memory of 5252 4748 RegAsm.exe tpK5jyT5Rd.exe PID 4748 wrote to memory of 5252 4748 RegAsm.exe tpK5jyT5Rd.exe PID 4748 wrote to memory of 5572 4748 RegAsm.exe CFvbTXbM2h.exe PID 4748 wrote to memory of 5572 4748 RegAsm.exe CFvbTXbM2h.exe PID 4748 wrote to memory of 5572 4748 RegAsm.exe CFvbTXbM2h.exe PID 5988 wrote to memory of 2776 5988 Nework.exe Hkbsse.exe PID 5988 wrote to memory of 2776 5988 Nework.exe Hkbsse.exe PID 5988 wrote to memory of 2776 5988 Nework.exe Hkbsse.exe PID 6136 wrote to memory of 3052 6136 axplong.exe stealc_default2.exe PID 6136 wrote to memory of 3052 6136 axplong.exe stealc_default2.exe PID 6136 wrote to memory of 3052 6136 axplong.exe stealc_default2.exe PID 2776 wrote to memory of 2568 2776 Hkbsse.exe stories.exe PID 2776 wrote to memory of 2568 2776 Hkbsse.exe stories.exe PID 2776 wrote to memory of 2568 2776 Hkbsse.exe stories.exe PID 2568 wrote to memory of 1796 2568 stories.exe stories.tmp PID 2568 wrote to memory of 1796 2568 stories.exe stories.tmp PID 2568 wrote to memory of 1796 2568 stories.exe stories.tmp PID 6136 wrote to memory of 3920 6136 axplong.exe needmoney.exe PID 6136 wrote to memory of 3920 6136 axplong.exe needmoney.exe PID 6136 wrote to memory of 3920 6136 axplong.exe needmoney.exe PID 6136 wrote to memory of 4872 6136 axplong.exe penis.exe PID 6136 wrote to memory of 4872 6136 axplong.exe penis.exe PID 6136 wrote to memory of 4872 6136 axplong.exe penis.exe PID 1796 wrote to memory of 5896 1796 stories.tmp gerdaplay3se.exe PID 1796 wrote to memory of 5896 1796 stories.tmp gerdaplay3se.exe PID 1796 wrote to memory of 5896 1796 stories.tmp gerdaplay3se.exe PID 6136 wrote to memory of 3020 6136 axplong.exe crypted.exe PID 6136 wrote to memory of 3020 6136 axplong.exe crypted.exe PID 6136 wrote to memory of 3020 6136 axplong.exe crypted.exe PID 3920 wrote to memory of 1968 3920 needmoney.exe svchost015.exe PID 3920 wrote to memory of 1968 3920 needmoney.exe svchost015.exe PID 3920 wrote to memory of 1968 3920 needmoney.exe svchost015.exe PID 3920 wrote to memory of 1968 3920 needmoney.exe svchost015.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Roaming\tpK5jyT5Rd.exe"C:\Users\Admin\AppData\Roaming\tpK5jyT5Rd.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5252 -
C:\Users\Admin\AppData\Roaming\CFvbTXbM2h.exe"C:\Users\Admin\AppData\Roaming\CFvbTXbM2h.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\is-TMB2Q.tmp\stories.tmp"C:\Users\Admin\AppData\Local\Temp\is-TMB2Q.tmp\stories.tmp" /SL5="$F0238,3580803,56832,C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Fido Video Recorder\gerdaplay3se.exe"C:\Users\Admin\AppData\Local\Fido Video Recorder\gerdaplay3se.exe" -i8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:820 -
C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 12205⤵
- Program crash
PID:7024 -
C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe"C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6756 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\1000354001\f160aea806.exe"C:\Users\Admin\AppData\Local\Temp\1000354001\f160aea806.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:7120 -
C:\Users\Admin\AppData\Local\Temp\1000355001\ecad5f0362.exe"C:\Users\Admin\AppData\Local\Temp\1000355001\ecad5f0362.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:6160 -
C:\Users\Admin\AppData\Local\Temp\1000023001\917086e598.exe"C:\Users\Admin\AppData\Local\Temp\1000023001\917086e598.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:1892 -
C:\Users\Admin\1000026002\6b0f3adeb2.exe"C:\Users\Admin\1000026002\6b0f3adeb2.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1000028001\b034620509.exe"C:\Users\Admin\AppData\Local\Temp\1000028001\b034620509.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd7⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5756 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9c6efcc40,0x7ff9c6efcc4c,0x7ff9c6efcc588⤵PID:6892
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,11588121819490018887,14258175428082381418,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1900 /prefetch:28⤵PID:6940
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,11588121819490018887,14258175428082381418,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2220 /prefetch:38⤵PID:7012
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,11588121819490018887,14258175428082381418,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2460 /prefetch:88⤵PID:7076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,11588121819490018887,14258175428082381418,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:18⤵PID:6824
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,11588121819490018887,14258175428082381418,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:18⤵PID:6820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4576,i,11588121819490018887,14258175428082381418,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4572 /prefetch:88⤵PID:4084
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4772,i,11588121819490018887,14258175428082381418,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4788 /prefetch:88⤵PID:6100
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd7⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:7024 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9c6efcc40,0x7ff9c6efcc4c,0x7ff9c6efcc588⤵PID:6308
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2344,i,16398006863227163237,14666032427564956807,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=2336 /prefetch:28⤵PID:6428
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1836,i,16398006863227163237,14666032427564956807,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=2440 /prefetch:38⤵PID:6572
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1992,i,16398006863227163237,14666032427564956807,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=2572 /prefetch:88⤵PID:6356
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,16398006863227163237,14666032427564956807,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=3164 /prefetch:18⤵PID:6740
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,16398006863227163237,14666032427564956807,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=3204 /prefetch:18⤵PID:7040
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4624,i,16398006863227163237,14666032427564956807,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=4640 /prefetch:88⤵PID:5220
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4844,i,16398006863227163237,14666032427564956807,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=4776 /prefetch:88⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\1000029001\78305aca71.exe"C:\Users\Admin\AppData\Local\Temp\1000029001\78305aca71.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:6204 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4036 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 96⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3476 -
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"6⤵
- Adds Run key to start application
PID:6228 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"5⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\neon.exe"C:\Users\Admin\AppData\Local\Temp\neon.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\neon.exe"C:\Users\Admin\AppData\Local\Temp\neon.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"5⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:5604 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵
- Command and Scripting Interpreter: PowerShell
PID:1780 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵PID:2196
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6896 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4756 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:81⤵PID:5064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2332,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:31⤵PID:6080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3440 -ip 34401⤵PID:7000
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:5464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:5852
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2484
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4940
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3232
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:4452
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6512
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4900
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2824
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Query Registry
7Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
3.1MB
MD5b71921f2232bdf0efb1408be8655922d
SHA1a9f94ff9ce207cf80a2c10abd60e4d30d1bfa37e
SHA256457554183ac05321fce7b46d4ad93f2b6324f3ea5de30b6d8ee4a591bf07b1fc
SHA512279388939a3a8d707d3417f34de223d1a2dd553755a08588406b0ea07ea1fd7609f8473e81ae25cf2d17aca66da2e2288492282e92329a88fb526e2c3d760c37
-
Filesize
116KB
MD5ab1632680f4d6b9237e292eb566dd0c1
SHA1ccc94fdb89e7d625bbdbfb8ad99d3f39dcb6c923
SHA2566666beb79fc7eca6f6365707b940538ed4af9eea0370f3934adade3ca4e4f788
SHA5121db702e579e1e0112f1e4b6d0a793446c08d387c097d3bfdc9453874996b9ed0613f45d86a5246c425cb995137ef68d492bb0d5c9bce4311cb5ad786351a9312
-
Filesize
40B
MD54fd2e1e0ee89ab2efcf64b13813dfb57
SHA1f1469469ac1884f002fbe3cba1d8be88cfdf39af
SHA256b94064c9e6abef05638da45947d0760325acfec963626406aa73bdeb3f3e77a6
SHA512f28e540f5e356191f33a7e5cb091d9e6fcafac73a94e87d6b96823ff9cd8d914ed319cb3ad1ea76a5e788b7637826b6b5fa6b3a6c96f24353c0c44f9ce0b00cc
-
Filesize
649B
MD5193c0deba43d7778606503df5e6590a1
SHA1adb8f92d4dcbf83f7d5f07219f8c99a329dbccf8
SHA2566b5158102f226f10543d95774eae68a95c94186975b6b74e0afe1f4c49a65d8f
SHA51283fae181f79d2b75cc9b666739c2fc07bb241a6386c8943498d463a9fa99c09c79ec330fdb39ca23ac21de93c73347020ad5d81bcf7809a3a159952b21cb8581
-
Filesize
264B
MD50caacca544ce1133cb13e899cac6b1bd
SHA12e92f3049d543bd8265a11d68b77fd568cda9f33
SHA2562a7f43c6829aed9393f8b249a16b669ae47de5b740e6a46f14c8fdd5be48676c
SHA512d4e2d74f201637995e6937422cdc6ea647187f9e0e9b7420eee1629c3cbc32a91700c97719d70b779192695ba921a68985396a90c38756c3829e60b40337e3f8
-
Filesize
2KB
MD5f479a547fc9e48b23a421e7a6f0703b6
SHA1493915628353895d7a1ea2f5765cb83f69db66d5
SHA256ec8957c9312fe24d70de85359ef7739c9ac33877f3bb2561f56230a019d78542
SHA512fb16198976122f9ffe92742a4e83eb8bfae8fab8d6b867f4a8084158d508e477627c5780a2e5633f14971ea9edb5a9c6d3c399651afa53019fbfe4a07d1efbda
-
Filesize
859B
MD5455125f49358f4f7af775e6bbc346024
SHA160a9992476d6c0939c6d2623bf90f9c9c5a86a89
SHA25615f9dd9efd7a489f0ca1d86e8fdee424f2ad1cbc300b88d8a52648795c49cedb
SHA51247281a0c9cc9a70a1066451f740c40a5a17b2fd3db01a3fad5ead11d9cf5f1f2942d8f489f0e98843f155f299c3b77d409bbee20393fd9b8aef2fe6f059f9565
-
Filesize
859B
MD5c12e5a58911018e4d161ebb85cd9bb27
SHA14eb9be72ea6dfed623ba85ebf890b23156c57c1a
SHA25694809bd2a3191c68ef29d1b0d662a9b093ac07d8742e4f06e732e2ed5b8beefd
SHA512027dcfb917095377d883b3fcab252bc38206d5b64c94cfd3eb47c106f166e5ed0fd12ad2692388dcbc15c567c02b5beec8ac5f9eb01da8e9c06f4db1d34c84d0
-
Filesize
9KB
MD522b643ff182c8ddda45ab0aa55977dca
SHA1a0889a7c9323b65d890a58d4859fd93d5e8e23b1
SHA256f55c0231c96242db1a78eccf64f317d91df9f3a0105fdd380d46147e32496d42
SHA5128e66bf53f62c1376f1b77b6f46e52b4ed30b34519ee35a77382625fc3e69d3f33e7ef53981d10ea3ddc84026fa05986d7df7cea530977223a809524adc7154e3
-
Filesize
9KB
MD58fe26aef6d212a13ae59cad9da9dc5c1
SHA1d5d9bac31a169c3c1597a0346d4dd3f9d0e95d71
SHA256387342bc21b7340600b519590a4e99db4aad5c4a88f1b7212696d97d89c98043
SHA5127e9e5724515d63d0859d937d91160bad54e9d6e7bcbda1c32b137ed6ea8f268ebd0eabfba638e3c62b8596cee65405ae1c01c818f11e08c93babce014be2c08f
-
Filesize
10KB
MD5bea1a702f213795e8b2caf6534e6a7c6
SHA138a5a7aaa50783364bcf45836cd2a89e22171f1f
SHA256ca5947fd3a16fe3470dbdabf1302f88e06bd2ba3802afc83a4e27ec83f696b76
SHA51233a17b1dbaba838632517b705dd4a426c6658cc200c107d081feb66869531e07d0c73938fc9e57f86f49225302f1cb4dd5ad8801080354b4f4482d4fd77a1b86
-
Filesize
10KB
MD5a628839beec3e932e183cdd26d62f8a6
SHA135c3786429ecb292d156702140ec66addb6387dd
SHA2564df22bdbbe8dcf70f8e3698b4afbb16a10e145eb41f2da6f215165a43ae0d1ae
SHA512fa6caae0cb079e173ed90cd884dae4b7773746896ca1d7d5759c914a735fbaab56f60d44d203be18194d26500388eb7476b672c0fc7fdfd62d9db3630d6cd425
-
Filesize
9KB
MD5c2d8c505662bc72aa4631743b57814d6
SHA136e7ad151b9f85564ec23d5c1af5d5dc258aee2f
SHA2562a5b3d741e8ddafc156385be3c871f7c11fa818fa4b0a1bfd507b9314c4cc3a2
SHA5125baf09c09dde02959f0c74a17ca0f9db51fe7d7e9e37ab92955f7ce8a2e0a20d3cd2a56b6a71aed807d9b5ed0ce6e0646518f9e222806e4c5fca27a72beafaa5
-
Filesize
15KB
MD57d5eec640a2436510b720931d396c6a3
SHA1cf9eabcf316c81991240ac37da7d76c7a5664819
SHA2565ffed94a8149dcfaef9d9906172511936dca8a05afe6cb8d22f86cd460b0f099
SHA512030d1dcf88d5c8bb3542f8a29bc091c81f27bc45b2b64a2125dc30d49f194d041d07dfdea2b0719ef39c7c9dad434f4ec63a69abbe7553e921496efc5d4e6065
-
Filesize
212KB
MD55770e865cb4afe9c1a0cbf0f3d18541e
SHA19b576388100aef292a8aeb85e00d55be445368e0
SHA2565a12d6750b6832a4f4f68ed5e3c309caedabd8713f9e54a323fa9736b1010795
SHA51201a0d8a02e755b9b9f571ab5f16174ce587f42680eeb770b875715f88d7ccabc52b6ff9821a05edf6e5961bb5075a36bf0c7732def0371195abb05a4669a7ced
-
Filesize
212KB
MD5f7569326df29c17e153bb3bd4f00e8da
SHA1ec7e77482b8ad5ae96c83667c6871d733781df92
SHA25666371f38f3e006955948ea9dc7f3e76c764581310205ddc9270a5688251b2776
SHA51265121c2bfc9d04ecc7a8a479592453801f9cb9e0af45c7ea67678fa182667167c6e5466d081a084f7918fe71e1460d2570a7d69d3ccadd1126190519250481c0
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
18KB
MD5ebc7ded63e5de0a93f33b0343741a584
SHA1d5dcd61b3ffca4c5dd45e881f12664f6af718a73
SHA256e4ee920e7c2de6df679903c43a400c0bdf9ea2f7dd18d40c1fc0ec6c18b2b95c
SHA5120b44b14029493a247c75542431dd338931c27d37defb28ee499d2d3760e7f0c91d087f0db6ab7781c694f464b9b695a186e664a4eabf06d2f07c1b82acfc7ca1
-
Filesize
312KB
MD5389881b424cf4d7ec66de13f01c7232a
SHA1d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA2569d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA5122b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96
-
Filesize
882KB
MD584263ab03b0a0f2b51cc11b93ec49c9f
SHA1e6457eb0e0131bec70a2fd4d4a943314f0bd28d4
SHA2567d6e4e01c452dd502361640ee095e2bee35e3f55fd11edc9e94c3580d2c132b5
SHA512db35a02345b5166077e300524675c523a8b4082fa62fc151c0797141348cae5e173eeaec5ad1e95556e048ea6ed34a78b90b1184420557c53cd91f351417ebb2
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
1.1MB
MD5cda0b8ef0af532cf29045c06142ce1f8
SHA139b7bd4dadc3172152d727dd9633916ae1a8fd7d
SHA2563129cc8fa8430ac67ed710a05d4227d636612387b02125b8006117c40c79e5b6
SHA51240f6209a1b41e952eb5b96cadcfa87bdc5a9ceaf7f1f438beff20378d620eada3031485b179ef58920d23d6563324269206a2243d0cfb3ad58811827d39071f2
-
Filesize
3.7MB
MD544d2f50470151f8d8b2d9c3e3c5f7681
SHA1391405dd4e12bfa4120beb333bb9bf96ba57d24c
SHA2560df73688dc7f5f8a9734d4459a723619046a07f537bc9a50be18ac28dc69e93f
SHA5121bcc2727b9ee91e28a8d2912114220748d1657eede652552b795d5ca20e217873e6e043acccb96bcfd0d762c35de94e3f82e5cfd074fc4dbafcecf18720b16fb
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
4.1MB
MD57fa5c660d124162c405984d14042506f
SHA169f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c
-
Filesize
409KB
MD5a21700718c70ec5e787ad373cb72a757
SHA1027554ab5ff3245e7617f3b83d6548bf7919f92e
SHA25687e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
SHA512ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b
-
Filesize
314KB
MD5ff5afed0a8b802d74af1c1422c720446
SHA17135acfa641a873cb0c4c37afc49266bfeec91d8
SHA25617ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
SHA51211724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac
-
Filesize
352KB
MD52f1d09f64218fffe7243a8b44345b27e
SHA172553e1b3a759c17f54e7b568f39b3f8f1b1cdbe
SHA2564a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2
SHA5125871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909
-
Filesize
304KB
MD558e8b2eb19704c5a59350d4ff92e5ab6
SHA1171fc96dda05e7d275ec42840746258217d9caf0
SHA25607d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
SHA512e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
-
Filesize
963KB
MD51ef39c8bc5799aa381fe093a1f2d532a
SHA157eabb02a7c43c9682988227dd470734cc75edb2
SHA2560cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
SHA51213a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682
-
Filesize
359KB
MD56b470f7251aa9c14d7daea8f6446e217
SHA1a256c54d4dd7e0a7a1582d8fdfef5807bc3c4af4
SHA2568b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f
SHA512fdc553c9d2ff19343dd99b0b34c875752df4fa0cbd494096aeb51d859bd102448f1a5043a53a808045ae52077f180546a134b1aa69db4dc04aff2610fadeaca4
-
Filesize
1.8MB
MD52ff9d81435c7d755cb5a6b975ed50ce6
SHA1a588fbde21ac7335c3b516db6ccaa783eb2a088c
SHA256162e527a19799d2d3ace95ca315eba1ffa0fd4fd3eac247a26b41212033b2863
SHA51246688a8fb90c3b3bcb926e6b37129ebd45297283150e61450b685f792d20f7d5d2d88ea2487f73dd76d6e20b513f43ba143ff9d321b47f4f4563287e02a9e235
-
Filesize
1.8MB
MD50b827d78c350317ad56fd6766cad6d6b
SHA1945e3976cf4ea5c49be33b937b99db681c8c6ea3
SHA2565376f10da390a072fa7e46618705e38c8e4854a7d6cf89d82e5df409a22c033b
SHA51256f6c01386a83affd9944885091b088f83f122a0fe12683e3638b4cdfb5e4d2029703206ae1c8425283a8b6c30ea1ac5e526c9f3fb0a885e093be8feff592bc6
-
Filesize
3.5MB
MD5b3fd0e1003b1cd38402b6d32829f6135
SHA1c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA51204692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1
-
Filesize
1.8MB
MD52dbfc6089fd5e3b1aa8a004508a16a37
SHA120331e184251ff628c6e3593511fc6ab93349058
SHA25699bc61afdb7382ac8d7f9da3bb87ca552fe8596ded65bf39a81d2f7839bbc3d6
SHA51203f5390778ce28d28d6e4c60af50f0ee32f1e4adf1b0ea1958bd9897db919f63817f1a0df8b4b4ae03ac90d4e797a2a1db380f9fce9d6ef33575101c4a640629
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
692KB
MD5216d86f9c051d79f5b959f3513057472
SHA1e924fb25543fe8826bb3af4158e3dafe57798e0c
SHA256b997f60bd623876aaff1be08d562277d6c12c9988979b1bfb1fab5e1417a74af
SHA5129638df5d6b791f1dc856c86916a3039826d9031a67bb4e0ae2fcee1edcba8fa091258aa6bd63df232f3c771c6341f1b022bd72e89cbfda1c690afa190f922795
-
Filesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
Filesize
2.9MB
MD5b826dd92d78ea2526e465a34324ebeea
SHA1bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA2567824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA5121ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
-
Filesize
304KB
MD54e60f3fd76d9eab244f9dc00f7765b0b
SHA11a154d6e837e7105c551793131cde89f157c4330
SHA256d6945846cc23c01b9c9ad2b97d35b5a14c01f1a4cc2ec651a596f06777ba4fec
SHA51244727e25781f448579ac35aab94aff550ed9fe5ac58d95bd394569c62892dc78216ac687baa43cef66187ebe629f5dd9cd63ea274222d11dbef3440ec4d7f77a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2170637797-568393320-3232933035-1000\76b53b3ec448f7ccdda2063b15d2bfc3_76278eb0-9988-43b4-9423-af5897ebbcb4
Filesize2KB
MD596ea29aa27eeae734b98d73752aa0c27
SHA120a0e0760ed66758285d87e71d00e2630f41bb42
SHA2569a99e9e4e40bac7212cc350a3d480c94864336e052074f5e02f8b303b8b7f79b
SHA5124350e82b83682e702cb798804664bb83b4bfbd008f0f99c6883899319633f75a9ac4883940813a4681c4bad0a0a504d489821d0b3f5e13240db872c5ad5a046d
-
Filesize
356KB
MD5a3ef9920a91b891837705e46bb26de17
SHA19cfbcd0f46ec86fb57d3d6d74a064f9098adf117
SHA256171cef885f6c285e995ce3ec5960c5ea4e4ed049cec362745058fee39e4136cc
SHA512c65e91091b95c3aba0af7df4ed6543d26bcb5b54d6fab82f9d2ac1ba156f475f98124a1a0e8851d69be23b1dc945c76c075cd32515203273260802e1224dbd6e
-
Filesize
2KB
MD5c8a10028bbb73446ea5615382727894e
SHA17d00da95caecfd25c823bee36b22c1a1dcbe2d75
SHA256e8d228573eb38777a6b1a7ba346668194af007bc162a31033d9503b5d6e5fca8
SHA512fc16296673a4ca01558fdc9e0a13b03056aeaf1c45667539d4d7176cac71f12d55e0c461417ee61135273e34c21f7704a5ef836fd64e379673c084d5ff6bf84e
-
Filesize
2KB
MD5aac5f4ec2d1c4c6de526c560be1321a7
SHA1ad0bf4e7a78040add16b8c5b0c7c1c8e379eef92
SHA2568cc07a2f0d7d04b149bcd0a6a54823428e267a69816e07dc4173567c847f7f07
SHA5121e99f45d1884c97776d3e038fb509e3f48fa8fd89df4dd2709f1daa0af97e5afefc216a64f820a6ed753cf203fbe9a90aee09943dc782556db13b4d8bf21fa2b