Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:59
Static task
static1
General
-
Target
cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe
-
Size
2.8MB
-
MD5
b6009d2baed73bc321b38ce9a13f875c
-
SHA1
9759ef65ae6e3e50b9eaea5708babde594950014
-
SHA256
cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c
-
SHA512
9f831efce03a9dd2c47547fd32d66256160937e687ab0e7d555f0f05e490e2283ca1333caea8ed0cdb90f2c6762ed53cf38c563cb8fe57463923ded5e876657e
-
SSDEEP
49152:cUPK0E5y8r2i4fPnilRQkyuN+iBvVZ+DTKy:cKK0E88Si4HnilFFsKy
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
cryptbot
Extracted
lumma
Signatures
-
Amadey family
-
Cryptbot family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" c80d83d60b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" c80d83d60b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" c80d83d60b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" JYXGU759K5GIAW9LSZBENSG6M6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection c80d83d60b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" c80d83d60b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" c80d83d60b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" JYXGU759K5GIAW9LSZBENSG6M6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" JYXGU759K5GIAW9LSZBENSG6M6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" JYXGU759K5GIAW9LSZBENSG6M6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" JYXGU759K5GIAW9LSZBENSG6M6.exe -
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 2912 created 1184 2912 8ac941fe04.exe 21 PID 788 created 1184 788 b6ae3bae86.exe 21 -
Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 4735f44897.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 391d4173a7.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 17 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 660328cc89.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 391d4173a7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6b7949b2f3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8ac941fe04.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f38f746535.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 83f1f406f7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b6ae3bae86.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c91dd65cf6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c80d83d60b.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c687bf5d10.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4735f44897.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 136a0fec85.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ JYXGU759K5GIAW9LSZBENSG6M6.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 352 powershell.exe 12248 powershell.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 34 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 83f1f406f7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 660328cc89.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 136a0fec85.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 391d4173a7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b6ae3bae86.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4735f44897.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6b7949b2f3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8ac941fe04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c687bf5d10.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b6ae3bae86.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f38f746535.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 83f1f406f7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c80d83d60b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c687bf5d10.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c80d83d60b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion JYXGU759K5GIAW9LSZBENSG6M6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 391d4173a7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6b7949b2f3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 136a0fec85.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion JYXGU759K5GIAW9LSZBENSG6M6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 660328cc89.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8ac941fe04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c91dd65cf6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c91dd65cf6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4735f44897.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f38f746535.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe -
Executes dropped EXE 44 IoCs
pid Process 1992 axplong.exe 2772 6b7949b2f3.exe 2912 8ac941fe04.exe 2500 c687bf5d10.exe 1404 skotes.exe 1612 4735f44897.exe 2524 136a0fec85.exe 2768 f38f746535.exe 2508 83f1f406f7.exe 2504 c91dd65cf6.exe 2776 69e3170b45.exe 1440 c80d83d60b.exe 3520 zudFSfy.exe 3860 2d6fe371ec.exe 2068 7z.exe 3336 7z.exe 3540 7z.exe 748 7z.exe 3624 7z.exe 2684 7z.exe 2808 JYXGU759K5GIAW9LSZBENSG6M6.exe 1972 7z.exe 2288 7z.exe 2876 in.exe 3296 kz8ZdyP.exe 3492 CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe 3856 660328cc89.exe 1300 a4f7f90998.exe 2180 zudFSfy.exe 11812 391d4173a7.exe 12108 kz8ZdyP.exe 824 Intel_PTT_EK_Recertification.exe 11788 323985c50f.exe 788 b6ae3bae86.exe 2156 478aef8cbe.exe 3424 478aef8cbe.exe 4216 795fad6e15.exe 4176 795fad6e15.exe 4120 a4f7f90998.exe 4128 a4f7f90998.exe 4136 a4f7f90998.exe 864 a4f7f90998.exe 1864 a4f7f90998.exe 3668 Intel_PTT_EK_Recertification.exe -
Identifies Wine through registry keys 2 TTPs 17 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 4735f44897.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine JYXGU759K5GIAW9LSZBENSG6M6.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 660328cc89.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 391d4173a7.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 8ac941fe04.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 136a0fec85.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine f38f746535.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 83f1f406f7.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine c91dd65cf6.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 6b7949b2f3.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine c687bf5d10.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine b6ae3bae86.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine c80d83d60b.exe -
Loads dropped DLL 64 IoCs
pid Process 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 1992 axplong.exe 1992 axplong.exe 1992 axplong.exe 1992 axplong.exe 1992 axplong.exe 2500 c687bf5d10.exe 1992 axplong.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 3228 cmd.exe 2068 7z.exe 3228 cmd.exe 3336 7z.exe 3228 cmd.exe 3540 7z.exe 3228 cmd.exe 748 7z.exe 3228 cmd.exe 3624 7z.exe 3228 cmd.exe 2684 7z.exe 2508 83f1f406f7.exe 2508 83f1f406f7.exe 3228 cmd.exe 1972 7z.exe 3228 cmd.exe 2288 7z.exe 3228 cmd.exe 3228 cmd.exe 1404 skotes.exe 1404 skotes.exe 2508 83f1f406f7.exe 2508 83f1f406f7.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 3520 zudFSfy.exe 1404 skotes.exe 1404 skotes.exe 3296 kz8ZdyP.exe 11652 taskeng.exe 11652 taskeng.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 1404 skotes.exe 2156 478aef8cbe.exe 1404 skotes.exe 1404 skotes.exe 4216 795fad6e15.exe 1300 a4f7f90998.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features c80d83d60b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" c80d83d60b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" JYXGU759K5GIAW9LSZBENSG6M6.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\69e3170b45.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1017317001\\69e3170b45.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\c80d83d60b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1017318001\\c80d83d60b.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\6b7949b2f3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1007348001\\6b7949b2f3.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\c687bf5d10.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1007350001\\c687bf5d10.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\83f1f406f7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1017315001\\83f1f406f7.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\c91dd65cf6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1017316001\\c91dd65cf6.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0005000000019c0b-245.dat autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 1992 axplong.exe 2772 6b7949b2f3.exe 2912 8ac941fe04.exe 2500 c687bf5d10.exe 1404 skotes.exe 1612 4735f44897.exe 2524 136a0fec85.exe 2768 f38f746535.exe 2508 83f1f406f7.exe 2504 c91dd65cf6.exe 1440 c80d83d60b.exe 2808 JYXGU759K5GIAW9LSZBENSG6M6.exe 3492 CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe 3856 660328cc89.exe 11812 391d4173a7.exe 788 b6ae3bae86.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 3520 set thread context of 2180 3520 zudFSfy.exe 95 PID 3296 set thread context of 12108 3296 kz8ZdyP.exe 97 PID 824 set thread context of 11824 824 Intel_PTT_EK_Recertification.exe 102 PID 2156 set thread context of 3424 2156 478aef8cbe.exe 113 PID 4216 set thread context of 4176 4216 795fad6e15.exe 117 PID 3668 set thread context of 1592 3668 Intel_PTT_EK_Recertification.exe 124 -
resource yara_rule behavioral1/memory/2876-552-0x000000013F450000-0x000000013F8E0000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job c687bf5d10.exe File created C:\Windows\Tasks\axplong.job cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 660328cc89.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kz8ZdyP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b7949b2f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ac941fe04.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 69e3170b45.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c687bf5d10.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136a0fec85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69e3170b45.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478aef8cbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6ae3bae86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 795fad6e15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 391d4173a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c91dd65cf6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYXGU759K5GIAW9LSZBENSG6M6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 323985c50f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 795fad6e15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zudFSfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kz8ZdyP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478aef8cbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4735f44897.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2d6fe371ec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4f7f90998.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83f1f406f7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 69e3170b45.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c80d83d60b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zudFSfy.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4468 PING.EXE 2856 powershell.exe 3104 PING.EXE 11968 powershell.exe 2872 PING.EXE 4376 powershell.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 1956 taskkill.exe 2028 taskkill.exe 560 taskkill.exe 2620 taskkill.exe 2892 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings firefox.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 136a0fec85.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 136a0fec85.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 136a0fec85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 83f1f406f7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 83f1f406f7.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 4468 PING.EXE 3104 PING.EXE 2872 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 376 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 1992 axplong.exe 2772 6b7949b2f3.exe 2912 8ac941fe04.exe 2912 8ac941fe04.exe 2912 8ac941fe04.exe 2912 8ac941fe04.exe 2912 8ac941fe04.exe 448 dialer.exe 448 dialer.exe 448 dialer.exe 448 dialer.exe 2500 c687bf5d10.exe 1404 skotes.exe 1612 4735f44897.exe 1612 4735f44897.exe 1612 4735f44897.exe 1612 4735f44897.exe 1612 4735f44897.exe 1612 4735f44897.exe 2524 136a0fec85.exe 2768 f38f746535.exe 2508 83f1f406f7.exe 2504 c91dd65cf6.exe 2524 136a0fec85.exe 2524 136a0fec85.exe 2524 136a0fec85.exe 2524 136a0fec85.exe 2776 69e3170b45.exe 1440 c80d83d60b.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 1440 c80d83d60b.exe 1440 c80d83d60b.exe 2508 83f1f406f7.exe 2508 83f1f406f7.exe 2508 83f1f406f7.exe 2508 83f1f406f7.exe 2808 JYXGU759K5GIAW9LSZBENSG6M6.exe 2808 JYXGU759K5GIAW9LSZBENSG6M6.exe 2808 JYXGU759K5GIAW9LSZBENSG6M6.exe 2856 powershell.exe 3492 CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe 3492 CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe 3492 CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe 2808 JYXGU759K5GIAW9LSZBENSG6M6.exe 2808 JYXGU759K5GIAW9LSZBENSG6M6.exe 3856 660328cc89.exe 3856 660328cc89.exe 2180 zudFSfy.exe 2180 zudFSfy.exe 2180 zudFSfy.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe 11812 391d4173a7.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeDebugPrivilege 1956 taskkill.exe Token: SeDebugPrivilege 2028 taskkill.exe Token: SeDebugPrivilege 560 taskkill.exe Token: SeDebugPrivilege 2620 taskkill.exe Token: SeDebugPrivilege 2892 taskkill.exe Token: SeDebugPrivilege 2076 firefox.exe Token: SeDebugPrivilege 2076 firefox.exe Token: SeDebugPrivilege 1440 c80d83d60b.exe Token: SeRestorePrivilege 2068 7z.exe Token: 35 2068 7z.exe Token: SeSecurityPrivilege 2068 7z.exe Token: SeSecurityPrivilege 2068 7z.exe Token: SeRestorePrivilege 3336 7z.exe Token: 35 3336 7z.exe Token: SeSecurityPrivilege 3336 7z.exe Token: SeSecurityPrivilege 3336 7z.exe Token: SeRestorePrivilege 3540 7z.exe Token: 35 3540 7z.exe Token: SeSecurityPrivilege 3540 7z.exe Token: SeSecurityPrivilege 3540 7z.exe Token: SeRestorePrivilege 748 7z.exe Token: 35 748 7z.exe Token: SeSecurityPrivilege 748 7z.exe Token: SeSecurityPrivilege 748 7z.exe Token: SeRestorePrivilege 3624 7z.exe Token: 35 3624 7z.exe Token: SeSecurityPrivilege 3624 7z.exe Token: SeSecurityPrivilege 3624 7z.exe Token: SeRestorePrivilege 2684 7z.exe Token: 35 2684 7z.exe Token: SeSecurityPrivilege 2684 7z.exe Token: SeSecurityPrivilege 2684 7z.exe Token: SeRestorePrivilege 1972 7z.exe Token: 35 1972 7z.exe Token: SeSecurityPrivilege 1972 7z.exe Token: SeSecurityPrivilege 1972 7z.exe Token: SeRestorePrivilege 2288 7z.exe Token: 35 2288 7z.exe Token: SeSecurityPrivilege 2288 7z.exe Token: SeSecurityPrivilege 2288 7z.exe Token: SeDebugPrivilege 2856 powershell.exe Token: SeDebugPrivilege 2808 JYXGU759K5GIAW9LSZBENSG6M6.exe Token: SeDebugPrivilege 1300 a4f7f90998.exe Token: SeDebugPrivilege 2180 zudFSfy.exe Token: SeDebugPrivilege 12108 kz8ZdyP.exe Token: SeDebugPrivilege 11788 323985c50f.exe Token: SeDebugPrivilege 352 powershell.exe Token: SeDebugPrivilege 12248 powershell.exe Token: SeLockMemoryPrivilege 11824 explorer.exe Token: SeDebugPrivilege 11968 powershell.exe Token: SeLockMemoryPrivilege 1592 explorer.exe Token: SeDebugPrivilege 4376 powershell.exe -
Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 2500 c687bf5d10.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2076 firefox.exe 2076 firefox.exe 2076 firefox.exe 2076 firefox.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2076 firefox.exe 2076 firefox.exe 2076 firefox.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe 2776 69e3170b45.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1992 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 31 PID 2412 wrote to memory of 1992 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 31 PID 2412 wrote to memory of 1992 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 31 PID 2412 wrote to memory of 1992 2412 cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe 31 PID 1992 wrote to memory of 2772 1992 axplong.exe 33 PID 1992 wrote to memory of 2772 1992 axplong.exe 33 PID 1992 wrote to memory of 2772 1992 axplong.exe 33 PID 1992 wrote to memory of 2772 1992 axplong.exe 33 PID 1992 wrote to memory of 2912 1992 axplong.exe 34 PID 1992 wrote to memory of 2912 1992 axplong.exe 34 PID 1992 wrote to memory of 2912 1992 axplong.exe 34 PID 1992 wrote to memory of 2912 1992 axplong.exe 34 PID 2912 wrote to memory of 448 2912 8ac941fe04.exe 35 PID 2912 wrote to memory of 448 2912 8ac941fe04.exe 35 PID 2912 wrote to memory of 448 2912 8ac941fe04.exe 35 PID 2912 wrote to memory of 448 2912 8ac941fe04.exe 35 PID 2912 wrote to memory of 448 2912 8ac941fe04.exe 35 PID 2912 wrote to memory of 448 2912 8ac941fe04.exe 35 PID 1992 wrote to memory of 2500 1992 axplong.exe 36 PID 1992 wrote to memory of 2500 1992 axplong.exe 36 PID 1992 wrote to memory of 2500 1992 axplong.exe 36 PID 1992 wrote to memory of 2500 1992 axplong.exe 36 PID 2500 wrote to memory of 1404 2500 c687bf5d10.exe 37 PID 2500 wrote to memory of 1404 2500 c687bf5d10.exe 37 PID 2500 wrote to memory of 1404 2500 c687bf5d10.exe 37 PID 2500 wrote to memory of 1404 2500 c687bf5d10.exe 37 PID 1992 wrote to memory of 1612 1992 axplong.exe 38 PID 1992 wrote to memory of 1612 1992 axplong.exe 38 PID 1992 wrote to memory of 1612 1992 axplong.exe 38 PID 1992 wrote to memory of 1612 1992 axplong.exe 38 PID 1404 wrote to memory of 2524 1404 skotes.exe 40 PID 1404 wrote to memory of 2524 1404 skotes.exe 40 PID 1404 wrote to memory of 2524 1404 skotes.exe 40 PID 1404 wrote to memory of 2524 1404 skotes.exe 40 PID 1404 wrote to memory of 2768 1404 skotes.exe 41 PID 1404 wrote to memory of 2768 1404 skotes.exe 41 PID 1404 wrote to memory of 2768 1404 skotes.exe 41 PID 1404 wrote to memory of 2768 1404 skotes.exe 41 PID 1404 wrote to memory of 2508 1404 skotes.exe 42 PID 1404 wrote to memory of 2508 1404 skotes.exe 42 PID 1404 wrote to memory of 2508 1404 skotes.exe 42 PID 1404 wrote to memory of 2508 1404 skotes.exe 42 PID 1404 wrote to memory of 2504 1404 skotes.exe 43 PID 1404 wrote to memory of 2504 1404 skotes.exe 43 PID 1404 wrote to memory of 2504 1404 skotes.exe 43 PID 1404 wrote to memory of 2504 1404 skotes.exe 43 PID 1404 wrote to memory of 2776 1404 skotes.exe 45 PID 1404 wrote to memory of 2776 1404 skotes.exe 45 PID 1404 wrote to memory of 2776 1404 skotes.exe 45 PID 1404 wrote to memory of 2776 1404 skotes.exe 45 PID 2776 wrote to memory of 1956 2776 69e3170b45.exe 46 PID 2776 wrote to memory of 1956 2776 69e3170b45.exe 46 PID 2776 wrote to memory of 1956 2776 69e3170b45.exe 46 PID 2776 wrote to memory of 1956 2776 69e3170b45.exe 46 PID 2776 wrote to memory of 2028 2776 69e3170b45.exe 48 PID 2776 wrote to memory of 2028 2776 69e3170b45.exe 48 PID 2776 wrote to memory of 2028 2776 69e3170b45.exe 48 PID 2776 wrote to memory of 2028 2776 69e3170b45.exe 48 PID 2776 wrote to memory of 560 2776 69e3170b45.exe 50 PID 2776 wrote to memory of 560 2776 69e3170b45.exe 50 PID 2776 wrote to memory of 560 2776 69e3170b45.exe 50 PID 2776 wrote to memory of 560 2776 69e3170b45.exe 50 PID 2776 wrote to memory of 2620 2776 69e3170b45.exe 52 PID 2776 wrote to memory of 2620 2776 69e3170b45.exe 52 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 2836 attrib.exe 2592 attrib.exe 2872 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe"C:\Users\Admin\AppData\Local\Temp\cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1007348001\6b7949b2f3.exe"C:\Users\Admin\AppData\Local\Temp\1007348001\6b7949b2f3.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\1007349001\8ac941fe04.exe"C:\Users\Admin\AppData\Local\Temp\1007349001\8ac941fe04.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\1007350001\c687bf5d10.exe"C:\Users\Admin\AppData\Local\Temp\1007350001\c687bf5d10.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\1017313001\136a0fec85.exe"C:\Users\Admin\AppData\Local\Temp\1017313001\136a0fec85.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\1017314001\f38f746535.exe"C:\Users\Admin\AppData\Local\Temp\1017314001\f38f746535.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\1017315001\83f1f406f7.exe"C:\Users\Admin\AppData\Local\Temp\1017315001\83f1f406f7.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\JYXGU759K5GIAW9LSZBENSG6M6.exe"C:\Users\Admin\AppData\Local\Temp\JYXGU759K5GIAW9LSZBENSG6M6.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe"C:\Users\Admin\AppData\Local\Temp\CVH7O5A2YR8BVEQ3JK0Y90YILHNJ3.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3492
-
-
-
C:\Users\Admin\AppData\Local\Temp\1017316001\c91dd65cf6.exe"C:\Users\Admin\AppData\Local\Temp\1017316001\c91dd65cf6.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\1017317001\69e3170b45.exe"C:\Users\Admin\AppData\Local\Temp\1017317001\69e3170b45.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking7⤵PID:2124
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking8⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2076 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2076.0.1168598868\2084374367" -parentBuildID 20221007134813 -prefsHandle 1204 -prefMapHandle 1196 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {19027336-dbc8-4db5-9b5b-9fa9f1f177e6} 2076 "\\.\pipe\gecko-crash-server-pipe.2076" 1348 107ed558 gpu9⤵PID:3012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2076.1.1608270627\129403710" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {181e8f0c-7616-4d1a-8e87-a5e0037c6b7b} 2076 "\\.\pipe\gecko-crash-server-pipe.2076" 1508 43f3658 socket9⤵PID:1008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2076.2.521173753\1581597969" -childID 1 -isForBrowser -prefsHandle 2004 -prefMapHandle 2000 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 772 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {410237ba-9384-4d6f-9dfd-31ee5d232937} 2076 "\\.\pipe\gecko-crash-server-pipe.2076" 2016 19890e58 tab9⤵PID:1644
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2076.3.1857347914\1528067069" -childID 2 -isForBrowser -prefsHandle 2832 -prefMapHandle 2828 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 772 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {878ea1ad-563a-4ce9-bbcb-845931cb3bb7} 2076 "\\.\pipe\gecko-crash-server-pipe.2076" 2844 1b0db158 tab9⤵PID:580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2076.4.1865668913\1176014805" -childID 3 -isForBrowser -prefsHandle 3680 -prefMapHandle 1148 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 772 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dde8af15-05e6-4fa6-bcd8-ba2425dbab02} 2076 "\\.\pipe\gecko-crash-server-pipe.2076" 1140 1ebedc58 tab9⤵PID:3700
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2076.5.1866519519\728735698" -childID 4 -isForBrowser -prefsHandle 3804 -prefMapHandle 3808 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 772 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c526d6a-c46d-466b-b8cb-1286fad98b75} 2076 "\\.\pipe\gecko-crash-server-pipe.2076" 3792 1ebed058 tab9⤵PID:3716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2076.6.2045642883\14677251" -childID 5 -isForBrowser -prefsHandle 3968 -prefMapHandle 3972 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 772 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9417a289-1cb6-43eb-aa3e-520d16004937} 2076 "\\.\pipe\gecko-crash-server-pipe.2076" 3956 1ebee858 tab9⤵PID:3724
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1017318001\c80d83d60b.exe"C:\Users\Admin\AppData\Local\Temp\1017318001\c80d83d60b.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
-
C:\Users\Admin\AppData\Local\Temp\1017320001\2d6fe371ec.exe"C:\Users\Admin\AppData\Local\Temp\1017320001\2d6fe371ec.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3860 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"7⤵
- Loads dropped DLL
PID:3228 -
C:\Windows\system32\mode.commode 65,108⤵PID:3256
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3540
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"8⤵
- Views/modifies file attributes
PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"8⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe9⤵
- Views/modifies file attributes
PID:2592
-
-
C:\Windows\system32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe9⤵
- Views/modifies file attributes
PID:2836
-
-
C:\Windows\system32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE9⤵
- Scheduled Task/Job: Scheduled Task
PID:376
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe9⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.110⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3104
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:12108
-
-
-
C:\Users\Admin\AppData\Local\Temp\1017322001\660328cc89.exe"C:\Users\Admin\AppData\Local\Temp\1017322001\660328cc89.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3856
-
-
C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"7⤵
- Executes dropped EXE
PID:4120
-
-
C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"7⤵
- Executes dropped EXE
PID:4128
-
-
C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"7⤵
- Executes dropped EXE
PID:4136
-
-
C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"7⤵
- Executes dropped EXE
PID:864
-
-
C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"C:\Users\Admin\AppData\Local\Temp\1017323001\a4f7f90998.exe"7⤵
- Executes dropped EXE
PID:1864
-
-
-
C:\Users\Admin\AppData\Local\Temp\1017324001\391d4173a7.exe"C:\Users\Admin\AppData\Local\Temp\1017324001\391d4173a7.exe"6⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:11812
-
-
C:\Users\Admin\AppData\Local\Temp\1017325001\323985c50f.exe"C:\Users\Admin\AppData\Local\Temp\1017325001\323985c50f.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:11788 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\nrbyk"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:352
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:12248
-
-
-
C:\Users\Admin\AppData\Local\Temp\1017326001\b6ae3bae86.exe"C:\Users\Admin\AppData\Local\Temp\1017326001\b6ae3bae86.exe"6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:788
-
-
C:\Users\Admin\AppData\Local\Temp\1017327001\478aef8cbe.exe"C:\Users\Admin\AppData\Local\Temp\1017327001\478aef8cbe.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1017327001\478aef8cbe.exe"C:\Users\Admin\AppData\Local\Temp\1017327001\478aef8cbe.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3424
-
-
-
C:\Users\Admin\AppData\Local\Temp\1017328001\795fad6e15.exe"C:\Users\Admin\AppData\Local\Temp\1017328001\795fad6e15.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\1017328001\795fad6e15.exe"C:\Users\Admin\AppData\Local\Temp\1017328001\795fad6e15.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4176
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1007351001\4735f44897.exe"C:\Users\Admin\AppData\Local\Temp\1007351001\4735f44897.exe"4⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1612
-
-
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:448
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1816
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {ED1E929E-BDCC-4619-8519-39458289C67E} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Loads dropped DLL
PID:11652 -
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:824 -
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:11824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- Drops file in System32 directory
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
PID:11968 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2872
-
-
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3668 -
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- Drops file in System32 directory
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4376 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4468
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Query Registry
7Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\activity-stream.discovery_stream.json.tmp
Filesize31KB
MD5eacd755ac8843673d4ae058bf929ce77
SHA12657ae6f96afb882294ca3e6e2c1a98b3ba100a5
SHA256d7f6d9b425525dfc47c60a090c8c8afded23669c35bb26553e3b25f8cef2d631
SHA512af7ae8db2c927f9aa93d823de4d72ef8d18d3061f3f41e792f4451699db1dbb54bc501eeec6bca5811e2862fdb6bf037510cf35b3ea3b248603feeabae835812
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
2.7MB
MD5b02d86ff1695f8c3faf80f6e5cd1b8bf
SHA1aaf7bc27106152a25b5ad8ce4c643f4def00bfe8
SHA256ff283c5f3e854c82dcfb4ea631f5f68496fb1654d025b5f3acfae5318c5ed088
SHA5124c219352d2555f183b143ec875f7944c622d1f5fdd5969caf46844e537fd8852c0309e9d9d0cadc55e151bda2cc49eff2d8bb2d84e81ce5261f2e0f474fc7098
-
Filesize
1.9MB
MD5eed0b74ba5f52789a7b50fbf64a6eb5f
SHA1146367bafe9364ec489c48dbee6b8b8aeecf38fc
SHA256e3d09adecc926177201dc5ec6b6a3ba661b8de3aed15afa65893e3ad76303c61
SHA512e9bd7a33f7da4b87aa0f18f33b3b54fe3cf8c4436e88d1d39405608a62dc8d69d516dde7bb5211b9b4396c2198ed42c447b7c4a627eed892bfc0d468ddf92d3f
-
Filesize
2.9MB
MD54847e8303867ebacc565bee522e371ae
SHA176fe0c69db896ecbca1cb691cbbca4f7bf9eb107
SHA256f2dd316b06bca0219b144c7fe0af63cabca36be80f0c2b5182dde47687ff511b
SHA512c42ea2f2942a10ddd5d68bcd3eacb5afa413e2f6da5e424b3dbbcd30dee323cb5c495b167b77586058c6c57a5283f08c5f15e0513dc2de806aed7e990b19a659
-
Filesize
4.2MB
MD5fa2b9ef3eedea37bee3f07f9a580ca57
SHA1886267a5d0287a9e8385aa7337f7c0dfb6e0c3b2
SHA256bb2af2fb0383047e427ce40b100535426c1037778a3e3c713158d02d6ab6c8a2
SHA512a5ffb97936a0c9b4451436b9b8d5e433a108ad5c9c70c9bce55e8597e7b76e9d8d0786663f9e535bb313a51a1ed75a482c08dba6ec64eafe46029905ad406f64
-
Filesize
1.8MB
MD525fb9c54265bbacc7a055174479f0b70
SHA14af069a2ec874703a7e29023d23a1ada491b584e
SHA256552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c
SHA5127dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668
-
Filesize
1.7MB
MD581cfbdcd567c50d28a6380910dd6cf83
SHA13fac13a3e2416853ce16ed6052ba91e4ec978c86
SHA25655cb3e812b8545ae08027c08bc3d8d0ffc8e6cd2854547a582ab3c4e2db88d1d
SHA512fd083c0ec0a95175ef05afb2c60cc1990b868d0a5db483372a294bda2955db7dbe586ab9c3633a7bbb2bfc6f478e09b2f5e04fae41393a626dbb53345fc81838
-
Filesize
945KB
MD5457285e2cf3c306e05a2dc450c9748ad
SHA1d9d57583b4eac7332c9ff79869695b995ba44d2f
SHA2560c9c4c41cda2b02f17a65d180643a428c70c4535d0e214739c3d461403408f06
SHA512f4c5f17aa2e388e4f682869999ca7ff10c79cd2a66e2803c630c75a2748399201805ac7bf0a352132bd8f9ae06420a51a2c5a003a5b4d1a011ddbc12ee728003
-
Filesize
1.7MB
MD551501deb706a509a1dec7745ecf713e3
SHA17a925e2f3231498ab0cbd8cefe9b475fbab5f58b
SHA256fe72e6a8775634e7d76adecf570a2866a81714d3e3d7be6174c8fefb327f2f0b
SHA512cae65b34492e2c8413bcc19448697bd8c76e685046b60ecc65b313a49e4d7f9e9df24f0593f4691cffca1d8c7e9bc077bb2df7918767614b2172167bdc847476
-
Filesize
1.1MB
MD5ef08a45833a7d881c90ded1952f96cb4
SHA1f04aeeb63a1409bd916558d2c40fab8a5ed8168b
SHA25633c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501
SHA51274e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
1.1MB
MD568c0e4eefd4c6a76cff542ef57a49ca2
SHA18aa521628b89f3ce539269229834da2a87060e76
SHA2564e417fd6cce7dbff53412a820f4813d01da0e7f20e7615220aaa1372cc59db83
SHA512d722432cdf836269ed3a6e181dd02c6e49d719ca9d84aa5582447d480f43ccc0f79f2d9a9191171d21ec2ea3306a97c60a0aff6707fa3ca9e81e957bf8aad283
-
Filesize
1.8MB
MD5ff279f4e5b1c6fbda804d2437c2dbdc8
SHA12feb3762c877a5ae3ca60eeebc37003ad0844245
SHA256e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378
SHA512c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967
-
Filesize
3.1MB
MD5c00a67d527ef38dc6f49d0ad7f13b393
SHA17b8f2de130ab5e4e59c3c2f4a071bda831ac219d
SHA25612226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3
SHA5129286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca
-
Filesize
4.3MB
MD532353fd729d2709ff0f7fbd5af5d38b1
SHA1bd2666a194111152ed802d4c5ae96f5ecc6f61c3
SHA256506a9cff027877d2344079b59c90ed5cd5f85225ede2828ce2a9aaf0c22cd329
SHA51209f8cf2c288453d75d0ef19065f62791bbdd7a5fe1f91294db23025b9f394f9edcaae3c4451b2ce6807f0bdd9b39a977a5905a6aa44b9ba6ab39b162486839b7
-
Filesize
21KB
MD514becdf1e2402e9aa6c2be0e6167041e
SHA172cbbae6878f5e06060a0038b25ede93b445f0df
SHA2567a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a
SHA51216b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a
-
Filesize
747KB
MD58a9cb17c0224a01bd34b46495983c50a
SHA100296ea6a56f6e10a0f1450a20c5fb329b8856c1
SHA2563d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b
SHA5121472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840
-
Filesize
758KB
MD5afd936e441bf5cbdb858e96833cc6ed3
SHA13491edd8c7caf9ae169e21fb58bccd29d95aefef
SHA256c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf
SHA512928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
1.7MB
MD50dc4014facf82aa027904c1be1d403c1
SHA15e6d6c020bfc2e6f24f3d237946b0103fe9b1831
SHA256a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7
SHA512cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028
-
Filesize
3.3MB
MD5cea368fc334a9aec1ecff4b15612e5b0
SHA1493d23f72731bb570d904014ffdacbba2334ce26
SHA25607e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541
SHA512bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748
-
Filesize
3.3MB
MD5045b0a3d5be6f10ddf19ae6d92dfdd70
SHA10387715b6681d7097d372cd0005b664f76c933c7
SHA25694b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d
SHA51258255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b
-
Filesize
440B
MD53626532127e3066df98e34c3d56a1869
SHA15fa7102f02615afde4efd4ed091744e842c63f78
SHA2562a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca
SHA512dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O4RTVD26IPD17HAMUONE.temp
Filesize7KB
MD54a1d624ef656d0c6ad008fd916dc66b4
SHA145c37e322290862c1c6c21af71e94cab600cfc86
SHA256b1326b1f8af1e59380b7331b2d9dfcf2011ef6041bba065574c23020bdf568ea
SHA5124ef50f54cad7962bc88838b2890a3ea3d053d57fd33b4247616acbe4ed392df4a884878e41f20b121692d36856dc7434dc88a98884a00d6fd8d8cedce622de6f
-
Filesize
224KB
MD586c184f12dbc234b991301c80b8c4a5b
SHA11c02f6e0fd80a5ecccd61430a2390f0848e2caa2
SHA256359171f8cc5d2b5f9cbea42ed033491febf9fabd7e78601ce13506c2f9ef876c
SHA5120772cdf65218bae2d412c22facc6328ba8ad40af687bb12e1046fa03d8ddbed40f314105bebed52ebb7e7e47ca91b4dd5678b6cc543fe4a4db235889a9d89193
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5383088e9959ae7ef6d88171a07e3d3b8
SHA1391382ee6c93181193d0150f81e229a82fd779dc
SHA25672549223ff85d65b683187074fc4239597c545e99cc2857e1b671803ac2b9ab2
SHA512fdd2d6e696d0c121f46760a900763019e07a13c1d8245612a50da3ed9ef315b4ae78e9aacefc9b6fdb3c4f234dabd4069ff68f3179ddd6ef77f525ce6de8a471
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\48ed1617-53bf-4fe9-966d-ad39d1fd9241
Filesize745B
MD5a4780f7210630512a78741ef2349df7f
SHA1acf2a956d3af289908fca888b40931730c64d78a
SHA256565d109004adb15da8ea77264ace12390c9d8fa7272b91965e36566b115dace1
SHA512967ddd40b440f417f705c84d907a19937ed23d44083303595863812640ef678b0517585fb6d34a839d57c4678df42740483ab8504a103374ae4e20137a23e3ac
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\f82d3365-21a6-4d81-a0e0-00d75e01c2c9
Filesize11KB
MD50dc4498262c9d58345536a50a56954dc
SHA150caa2a433ca816e6347750e864f0606b146c768
SHA256514b1581e75084726adc0bccd63fc1e454233467d9c59720bb1a55b06ef3ce99
SHA512ab1902b6a3cdf3ee9d0f4ae1f8b061b5e2f251125da4d15fe4f01ef0649ff9c0bec74b0f8d023f5dff8c1c68e2c9fd9af9006fb37ea29d15bd5710209db6f6e0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD56008654c1727950c805c69cd77f44560
SHA1ff530b6febf0286043a3b92cf4a87984474665e7
SHA256c1d0bf3b14a03a670325886473f75180a6d1c5af00464d355158a61b4b8081a0
SHA512fbb3d0a768984a11fa62fe112eb4f47b823815d7ee476357070df2608516444046ed9b62c960f5d6c8832e0bcc4578620ad359b02d9ba61ab88b99923a8cd8db
-
Filesize
7KB
MD5cae37ca519f7749cbfad7a04580824bb
SHA110d088994fe95ff45bcb73407be0acf9ebf6c8d9
SHA256001bdabf45b60afcb2bbea7c3276a5e678416d7c7108a0b434d2c451d52ed1ca
SHA5128b4056e531a16999bc3bf7ac6b54d5ca5407f6f2407180ff9ade97641ecb40270263dc267db68c9a4bd4ea6d5d09d6efa2019846c5313059a9098279f29dbd22
-
Filesize
6KB
MD53d83d0a07077baa6a186a3b24a1a2a9e
SHA15ab9a2170d159c42e58d22e3bb2f07222182e4f4
SHA256df95a057f49541a2cf5e00ecbf9be14d3cdfff485d90304aebc151bc5a5103c6
SHA5121aaa154366e4ab0ae7efc7a39a9c1322fbcd8df450b60d3e212f6e0350d954793dff98d341b564b2ff8f6d6bedc3fffe038bccb8a0e7fb8061f515c546ebbc78
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5ecdc7397171c779390fa75517caf1f0f
SHA1e472e9682c45c5cc931b63dec40ff737decab56f
SHA256e62b1eac38652fbeffedf4c228397156dab71e1d5644f71158a47da0069a49d1
SHA512da56d30e3551349092b312175ac33e07cad6846e7e6f7fbad0be1186a8058db1ce4e721286f19d0139ae0ad0f687512016e3c968a0b9ecf3013bf92e13cdee50
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD53dc733f51b6c47c0e57ae7035b9abacf
SHA1d4c28a6f9d4bae9e297440a46726a2cb3e2504ba
SHA256aafa700fb884f14becaf86a0eb9df79dfa15885b2ebe11cabe5f48a3a5d9e0e1
SHA512e02670f6fa626a21ad150e0e0e589ba9f1f7a1fb921dc28f4117dc0a30a337b9c9b165dd0a30da864fe4dbdf130372e846648792a0bcf5aad4e8d28118101067
-
Filesize
2.8MB
MD5b6009d2baed73bc321b38ce9a13f875c
SHA19759ef65ae6e3e50b9eaea5708babde594950014
SHA256cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c
SHA5129f831efce03a9dd2c47547fd32d66256160937e687ab0e7d555f0f05e490e2283ca1333caea8ed0cdb90f2c6762ed53cf38c563cb8fe57463923ded5e876657e
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628