Analysis
- user interaction
yes - max time kernel
568s - max time network
529s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/05/2026, 17:14
Static task
static1
Behavioral task
behavioral1
Sample
WeatherZeroService.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral2
Sample
WeatherZeroService.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
600 seconds
General
- Target WeatherZeroService.exe
- Size 3.2MB
- Sample260524-vr1tsaft8x
- SHA256 95f0e021c978ddd88e2218a7467579255a5ae9552af2508c4243a4adec52d2b8
- MD5 2b149ba4c21c66d34f19214d5a8d3067
- SHA1 8e02148b86e4b0999e090667ef9b926a19b5ca7d
- SHA512 c626f89bc01fdb659f4ee2cf86ba978f04e4bf0dec2624170c83c21d5ad29e20335566b1f7545d9badc4e47ca2ea90535c4cb08b4afa3457b72a5801053706d8
- SSDEEP 98304:EuOjRHrd1zBPC474Iz8pEeVJmUXyevkUL38/cSUJ9yElx7W91a8G8C:91VzF38/LUJ9yE37KGH
- TLSH T179F59BC1B329F945E36901701A3532F4866A29303755E9B9FE8F36D2186C2D6ADE0F73
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS procexp64.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" procexp64.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: procexp64.exe File opened (read-only) \??\E: procexp64.exe File opened (read-only) \??\H: procexp64.exe File opened (read-only) \??\L: procexp64.exe File opened (read-only) \??\O: procexp64.exe File opened (read-only) \??\P: procexp64.exe File opened (read-only) \??\R: procexp64.exe File opened (read-only) \??\S: procexp64.exe File opened (read-only) \??\W: procexp64.exe File opened (read-only) \??\A: procexp64.exe File opened (read-only) \??\B: procexp64.exe File opened (read-only) \??\G: procexp64.exe File opened (read-only) \??\I: procexp64.exe File opened (read-only) \??\K: procexp64.exe File opened (read-only) \??\N: procexp64.exe File opened (read-only) \??\Q: procexp64.exe File opened (read-only) \??\X: procexp64.exe File opened (read-only) \??\M: procexp64.exe File opened (read-only) \??\U: procexp64.exe File opened (read-only) \??\Z: procexp64.exe File opened (read-only) \??\J: procexp64.exe File opened (read-only) \??\T: procexp64.exe File opened (read-only) \??\V: procexp64.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\services.msc mmc.exe File opened for modification C:\Windows\SysWOW64\sechost.pdb procexp64.exe File opened for modification C:\Windows\SysWOW64\wntdll.pdb procexp64.exe - Executes dropped EXE 1 IoCs
pid Process 5468 procexp64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WeatherZeroService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WeatherZeroService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WeatherZeroService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WeatherZeroService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WeatherZeroService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WeatherZeroService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WeatherZeroService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WeatherZeroService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language procexp.exe - Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz procexp64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 procexp64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings firefox.exe - Modifies system certificate store 2 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 procexp64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e procexp64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 procexp64.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\ProcessExplorer.zip:Zone.Identifier firefox.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4384 mmc.exe 5468 procexp64.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 5468 procexp64.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5468 procexp64.exe - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeTcbPrivilege 1472 WeatherZeroService.exe Token: 33 4384 mmc.exe Token: SeIncBasePriorityPrivilege 4384 mmc.exe Token: 33 4384 mmc.exe Token: SeIncBasePriorityPrivilege 4384 mmc.exe Token: SeDebugPrivilege 4016 firefox.exe Token: SeDebugPrivilege 4016 firefox.exe Token: SeDebugPrivilege 4016 firefox.exe Token: SeDebugPrivilege 5468 procexp64.exe Token: SeBackupPrivilege 5468 procexp64.exe Token: SeSecurityPrivilege 5468 procexp64.exe Token: SeLoadDriverPrivilege 5468 procexp64.exe Token: SeShutdownPrivilege 5468 procexp64.exe Token: SeCreatePagefilePrivilege 5468 procexp64.exe Token: SeShutdownPrivilege 5468 procexp64.exe Token: SeCreatePagefilePrivilege 5468 procexp64.exe Token: SeDebugPrivilege 5468 procexp64.exe Token: SeImpersonatePrivilege 5468 procexp64.exe Token: SeSecurityPrivilege 5468 procexp64.exe Token: SeDebugPrivilege 5468 procexp64.exe Token: SeBackupPrivilege 5468 procexp64.exe Token: SeRestorePrivilege 5468 procexp64.exe Token: SeDebugPrivilege 5468 procexp64.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe 5468 procexp64.exe - Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 4384 mmc.exe 4384 mmc.exe 4384 mmc.exe 4384 mmc.exe 4384 mmc.exe 4384 mmc.exe 4384 mmc.exe 4384 mmc.exe 4384 mmc.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 4016 firefox.exe 5468 procexp64.exe 5468 procexp64.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 852 wrote to memory of 4928 852 cmd.exe 90 PID 2256 wrote to memory of 4548 2256 cmd.exe 95 PID 3220 wrote to memory of 1976 3220 cmd.exe 99 PID 3220 wrote to memory of 4504 3220 cmd.exe 100 PID 3220 wrote to memory of 2388 3220 cmd.exe 101 PID 4332 wrote to memory of 4016 4332 firefox.exe 106 PID 4332 wrote to memory of 4016 4332 firefox.exe 106 PID 4016 wrote to memory of 2180 4016 firefox.exe 107 PID 4016 wrote to memory of 2180 4016 firefox.exe 107 PID 4016 wrote to memory of 2180 4016 firefox.exe 107 PID 4016 wrote to memory of 2312 4016 firefox.exe 108 PID 4016 wrote to memory of 2312 4016 firefox.exe 108 PID 4016 wrote to memory of 2312 4016 firefox.exe 108 PID 4016 wrote to memory of 2312 4016 firefox.exe 108 PID 4016 wrote to memory of 1760 4016 firefox.exe 109 PID 4016 wrote to memory of 1760 4016 firefox.exe 109 PID 4016 wrote to memory of 1760 4016 firefox.exe 109 PID 4016 wrote to memory of 1760 4016 firefox.exe 109 PID 4016 wrote to memory of 2892 4016 firefox.exe 110 PID 4016 wrote to memory of 2892 4016 firefox.exe 110 PID 4016 wrote to memory of 2892 4016 firefox.exe 110 PID 4016 wrote to memory of 732 4016 firefox.exe 111 PID 4016 wrote to memory of 732 4016 firefox.exe 111 PID 4016 wrote to memory of 732 4016 firefox.exe 111 PID 4016 wrote to memory of 732 4016 firefox.exe 111 PID 4016 wrote to memory of 5400 4016 firefox.exe 112 PID 4016 wrote to memory of 5400 4016 firefox.exe 112 PID 4016 wrote to memory of 5400 4016 firefox.exe 112 PID 4016 wrote to memory of 5400 4016 firefox.exe 112 PID 4016 wrote to memory of 6056 4016 firefox.exe 113 PID 4016 wrote to memory of 6056 4016 firefox.exe 113 PID 4016 wrote to memory of 6056 4016 firefox.exe 113 PID 4016 wrote to memory of 6056 4016 firefox.exe 113 PID 4016 wrote to memory of 6064 4016 firefox.exe 114 PID 4016 wrote to memory of 6064 4016 firefox.exe 114 PID 4016 wrote to memory of 6064 4016 firefox.exe 114 PID 4016 wrote to memory of 6064 4016 firefox.exe 114 PID 4016 wrote to memory of 6072 4016 firefox.exe 115 PID 4016 wrote to memory of 6072 4016 firefox.exe 115 PID 4016 wrote to memory of 6072 4016 firefox.exe 115 PID 4016 wrote to memory of 6072 4016 firefox.exe 115 PID 4016 wrote to memory of 5480 4016 firefox.exe 116 PID 4016 wrote to memory of 5480 4016 firefox.exe 116 PID 4016 wrote to memory of 5480 4016 firefox.exe 116 PID 4016 wrote to memory of 5480 4016 firefox.exe 116 PID 4016 wrote to memory of 6008 4016 firefox.exe 117 PID 4016 wrote to memory of 6008 4016 firefox.exe 117 PID 4016 wrote to memory of 6008 4016 firefox.exe 117 PID 4016 wrote to memory of 6008 4016 firefox.exe 117 PID 5436 wrote to memory of 5468 5436 procexp.exe 119 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exe"C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4892
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵PID:1620
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1252
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exeWeatherZeroService.exe install2⤵
- System Location Discovery: System Language Discovery
PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exe"C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1540
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exeWeatherZeroService.exe start2⤵
- System Location Discovery: System Language Discovery
PID:4548
-
-
C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exe"C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exeWeatherZeroService.exe2⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exeWeatherZeroService.exe s2⤵
- System Location Discovery: System Language Discovery
PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\WeatherZeroService.exeWeatherZeroService.exe start silent2⤵
- System Location Discovery: System Language Discovery
PID:2388
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4384
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27098 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {6c3e382a-3a73-493b-8c8b-ae68c8b46605} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:2180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27134 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {4aebb4d6-006b-4ad5-8ecd-0691834256ff} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:2312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27274 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {59f24290-c2cc-4d28-92a8-fe4e490c53bc} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:1760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27274 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3936 -initialChannelId {305014bc-29af-4b8e-b729-3f2441107944} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:2892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4456 -prefsLen 34773 -prefMapHandle 4460 -prefMapSize 270279 -jsInitHandle 4464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2604 -initialChannelId {5a1c754e-85cc-409b-8f2b-075b5386e9a5} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:732
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5000 -prefsLen 34822 -prefMapHandle 4720 -prefMapSize 270279 -ipcHandle 2604 -initialChannelId {0e95c849-1eab-4eb4-8def-1af94b20d3e6} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:5400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32952 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5476 -initialChannelId {bb99c5e4-b6b0-4052-b926-246786415cfd} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:6056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5660 -initialChannelId {abc83acd-34f1-4578-863b-114038219305} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:6064
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5832 -prefsLen 32952 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 5840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {1621eaaa-96be-450e-89d2-831264037479} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:6072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6444 -prefsLen 33071 -prefMapHandle 6448 -prefMapSize 270279 -jsInitHandle 6452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6460 -initialChannelId {93ed0983-10d1-48ec-8ea5-b31ae2a2544b} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:5480
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6592 -prefsLen 33071 -prefMapHandle 6332 -prefMapSize 270279 -jsInitHandle 6612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1668 -initialChannelId {1c9e08d4-d9a4-4ab2-ac97-015d5c00eb20} -parentPid 4016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:6008
-
-
-
C:\Users\Admin\Downloads\ProcessExplorer\procexp.exe"C:\Users\Admin\Downloads\ProcessExplorer\procexp.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\procexp64.exe"C:\Users\Admin\Downloads\ProcessExplorer\procexp.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Drops file in System32 directory
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5468
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\procexp64.exe
- Size 2.3MB
- SHA256 8404b6cfad9d998b10d2df6073e1275b7744c0416982bdc5cb7ef5b74348333d
- MD5 21f1e297353ff80d455f3445a1f13c03
- SHA1 71702649523154e6d64cb15cba13ae79c546cb8a
- SHA512 0779dad679f7fae8c2c2af3c6c2643e0b903d04eb410e2ef7336ee69f96298b7b8d69f6a1fc97da386c4d77fd767d74ed62a0e17785b4c0e3dda894ed1e48233
- SSDEEP 24576:zHeD1MZwPHRHEzLuzTCuwQxMAN0uL/guYtkPOe+42chxPe9MoQtF2:rW1MZwpHEqPwzANNYufOb42c/Q
- TLSH T16FB58E4393EC41E5E0779734896A8626FEF27C150B3496DF0245FA1E2F33AC25A76722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\AlternateServices.bin
- Size 10KB
- SHA256 9859df0e7e6753522cafef7c729973aa7c2dd231a8a2b6a74b941d0cbcef7970
- MD5 8ce285115199d32cbd00d225feae88f9
- SHA1 c047fd18e4d3ebcf6a21023f77e986e5b62e2efe
- SHA512 0a03a3ee958078138be15aacd415c48141df20a04b479ef55be8ed1df6879dcf130d05b36db9cc65e807019ef75cb57a8e5345baf95bbde77ed6d84cdfdc9c16
- SSDEEP 24:TQuhMZG291dwrOjF9xpwrOv9B1tR9VvTtk5q9F55A5StZ9l7tNG9Bbh2:TZs7nbbnVftjBTtWI56St75tN89h2
- TLSH T1B12272F36BB1A462F0628FF0405CB18CDC32133655BCA194C654D0F726D5A99A13EBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\AlternateServices.bin
- Size 12KB
- SHA256 4c43906d43f9868334f4b3c3aba1da6bc0880d563e2219d5e4019efe06cd7740
- MD5 0c0d3ce50a2e6224024bc00a7ec91822
- SHA1 465469ba88735ef1adb98d9fe8c8867f2c2d8ba6
- SHA512 cd43c24eb0ab9f220e239ffe76c84aca82c682e74de4da595d8303ddfc1e23e62701f54a9e12258f9e4a16e27728806f303d7c0b6782f336dc0686503002a10d
- SSDEEP 24:SuhMZe91Qk9x0s9BYQ9VvG75q9F55A5Z49l+A9Bb8xWN9VxWAGUdilCi:9+GeeaaBG1I56ZykK98xM/pGYiki
- TLSH T1944283F76B71A462F0628FF04058B48D9C33133A65BC91D0C614A4FB16DAB95A13EBBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 4e51a38d656c787efcb73ca291c254bfc559e9d9bf60c230e0a370b48c9ff652
- MD5 cc659bcba1da810b9399c5e22189cda6
- SHA1 d13cb22cd5303d387d9ceaaca3743ec2df044fff
- SHA512 4058a927bb228de3107e266cab88b8917e394dd00eb0b11b1223f2a375ee08ae93a1bee54446e31f8a3646b5c2aee867271fcbe07c501c98d36763d42004bf02
- SSDEEP 192:J1d66Joz0dzgCl6mc0d+Ov5zboHBZU3yjfM:Hd66JozQzgC1j7bohZU3yj
- TLSH T140E10164EA28863FC404527BDDA21F410F39389ADC4E3F19359DA45C2D572ED3A8E17D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 c83b72738854dae5746b6fc9eeabb77b8a8b586dccf897a516782ffbb7e96f85
- MD5 3d6986a65e94e63b02569e156b207937
- SHA1 28367cd32504823742d2773fbcc9a6f27e5e34dd
- SHA512 5d176d2c0fcbea1e9b05cd25e683d2e7e63b558edd0e799c0e28eda27c2f14f48dacde19a11e9528de7b6d20b392f098f9ce1d91c3ba9b96eb8d0146128031e6
- SSDEEP 192:J1d66Joz0dzgCl6mc0dSOv5zbooZU3yj0xI:Hd66JozQzgC1jzbooZU3yjT
- TLSH T192D1EE68E629467BC844423BCCA21B400F39389BD85E7F2531EC645C2C572EE7A8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 2b737cd25bd638dba50fdd7dffcd24d8bce78d0dfbe7eb73d911676dfec55ef0
- MD5 16c9f27d8706947b3d39eec9504b988f
- SHA1 678e1bb8ac9cbdca072bba074a00c157f8dfdaa6
- SHA512 ed673993c09c16fa7cb82acfd119c58a775bd70d8188daab2ff4ee1686c8b070ce7c2ab2300fc402585af3a9e9a67bd7110175ab826d03d51ec7d766d072713d
- SSDEEP 192:MOv5zboH/U3yjfMv1d66Joz0dzgCl6mc0dz:vbofU3yjQd66JozQzgC1jd
- TLSH T1CCF11164EA28463BC804527BCDA21F410F39389AD85E3F1531ACA45C2C572ED7A8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 b4f306235c236e1dce71fc456416f40ff1dde91c61da1bcd3af2424db2c60d84
- MD5 6290046f58acc2125d8ad6028b632320
- SHA1 97ef0aaaf285540bf7b8a1640db594fd1f4755f9
- SHA512 876dfb7be54fe7b7538ab46b809a34517fb7955d59ad995cf1834dcfa7d4a1db698011ce18ee18c4ac7848b4b2d898c38e71be7bafc5567a1f765e928c9f0ae9
- TLSH T1DB21646C39B84E2AACCAE6DC754101CF53958A0754C71C930E12DE8DDDD5AE9336E839
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\2048636b-a288-40b4-82fb-2db7b95e9f72
- Size 16KB
- SHA256 590859f2fc19389f1d88b8a58943028e19f65fe546b903de3c582b974dbd2157
- MD5 8724ef949a9578777054211592d57684
- SHA1 17e14a9446af862b6e466d49ffc1cc887b1eed50
- SHA512 561fb7c404e17f7dc60b59831cce348fa5ed561b9c45b95db749ff4264d09ab9ce273630823c7fe0c05cc38053c2df94acf6b581a6b6e91faa5aed78504b5c04
- SSDEEP 192:MWl8/BmhMEEqyAntmkXjGqrOzCzAuybS5iVjGnWcICkCYtvZIJf2a1v+RgROFKBk:30XayGtm8niWDybS5iVj+kC2S+WY
- TLSH T12F72B9565460857AC651E3AC98FCBFC3E2F528CB4C419FCA97E4BD0869DE06E112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\72d3207f-a761-4ebe-b658-d33f498bcadd
- Size 235B
- SHA256 1a419732aee3101c67f8979d8d139c8b79f52cb704a82c1086100cf643c1a909
- MD5 f2b408ceda7af628dfc361637880da07
- SHA1 746ed247b67e444956fb3147d7a63f38bf9dc3d3
- SHA512 9a7c814e63f923ec7a2064e8a2647e295f0b58d3312595cb47031edefe31f995cb07c3c60553143ae98dacdbd1e92619791cf4524414d3da76a6cb259700c96a
- TLSH T1A2D0A7C8A8A8A7AD0C144F1FB0B169C630898C3794755824DAE186BC9AB9ED581A291B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\7789c40b-ba65-4d5e-84fe-ee006171943c
- Size 2KB
- SHA256 c66fd3d41a8918e1c3fcef6d789bfd524ab0418de84f4aa660ba86a3b6d9cad5
- MD5 ceebcd8707509b84267119ebcb0b12bc
- SHA1 3211b60ecb868b26ba23b5fde99575b3205c63c0
- SHA512 5fc83034995d4c845333fade8b6d518908ad8cf60789e8b5c10df51df092cc95f495c86770bf6b4e1a83437d70dfaa3129de9d536d830ac1e27dfef969dfa314
- TLSH T13441856C79784CB78DDAE18DD592238E43748A1300C15C832EA2DF0C8DDA3AD236B52B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\882910f4-83ee-44f8-8109-fce85e0cd057
- Size 883B
- SHA256 4d2bf06393454e3c16f467fbf0df9aea8883faa3795925c483f6ba5b51e623d8
- MD5 a6128226bf4422d7a275bd7e5a8685d6
- SHA1 a06bd5ce2a00a3a8a2cd5d820dca5878479354fa
- SHA512 ff9f79b1d9c5a78938eabc2cbb3170901ddc4e85078f49e5d9bb6b3ac0e8d542c486d761e186f4bb97d2ab6fded0768b494f69b970f50ed4678a7537688e816e
- TLSH T10211DC91D63179F3CD78925B8A917B028BA87523C0C689183DA5DE080D7E52A636B307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\8af796ff-d280-4ebd-a497-873c477408eb
- Size 886B
- SHA256 902cde58b5928959cfe3a8524ac5777d584efc4c721c71abd3d05d039a1fb53a
- MD5 4c34fcf28e939e26695db7f7ff239c49
- SHA1 7589d00a11ba329e710f98cdd25cfeeb3c7a39f3
- SHA512 3033a1d17681a026a817faebd2ebf08d6ee6dbc4e750721c734a5fe0d00fc90674d2519631ded6e81216cc5b04619a51198f4816ba4800ffa1f0a741c97da891
- TLSH T1E4110051C675BAB38D68D18B9691BB024FB83423C0DA19187D95DA184CBA13A63AB707
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\fca93ad4-aec1-4113-97fa-1166e1550d0e
- Size 235B
- SHA256 d918ed6f869d5bbc2ece8e1e26318fc8979be5d61822412b521c3ab625b49adc
- MD5 47e7c21cce273dad44c17215d0bc2606
- SHA1 a87a9259a64bc961e1cdcd185f540985f88a31d8
- SHA512 934784570166e055355ead804184fc18a026b7f1e7fd512059ec35b5e575252fd9d9ab2322ecb991d30f25e8672be47012d5ef87403807da1c824a292a335c8f
- TLSH T173D097E0248C67DD08000F07B1F06CEA30D54D3315B4682089628538DDBC9CA8161927
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
- Size 6KB
- SHA256 ed2fb1d1a1e0be2abe16851ba087ff6d7ac306903efa702a4f7e0250ecd04d32
- MD5 e6b90e768e744e93d5a2eab9be12ba5f
- SHA1 54f34a773cb7504b2853296c2401e7016d59a40b
- SHA512 5e85ab69fbb4f9041f55a65d2c1f446d7333aa63c410f73abd3667b613d943b1e00a1d0f9c2d6f2e23c0047948674f3ae07750178d8a92a382889f8a195bc6ec
- SSDEEP 96:xHkUTUNqGqZfrfhkzSVSSlqdv9jVnumHb4nNzw9Bw88H8L4cnteGGS:+gRZfrfhXSSpob0sBw88u
- TLSH T1DDE1307890088F7F74B677ACAC688871AAB2413BBBBF68D750B55485050CF3442F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
- Size 7KB
- SHA256 32e2f9dcdba40ccee24e8d1b84a080253dc689dcabab2bf9632708a2ff6ecde3
- MD5 a2ed348b699c1f884ac4db4782440b48
- SHA1 ff23c8a50c53868a575e74f34dca7a16b7b08460
- SHA512 7013bdb1da27e4469068dd8a9b96495451527b61355402a96915ef620cb447f6d6dd0733c43a18e23df99359cb08b7cfb97134475ccf6801157c653e1519fdce
- SSDEEP 96:xHkUTU4PqGqZfrfhNbzSVSSlqdv9jVnumHb4nNzw9Bw88H8L4cnt5GGS:+ICRZfrfhISSpob0sBw88v
- TLSH T193E1207891088B7F74B676ACAC688871AAB2413BBBBF68D750B544C4051CF3442F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
- Size 6KB
- SHA256 34c25272e974b43380e356134d2b07f22df059cda0746ee89e8c89ccf75c5ec3
- MD5 b161d306895ea4c84c09d5b722599f91
- SHA1 83f157d3f29784080156539789cef59f43a624f1
- SHA512 aca43175736574b5970672613d44bd81165c06db0259ec0639b876a61b48649bca8f6c1f085607618a1593b68409ea6b7a2c46b6c5f54b16e2fad326aacdfdd5
- SSDEEP 96:xHkUTUNqGqZfrD21zSikSSlqdv9jAnumHb4nNzw9Bw88H8L4cntev:+gRZfrD23kSSaob0sBw881
- TLSH T156E13F789108CB7F74B677ACAC688831AAB2413BB7BF28C750B95484050CF3442F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
- Size 6KB
- SHA256 26b47d81257b3e9901d8950b101a9450bb791b755eccaab15822bedea2c22456
- MD5 419cbcfa7a392a8e7e68b8b393105370
- SHA1 632ad42890352ce02ec2f84186650645ea9d5e37
- SHA512 1216d0fbcdc754b59f193f443f461022d80c354c78a423b9e3164a643098be9c83e91149433088165f38e343951587863588477e99493fd72213d2d97a06c5d9
- SSDEEP 96:xHkUTUNqGqZfrfh1zSVSSlqdv9jVnumHb4nNzw9Bw88H8L4cnteGGS:+gRZfrfhkSSpob0sBw88u
- TLSH T1D0E1407890088F7F74B677ACAC6888319AB2413BBBBF68D750B54485050CF3442F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionCheckpoints.json.tmp
- Size 259B
- SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
- MD5 e6c20f53d6714067f2b49d0e9ba8030e
- SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
- SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
- TLSH T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\ProcessExplorer.shYw1ai9.zip.part
- Size 3.3MB
- SHA256 47ff65944e87280a0d40e6eb7a6157f13f46d605df44ff794784b54d56795aa6
- MD5 54d121db0329c476cae2f19b77c441ea
- SHA1 eb9c031392cf595ca6589974b52826df2b7c6558
- SHA512 09cec794c6e31cccb96a75796ae47d01a7b9d2d36b5519967f1666e6a7f1d1aa9cc12bbe390f5ddeafecc8ce735a7c21a5992079d6f6edc0e859800bdfbba152
- SSDEEP 98304:mCZVMssQaYahON+GImUQYHwnHPvV0i0U5JBI:RVMsVaBhfjHwnHHai3BI
- TLSH T11BF533E5593BDC1A86BE34537146D8D089DA97822C4D2B8B4726D8F0A316CB7F308B7D
- MD5 SHA1 SHA512 SSDEEP TLSH