amadey | 2bef7f94ae35ae24ec6580311d98315cf34e82402ae1f71396e17d03250ccc61

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a1ac94cc27bf21fa3f542a09658a2c7.exe
Size 1.8MB
Sample241009-fb83wsserc
SHA256 2bef7f94ae35ae24ec6580311d98315cf34e82402ae1f71396e17d03250ccc61
MD5 1a1ac94cc27bf21fa3f542a09658a2c7
SHA1 d0242b0a3a14d9d12c84ed6552b8e1e0280a41c0
SHA512 5209536829cd3052f20169719fa80486398115149fddd3943653f53f17357dbecc0a44a240e72793a390e040619db8b1e5daba02d4cfdd98e712f831c2902228
SSDEEP 49152:vopf4CbB40MG8/SU50BJGcGq0V052j4qNNHd3HajHlgRwEpYrCjAt:ApfLBjTa0BkoX5vqNBoB1AY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey lumma redline stealc 1176f2 9c9aa5 default2 doma fed3aa newbundle2 tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

redline

Botnet

newbundle2

185.215.113.67:15206

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29862

Extracted

Family

stealc

Botnet

doma

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023bcf-127.dat	family_redline
behavioral2/memory/3816-141-0x0000000000A10000-0x0000000000A62000-memory.dmp	family_redline
behavioral2/memory/3032-287-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6332403d47.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	df5745d698.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	083cc3b61e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	91d8be2514.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	083cc3b61e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	91d8be2514.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	91d8be2514.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	df5745d698.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6332403d47.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	083cc3b61e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	df5745d698.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6332403d47.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Hkbsse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	processclass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	javuma.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	083cc3b61e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Nework.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	splwow64.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	context.exe

Executes dropped EXE 29 IoCs

pid	Process
2152	axplong.exe
4936	gold.exe
4332	legas.exe
2516	WW2WJzGyTj.exe
2472	H0wMeIntqX.exe
4884	stealc_default2.exe
3816	newbundle2.exe
1156	6332403d47.exe
4184	083cc3b61e.exe
2040	MK.exe
2692	skotes.exe
2508	Nework.exe
4360	Hkbsse.exe
1124	processclass.exe
4604	splwow64.exe
4668	a65eb8cace.exe
1880	num.exe
5656	javuma.exe
6080	91d8be2514.exe
548	df5745d698.exe
5592	context.exe
1668	axplong.exe
4256	Hkbsse.exe
2040	skotes.exe
4780	service123.exe
3956	axplong.exe
5288	skotes.exe
5640	Hkbsse.exe
2656	service123.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	6332403d47.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	083cc3b61e.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	df5745d698.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	91d8be2514.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe

Loads dropped DLL 4 IoCs

pid	Process
4884	stealc_default2.exe
4884	stealc_default2.exe
4780	service123.exe
2656	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\083cc3b61e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\083cc3b61e.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a65eb8cace.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000332001\\a65eb8cace.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\num.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000336001\\num.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\91d8be2514.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000349001\\91d8be2514.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\df5745d698.exe = "C:\\Users\\Admin\\1000350002\\df5745d698.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6332403d47.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\6332403d47.exe"	axplong.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023c6b-390.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
4536	1a1ac94cc27bf21fa3f542a09658a2c7.exe
2152	axplong.exe
1156	6332403d47.exe
4184	083cc3b61e.exe
2692	skotes.exe
6080	91d8be2514.exe
548	df5745d698.exe
2040	skotes.exe
1668	axplong.exe
3956	axplong.exe
5288	skotes.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 1744	4936	gold.exe	90
PID 4332 set thread context of 3404	4332	legas.exe	95
PID 2040 set thread context of 3032	2040	MK.exe	110
PID 4604 set thread context of 3912	4604	splwow64.exe	148
PID 5592 set thread context of 6124	5592	context.exe	156

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	1a1ac94cc27bf21fa3f542a09658a2c7.exe
File created	C:\Windows\Tasks\skotes.job	083cc3b61e.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3948	4936	WerFault.exe	89
1788	4332	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a1ac94cc27bf21fa3f542a09658a2c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a65eb8cace.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javuma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91d8be2514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	legas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	num.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df5745d698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	083cc3b61e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6332403d47.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javuma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javuma.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5244	timeout.exe
6000	timeout.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
620	taskkill.exe
4380	taskkill.exe
2288	taskkill.exe
4084	taskkill.exe
4880	taskkill.exe
4332	taskkill.exe
4224	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	newbundle2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	newbundle2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4536	1a1ac94cc27bf21fa3f542a09658a2c7.exe
4536	1a1ac94cc27bf21fa3f542a09658a2c7.exe
2152	axplong.exe
2152	axplong.exe
4884	stealc_default2.exe
4884	stealc_default2.exe
1156	6332403d47.exe
1156	6332403d47.exe
2516	WW2WJzGyTj.exe
2516	WW2WJzGyTj.exe
2472	H0wMeIntqX.exe
2472	H0wMeIntqX.exe
4184	083cc3b61e.exe
4184	083cc3b61e.exe
2692	skotes.exe
2692	skotes.exe
4884	stealc_default2.exe
4884	stealc_default2.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
3032	RegAsm.exe
3032	RegAsm.exe
3032	RegAsm.exe
3032	RegAsm.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
6080	91d8be2514.exe
6080	91d8be2514.exe
548	df5745d698.exe
548	df5745d698.exe
2040	skotes.exe
2040	skotes.exe
1668	axplong.exe
1668	axplong.exe
3956	axplong.exe
5288	skotes.exe
3956	axplong.exe
5288	skotes.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeBackupPrivilege	2516	WW2WJzGyTj.exe
Token: SeBackupPrivilege	2472	H0wMeIntqX.exe
Token: SeSecurityPrivilege	2516	WW2WJzGyTj.exe
Token: SeSecurityPrivilege	2472	H0wMeIntqX.exe
Token: SeSecurityPrivilege	2472	H0wMeIntqX.exe
Token: SeSecurityPrivilege	2472	H0wMeIntqX.exe
Token: SeSecurityPrivilege	2472	H0wMeIntqX.exe
Token: SeSecurityPrivilege	2516	WW2WJzGyTj.exe
Token: SeSecurityPrivilege	2516	WW2WJzGyTj.exe
Token: SeSecurityPrivilege	2516	WW2WJzGyTj.exe
Token: SeDebugPrivilege	2472	H0wMeIntqX.exe
Token: SeDebugPrivilege	2516	WW2WJzGyTj.exe
Token: SeDebugPrivilege	4224	taskkill.exe
Token: SeDebugPrivilege	3032	RegAsm.exe
Token: SeDebugPrivilege	620	taskkill.exe
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	2288	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	1124	processclass.exe
Token: SeDebugPrivilege	4604	splwow64.exe
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	5592	context.exe
Token: SeDebugPrivilege	4332	taskkill.exe
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	4916	firefox.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4536	1a1ac94cc27bf21fa3f542a09658a2c7.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe
4668	a65eb8cace.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 2152	4536	1a1ac94cc27bf21fa3f542a09658a2c7.exe	88
PID 4536 wrote to memory of 2152	4536	1a1ac94cc27bf21fa3f542a09658a2c7.exe	88
PID 4536 wrote to memory of 2152	4536	1a1ac94cc27bf21fa3f542a09658a2c7.exe	88
PID 2152 wrote to memory of 4936	2152	axplong.exe	89
PID 2152 wrote to memory of 4936	2152	axplong.exe	89
PID 2152 wrote to memory of 4936	2152	axplong.exe	89
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 4936 wrote to memory of 1744	4936	gold.exe	90
PID 2152 wrote to memory of 4332	2152	axplong.exe	94
PID 2152 wrote to memory of 4332	2152	axplong.exe	94
PID 2152 wrote to memory of 4332	2152	axplong.exe	94
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 4332 wrote to memory of 3404	4332	legas.exe	95
PID 3404 wrote to memory of 2516	3404	MSBuild.exe	98
PID 3404 wrote to memory of 2516	3404	MSBuild.exe	98
PID 3404 wrote to memory of 2472	3404	MSBuild.exe	99
PID 3404 wrote to memory of 2472	3404	MSBuild.exe	99
PID 2152 wrote to memory of 4884	2152	axplong.exe	100
PID 2152 wrote to memory of 4884	2152	axplong.exe	100
PID 2152 wrote to memory of 4884	2152	axplong.exe	100
PID 2152 wrote to memory of 3816	2152	axplong.exe	101
PID 2152 wrote to memory of 3816	2152	axplong.exe	101
PID 2152 wrote to memory of 3816	2152	axplong.exe	101
PID 2152 wrote to memory of 1156	2152	axplong.exe	104
PID 2152 wrote to memory of 1156	2152	axplong.exe	104
PID 2152 wrote to memory of 1156	2152	axplong.exe	104
PID 2152 wrote to memory of 4184	2152	axplong.exe	105
PID 2152 wrote to memory of 4184	2152	axplong.exe	105
PID 2152 wrote to memory of 4184	2152	axplong.exe	105
PID 2152 wrote to memory of 2040	2152	axplong.exe	106
PID 2152 wrote to memory of 2040	2152	axplong.exe	106
PID 2152 wrote to memory of 2040	2152	axplong.exe	106
PID 4184 wrote to memory of 2692	4184	083cc3b61e.exe	108
PID 4184 wrote to memory of 2692	4184	083cc3b61e.exe	108
PID 4184 wrote to memory of 2692	4184	083cc3b61e.exe	108
PID 2040 wrote to memory of 2328	2040	MK.exe	109
PID 2040 wrote to memory of 2328	2040	MK.exe	109
PID 2040 wrote to memory of 2328	2040	MK.exe	109
PID 2040 wrote to memory of 3032	2040	MK.exe	110
PID 2040 wrote to memory of 3032	2040	MK.exe	110
PID 2040 wrote to memory of 3032	2040	MK.exe	110
PID 2040 wrote to memory of 3032	2040	MK.exe	110
PID 2040 wrote to memory of 3032	2040	MK.exe	110
PID 2040 wrote to memory of 3032	2040	MK.exe	110
PID 2040 wrote to memory of 3032	2040	MK.exe	110
PID 2040 wrote to memory of 3032	2040	MK.exe	110
PID 2152 wrote to memory of 2508	2152	axplong.exe	112
PID 2152 wrote to memory of 2508	2152	axplong.exe	112
PID 2152 wrote to memory of 2508	2152	axplong.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1a1ac94cc27bf21fa3f542a09658a2c7.exe
"C:\Users\Admin\AppData\Local\Temp\1a1ac94cc27bf21fa3f542a09658a2c7.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 272
      4⤵
      Program crash
      PID:3948
- - C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Users\Admin\AppData\Roaming\WW2WJzGyTj.exe
        
        "C:\Users\Admin\AppData\Roaming\WW2WJzGyTj.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Users\Admin\AppData\Roaming\H0wMeIntqX.exe
        
        "C:\Users\Admin\AppData\Roaming\H0wMeIntqX.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 264
      4⤵
      Program crash
      PID:1788
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\1000354001\6332403d47.exe
    "C:\Users\Admin\AppData\Local\Temp\1000354001\6332403d47.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\1000355001\083cc3b61e.exe
    "C:\Users\Admin\AppData\Local\Temp\1000355001\083cc3b61e.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\1000332001\a65eb8cace.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000332001\a65eb8cace.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4668
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4224
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:620
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:2068
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4916
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f837072-3cfc-4a73-9405-fdabc2001c9b} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" gpu
        8⤵
        
        PID:1076
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8044ed29-e58a-41ec-b21f-36a409c92c34} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" socket
        8⤵
        
        PID:2956
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 1 -isForBrowser -prefsHandle 3212 -prefMapHandle 3256 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4fc3cb0-8824-480e-bc8b-0190e9585e66} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
        8⤵
        
        PID:4868
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3612 -childID 2 -isForBrowser -prefsHandle 2624 -prefMapHandle 2620 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b86a7359-cfa4-40af-856e-fe9829ad702d} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
        8⤵
        
        PID:2204
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1224 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4256 -prefMapHandle 4268 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49e48f19-467f-4246-9318-5c243a097412} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" utility
        8⤵
        Checks processor information in registry
        
        PID:5732
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 3 -isForBrowser -prefsHandle 5580 -prefMapHandle 5596 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b2ab04e-bc3e-4c59-ad03-ca863c4cd657} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
        8⤵
        
        PID:5312
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 4 -isForBrowser -prefsHandle 5788 -prefMapHandle 5792 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf45b40f-89e3-4eb5-847c-f73a8086aad1} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
        8⤵
        
        PID:5344
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5944 -childID 5 -isForBrowser -prefsHandle 5864 -prefMapHandle 5868 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b92b81f2-bbbf-43c9-805c-0d01ddbbcfce} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
        8⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\1000349001\91d8be2514.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000349001\91d8be2514.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6080
    - - C:\Users\Admin\1000350002\df5745d698.exe
        
        "C:\Users\Admin\1000350002\df5745d698.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:548
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        
        PID:3612
- - C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
    "C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2328
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
    "C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\1000077001\javuma.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000077001\javuma.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4780
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5156
- - C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
    "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start context.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        5⤵
        Drops startup file
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5592
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4332
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5244
- - C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
    "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4880
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4936 -ip 4936
1⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4332 -ip 4332
1⤵
PID:3456

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1668

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3956

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5640

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5288

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json.tmp
Size 22KB
SHA256 01decb594bd0e4d7fbeeaab9d874d319649120aa6b5fa4077d45dde4833eac2e
MD5 91c5b9141e5585190760f1868ede970b
SHA1 a0172011d147c23240a14c6580d876a0d8fed023
SHA512 fae9f289bc5ce7b5d21c6c1ee915b13075203a8dad043aa627b84dd485d6e88192ac6afdbe72b6e48a8e9c23122a97c30c4d65d6bac6193087190ab0634930a2
SSDEEP 384:P1WuYjnYqR+ZF0DmeG50UNgemz5yOyauBhvhCM5:t2jnV+ZFD5RGXz5NydrZCM5
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 75ee19a7edb8bb81188bc299a2c48a58536b06666bb8a83816a4a8edad1c41ae
MD5 eca08e798b75a95b49db7577bf4c71f8
SHA1 70bfec7c8139c5c152ec2197bb5619076626f35d
SHA512 3fe58a0b03628fe5983cc80c7d5fefaa1056a1fe3ce7cfe06c46bd978ce376aee2a8885fd26bd61a6ec0c7bfc70436c08c488977c7ad1736b93a189d704781e6
SSDEEP 384:H7C9Du9fiGLm4pUqpHLFoCr/E8HPJyD3VonFcP+AWRMACPFTFB:bbBi8mCUqpHLGCr/E8Rg3V/+hRMFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

asrouter.ftl

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 7KB
SHA256 0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0
MD5 c460716b62456449360b23cf5663f275
SHA1 06573a83d88286153066bae7062cc9300e567d92
SHA512 476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30
SSDEEP 192:63/CCBm4CsBJumwOGmnOqiwpJibAKGb9CqwGV:OHPnIwyqwGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

050598569159

Path C:\Users\Admin\AppData\Local\Temp\050598569159
Size 96KB
SHA256 802f7157c5200a1c794f07cd3da0b320e75891581e80df22f46822520872a47f
MD5 18ef72b2bb39916d205727d7ab0e613b
SHA1 01ec2acfbd2a44e7f3a993e92bb5ec9a8cac4b6f
SHA512 8a9d714127ac20b9d95d03b8396f5f27316f21e16c1e587a47f1cf10c77b2f7ef4bfd4591ad501dfb5c718c1a5c06e13ee1431fbe9a1f61cca7f3337f0c1ac06
SSDEEP 1536:sJfSpRXQmMGpaeHpD1YBKdYWAI8drf4b1m4mmnBLBXas3PHo4MSlhY:Q6PMwHTIKdYVI8drf4A4RnvZokY
MD5 SHA1 SHA512 SSDEEP

Submit Download

gold.exe

Path C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
Size 566KB
SHA256 b78402483c46cd37e2c204d95690aa2a213616a1f904d779ceec0e22fcdd6531
MD5 049b6fe48a8cfb927648ad626aba5551
SHA1 9555d23104167e4fad5a178b4352831ce620b374
SHA512 ed787f90966ca1ea4b1e67c4026dd44393c7d312cd52e376f4ba5e5c49616938ec9e913044def29b40b441eb4c913a5134bb78317a179f62067bef3f9d913c7e
SSDEEP 12288:1jlubWMRDyAWLTf1MHzziuddD//x5gmwA964f2ETEO:1j4qMRqpMTziQdD/wjbmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

legas.exe

Path C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
Size 1.3MB
SHA256 c02fcc32573f4546201515667154d9e51e2636af52a1790d1063183c0d012566
MD5 24402fc0617a2740c16ea9c81518d669
SHA1 a0476ef848cd11bb20f8efd06e295a0f44c956ca
SHA512 dd90c0036a8a109c5645b481f1bd7b193fa86518183790b75dbc400416793fb8f9e7d4d4621d7c0227cbbf483758a03a94581397686b09c6f65218b651b5bc63
SSDEEP 24576:0kVD4LnqAsYilQNDuhy/Nl3je9DwScE8VhCqkCLGZiSYAcdin6u1Tp/1K:0SD4Lnq5Yi2NiM1l3ZS0htskE6iTpdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealc_default2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
Size 187KB
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
SSDEEP 3072:QJlVTFj5qDao8KaxfE54HnnGSail+bOX8bX60UFHJKa:QJP5j5Ka2aOanGSabY860UFpKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

javuma.exe

Path C:\Users\Admin\AppData\Local\Temp\1000077001\javuma.exe
Size 6.8MB
SHA256 4d17234e7d928fe07ad348777e08e80cf1b50530c7997645b5f4eb896c0d4404
MD5 8022d07f97b41440f4be8229f5a57069
SHA1 313b34e34c003aa7d4bfd84f7dc6e44503a1e4b7
SHA512 17fd1e31a91d9f0a1303b09d31e815aeed05de5c99e4b821af9b5366e3fa7d4505350b11cc530181b4d5054bfcd457dac45d497aac9556f42a882c5fc9958bb1
SSDEEP 49152:I8oGKIqb64Lw0fGPWVsWeqU9eR7FToV4SFqSiqL7EI4ohxbq3zDzAQJ5JZGW:I8tj4MiB5eqkyFUV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealc_magent.exe

Path C:\Users\Admin\AppData\Local\Temp\1000254001\stealc_magent.exe
Size 10B
SHA256 7515bf959b73b956ceb967351c7e299cbb3668a53d35f9c770eb72e00d93ced6
MD5 ef81e41d11c9e7193ddd3d470dbb3eda
SHA1 0c15d12755a0be84e6403445c427231c274919c6
SHA512 bf69c60fbb6d5ff50d81cd093cbabe59cd4eed439822e9ed02472245c3dae033cec143f1c4bbe6f702b7530f87c020442217ca1859da8f4b0f578a93b46cbdfa
MD5 SHA1 SHA512

Submit Download

newbundle2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
Size 304KB
SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
MD5 58e8b2eb19704c5a59350d4ff92e5ab6
SHA1 171fc96dda05e7d275ec42840746258217d9caf0
SHA512 e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
SSDEEP 3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

a65eb8cace.exe

Path C:\Users\Admin\AppData\Local\Temp\1000332001\a65eb8cace.exe
Size 897KB
SHA256 a87c0f18e15e7b1a8b13354f2107c3d6b1e60da88a5bb196319fa2d7087619bd
MD5 787198c3296e8495382a16e38dcd2cc9
SHA1 64647dcf4d7df0ca054e72a6eba2d62bd5be9d3c
SHA512 df760d7ee602b2cf03d7055812dda63625939bd5803cd7c14d90872d1eb4d3208343c323409c47154308cc4824b295ecdb2bc095b77efee5ff5e15e1bfe28efb
SSDEEP 12288:/qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaxTk:/qDEvCTbMWu7rQYlBQcBiT6rprG8aFk
MD5 SHA1 SHA512 SSDEEP

Submit Download

num.exe

Path C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
Size 307KB
SHA256 27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d
MD5 791fcee57312d4a20cc86ae1cea8dfc4
SHA1 04a88c60ae1539a63411fe4765e9b931e8d2d992
SHA512 2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c
SSDEEP 6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

91d8be2514.exe

Path C:\Users\Admin\AppData\Local\Temp\1000349001\91d8be2514.exe
Size 1.7MB
SHA256 16413a4fbd8e9220e8aac3443d8a4b4f3db01063afc16caf82a5554e3d897393
MD5 9028d6ec8410d854d7a504f65bec566d
SHA1 02b33689d29b36bec5a80d5a65c3cf311f21e33b
SHA512 6bd5962d35f1855354c93ed94444680a6727e071b1607252ac2c1a4ec1ff5efdc6f74be42d2306c2ed9ef60cb2e9adaa6ed0ff2b36ca38c7c04d7f53ddb16cc1
SSDEEP 49152:g3O8bOEUzvnGdPaRpc6hqWsckXJ1FeqIhEuVP:MTbezvnJPc6XnkZmqwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

6332403d47.exe

Path C:\Users\Admin\AppData\Local\Temp\1000354001\6332403d47.exe
Size 1.8MB
SHA256 44dde1f10c72c11df8d7f33d7f0f9570b2257b3783de13efd19a5103e886c9b5
MD5 12e34403109e8cb8c389674544a983a8
SHA1 a1d72bce0f37a06826382a6f7b803fe33917f53d
SHA512 434148f3ab3b09bea60d3b713aacf6e6e414d51565f17df67dfd87596383d90d50d6826309d4489e02179b04da5390a962c4abe3270907e698ecb7dac0241014
SSDEEP 49152:BuIn0YPMGmdAs6QQ27UH7ADUS1JF4tPE+a0u0A:ButYmmkQJGUS1JFVsA
MD5 SHA1 SHA512 SSDEEP

Submit Download

083cc3b61e.exe

Path C:\Users\Admin\AppData\Local\Temp\1000355001\083cc3b61e.exe
Size 1.8MB
SHA256 369a92254621e22bf54c611a279fef9a2ee870182c48db2e93ec233f53e64ba3
MD5 4c7763c0a1a0834602ff210a455c15c1
SHA1 2e31899c521e2dd8cbd4d5abe2de5fab9e0fb8ae
SHA512 b578a380b8dfe5f15797e47430698007f06fe500970dc2a430a5e27af7349a5b2bac106fcf8397f138d9d41640a85ec33ceb8447dbcaf7a1b7728d0d6248ee7b
SSDEEP 49152:i1+q1/5YzpG0V6BToYpbZX32wkLttk3gP1:C+q1/55AwcGM7Lt4gP1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MK.exe

Path C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
Size 314KB
SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
MD5 ff5afed0a8b802d74af1c1422c720446
SHA1 7135acfa641a873cb0c4c37afc49266bfeec91d8
SHA512 11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac
SSDEEP 6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nework.exe

Path C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
Size 416KB
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
SSDEEP 12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5 SHA1 SHA512 SSDEEP

Submit Download

processclass.exe

Path C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
Size 6KB
SHA256 a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6
MD5 c042782226565f89ce3954489075e516
SHA1 256dd5ba42837a33c7aa6cb71cef33d5617117ee
SHA512 9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd
SSDEEP 96:KR0JUnFk9YV0Y9btrzxSC6+1lcBrs4VvlrljlQ0ljhFEuxlSRjbumOLzNt:p396VLSN2GQEvlrljlQ0lj3lMHON
MD5 SHA1 SHA512 SSDEEP

Submit Download

splwow64.exe

Path C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
Size 1.1MB
SHA256 53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a
MD5 ed9393d5765529c845c623e35c1b1a34
SHA1 d3eca07f5ce0df847070d2d7fe5253067f624285
SHA512 565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8
SSDEEP 24576:SjmUMPBrmM35axAiLlvySI1/vJDFBLBYcJ82mnNOt6QVqJYLkmAp984BRCqQGejK:SjmUMPBrmM35axAiLlvySI1/vJDFBLB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

axplong.exe

Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
Size 1.8MB
SHA256 2bef7f94ae35ae24ec6580311d98315cf34e82402ae1f71396e17d03250ccc61
MD5 1a1ac94cc27bf21fa3f542a09658a2c7
SHA1 d0242b0a3a14d9d12c84ed6552b8e1e0280a41c0
SHA512 5209536829cd3052f20169719fa80486398115149fddd3943653f53f17357dbecc0a44a240e72793a390e040619db8b1e5daba02d4cfdd98e712f831c2902228
SSDEEP 49152:vopf4CbB40MG8/SU50BJGcGq0V052j4qNNHd3HajHlgRwEpYrCjAt:ApfLBjTa0BkoX5vqNBoB1AY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmpE5EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE5EB.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-2

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-2
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

H0wMeIntqX.exe

Path C:\Users\Admin\AppData\Roaming\H0wMeIntqX.exe
Size 393KB
SHA256 3d66fed04c76d055c6149b33dcfda544b509c57087c57a861e1d6256b59f8465
MD5 7d7366ab79d6d3d8d83d13a8b30de999
SHA1 75c6c49a6701d254c3ce184054a4a01329c1a6f3
SHA512 64f4551b3be1c21ce7c2d49608463e5aec4166e3e6893883c33a5b7d1109ef0fc8ab6bd15c70d9d606e2706f12a937c2d90d5bc8f6c629ad6f30f212dc25f022
SSDEEP 6144:qhUGuz/J74kSIjF0nLuMjqrWqOckWkqrDzP8U3S0pM:qhUGix7cKaqraHWhr5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_cca0d105-8260-4611-8c12-bd85a7208b9f

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4050598569-1597076380-177084960-1000\76b53b3ec448f7ccdda2063b15d2bfc3_cca0d105-8260-4611-8c12-bd85a7208b9f
Size 2KB
SHA256 d0b5302d343393ff885d474333a32dc48ccd085a25bb928b49bf9faed68536b4
MD5 56f30526692ac98386108d0cab0e4cba
SHA1 705342470d25b1942a7ceed8908b84bde7519a66
SHA512 ef6bc9fb42e79ed712d505bfddafcbb1786d20d3d51928046a75aef14b9e0c72839bce09e61e542d544b2c27bf0b8aafebd21c834fd68400b7d4ceca07f7970e
MD5 SHA1 SHA512

Submit Download

Office Manager.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url
Size 70B
SHA256 b5fd05a1a23d90dee32a1f61158a1e0859fde6882b289267c90845bb995b0c09
MD5 1c5c0d2105718982915d88e1e34b7c24
SHA1 ecb11df5274a3a37c81fc19b95ec316d39bb6f03
SHA512 9e1f86ca561c034078acbce22e6b3b2dc938a883f4897167c96ad7c61f28d30075d66557335825c18a00f96467fbd1dee067bb756388ba60b21443ba964ba331
MD5 SHA1 SHA512

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
Size 10KB
SHA256 4484b02e94c8600bf6bef0019b77744fd613db185f918f2074a43f12946bf2e1
MD5 01f68c076be5c471cfe389f0aadd098c
SHA1 042aa91eb38c545d631b48cbeb87d6232e129fb2
SHA512 61ae74e5e929ebe800aaf21622d71d74c42159d36f03f757e956a936e93fd73e236665b294534f9754c2a51dded4040343d9a6771f24b76ad09b240743a929a4
SSDEEP 96:j5oMebVK+rxbGebOJ+rxbEpebvpf++rxb:j5krHrqu3r
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
Size 17KB
SHA256 fbf13219ef8f2811a15c8a5862a2547c36b03b8d5df3e80a65972967f458bcf7
MD5 c3e6abbd3ffee206226d07b04072ccb3
SHA1 1c93fc7b729cea1b93bc610fecc81e7ad45e530a
SHA512 73b51e8064cbc603e07685065636510e9e2958b74169eb9eebf102b70e36d8d4526a467b96980b1496275ac8fb8281d1afd31b0b09b943d2b3d4fd90f5ebc189
SSDEEP 96:z5oMebVK+rxbGebOJ+rxbzpebvpf+XrxbabkrxbfgbgznrxbSbYrxbUbQrxbDrrr:z5krHrhuCrjrzrXrPrJrrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 ac586d0afdb0dc0da6dc14699500b30de1a353c7f5113f97aaaa116d94140f39
MD5 d26ecbed24ef7b8586ca25c1d3a8c0e3
SHA1 705c5ee52824b7468b4b415d5a2333931530fa08
SHA512 d0a3adf9567ed9251a00567a4460d2db7d75d4c8470f6aa906e0701db1ec1326ea36a0a92a007c8d7c73bb7d0cadd706483c60385083932ab135ade8cc60982e
SSDEEP 768:IuHQ1uMlDnimUHMU5GWbebqbBbpbibubHbc+sf7eIEm:H2uM3+sfb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 e070a1fe5f652b325dd2f4a121ca974235f8c93cda9edfe4ccc599def1eef8a2
MD5 be558794a0effcfc99072dcbca3ddab0
SHA1 dda0c7624257135bb41fe67976cc9a41552b8a84
SHA512 c839ae740df4b58d425714bc1897cc9c20b44b436cc1e8ec66d4f3e53e247c8ef78f6d5c618702d1343327d1d074e88bf3d802d5bc47765a01ae366a4436ac9a
SSDEEP 768:yQ1uMlDnimUHMU5GWbebqbBbpbibubHbc+sf7eIE9mj:y2uM3+sff
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 0a5a487168bd59ba2b2c88b9ce2727c1f5d72a9d965380f5e3073d97ca05b624
MD5 a4e0a443a933026f46f8b8c840b5d736
SHA1 eed293d3471f5572b5870b200f42c8c05573e9cd
SHA512 85d3f888055849d5c7b5a0194f1c9e33c17afca9786216fda1725d379c08c0b27b21d2c4618b44d1c43b7947c77e502796ba01ad5343e13fe556ff35ece1569e
SSDEEP 96:4SMF9ZbkW6ShmNFPPP/PrWZGpnQp0Mi6Fl66JozGzgClKtmSSM:4rvZboShIpPC5V/66JozGzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 281c501ce30559d43519d1812963a6f10da9de90cb7df5b7885f55c1396f214a
MD5 fb46eff083686e417c2182c186c0b369
SHA1 489567a4bce481e1f79bee8bbf50c0ed1a607fab
SHA512 86c30c00e737e4d0c4ba10ec7e388b7505e735ef66ec54bfbf88b2c87f954fadd46c3d54429fcb0e13358ff61b4315e92fa1a7e79285e5f2c61be5f71e962559
SSDEEP 192:QrvZboPAhgcOpPUgCV/66JozGzgCl6mSSM:+bo4qpP0V/66JozGzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

200f66e5-221a-4e4e-abfe-aa76425089b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\200f66e5-221a-4e4e-abfe-aa76425089b8
Size 671B
SHA256 9659c93ed5e14430796cc200e37656087fe3a3131cab7cfa04aca99a3556f9b1
MD5 19e43b4ad21204e8438a720ad728ee46
SHA1 fbe2b84a5eab6462955f474eef4780d00fe788d1
SHA512 2e8df4db4720a406c4ee2dd6e08a305f0e4810878e86e5a07d174082f6942a3f5225e5de4c2eb4cfb016f44fb05c2bcf38c50e8a8014511e1f670318ebbdfa9d
MD5 SHA1 SHA512

Submit Download

4f673056-68a4-4369-8025-5600ccb373d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\4f673056-68a4-4369-8025-5600ccb373d8
Size 27KB
SHA256 e5d5f2c9f9723ac24e74aed31d03e2b3f0b328260338b9c563872e4a9642922c
MD5 b0007b91b3042de28f5a279485ea36c9
SHA1 76daea7688f4cb036b2ba90aac800232e9f68995
SHA512 806ea22c0397df7315dae287322bd2b9ace15146377799b7d2f442697e34bfcf94764053d1d2b858e76ac460dfc380b4382ae063799636699193411e7102b925
SSDEEP 192:SuSrTU87zxctFRatbr8V4gRFp/6SHkG76rZkwuKZvpJoU7ic+ny1WBI24FvQ8bRc:SZp7lcbR2boVPfH4i0+6e07I
MD5 SHA1 SHA512 SSDEEP

Submit Download

6481a9ea-10f5-4cdb-8d14-bf974d12d82c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\6481a9ea-10f5-4cdb-8d14-bf974d12d82c
Size 982B
SHA256 70589b2baedef8a93ad0dd6d97757fd9cd3f6620fbab03ca066c6f7411446820
MD5 16072871701c3f115d43ab9c2aa88c29
SHA1 ced5d2c7845541147e23cf22da58de5f7b9d3c19
SHA512 7afe2c5c3b918032137efdbabdf766d4b62c9f971ae4414b6d03f4b3faeaf90c53da9badcfb835290a485e0b7c3eb28897d591116c3bba3c12837819409065b4
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll.tmp
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

LICENSE.txt.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp
Size 1KB
SHA256 6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683
MD5 36e5ee071a6f2f03c5d3889de80b0f0d
SHA1 cf6e8ddb87660ef1ef84ae36f97548a2351ac604
SHA512 99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
Size 13KB
SHA256 c5dd918b8c1b6820744fd3a7667b0d518dcd1ac97187b933df050657773ca659
MD5 d37b8458b7303fff681b709f59391d13
SHA1 d3ec4b2932f12ccb19c3a76ccbd434468b123bcb
SHA512 07f38a2a24cfab9ffd99c71bf42725d963a70c480dc450f03ff2bb0dd66b575a5b762a4cbec35af7838e36fc5a08308768d8c605a62a45a36b560c628d29c1b1
SSDEEP 192:JanARLbf5Gy+Tidxndd3SW+aIbMTtI7VUtSVDiJ1aX0EVoeBw8HEszC4:t1dxvSW+HBgSVKEVpwl0
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
Size 10KB
SHA256 2305bbe40ed5de5d5f9372869139a4f35ca3a29cb9d54a6d377bf1857c2d7794
MD5 c28f966b0b7803bbbbaf7b039aef54a8
SHA1 db96f7c0c0ef1bb1d05dd3bdbe830f6f263947ea
SHA512 fc635f6e99c70a945a66212160543380f077f71c40fe09bf39f861d06147821aedb34defb0e8b4e046dd6818dada25cf1071e8c9a0a69ffd64f6b035faadb99e
SSDEEP 192:Y5nARLbfXZzTVofAHBtq8prddx9y1ZO43gaXl5EVo8Bw8V3:phVoIbpd9y1ZOC5EVfw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
Size 11KB
SHA256 a417233694b47e270edab545fe0fba7d61bc8a0a0091fae2421f13a4384ad73a
MD5 3a482107cb5dd123cdbfb5f51f5626ce
SHA1 59caf4e31e16e9a8f832005c8a8771fcf4e6d20d
SHA512 74cdc958b288bb9bee625a2d13a49f24095528284900b9262221a2abfd253446b750b762801562754603d852acadf05639888837492e9e3631bdff727b13616f
SSDEEP 192:JanARLbfXGy+Tidxndd3SW+aIbMTtI7VUtSVDiJ1aX0EVo6Bw8HEsK:tXdxvSW+HBgSVKEVvwlp
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.8MB
SHA256 f880cf32d71ffd4a780b2daa486715df53346206f0727f12342e7e9220b381d3
MD5 b08b93fde7095ccc7d94fccd29491075
SHA1 d619711160e2ebc53fa935a7b03959f2abf3ee09
SHA512 51deeed41cf970d58aa20a255e96c067d62e578843bea58dbf3df3e802692f39d4caadba294549e6f61ddbbef0cfa72ebde0ffec97d56d7f05c0a1ae2fdefd9f
SSDEEP 12288:kSPwylk3cbLrI6rFJ+5Mfe/rOzqKcMsdlS:k4wylHDjry5we/rOzq7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.9MB
SHA256 8f5f351ab2b0395085ecfb0765fab5b0f0be9015a9a1c7e3a1f83db335afb263
MD5 c357b528fea86b05f5d548b64d167af1
SHA1 4b19015d4864dc4ff3181dd640df81f76b3c0e3e
SHA512 8f841c538a8b85a4f220768fff1871492770eadcd32b5afd581b5b5c51fe0a88ed987181dd5a5c631d9c68c7621bc6395709f3270ceecabbc4f366c722a4754c
SSDEEP 49152:ZcwtxujaUuHm+5CW535LVidxK+0eP4rXse0VGv0zv4V9NDnH/8j1dIjl1gB3XYWB:Zh
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 9.4MB
SHA256 5d5f6e7b9f71459d96ff2f5c6a4ccd6ca54b6117b11c7b8aa09e3ae44e49ebef
MD5 6c039f58f7a93f8ffaa884d81024df8e
SHA1 a2cf45a580daec36f1663693e404bcab13bb7e78
SHA512 171babeb40143f4c8b40538befd01904a73833aef2c06048959e032b1d83a58f706cf31fa0b80ef6b9d51d795ba6b3acc0f1482264bbf324a4fa4bff8f185836
SSDEEP 49152:m8C5yhiDNezybOxhUqVxi6JCXjjDUHjp+ogPDHv2BodVcyrKE5QxujaUmHm+5CWJ:50G
MD5 SHA1 SHA512 SSDEEP

Submit Download

WW2WJzGyTj.exe

Path C:\Users\Admin\AppData\Roaming\WW2WJzGyTj.exe
Size 602KB
SHA256 973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a
MD5 e4fc58d334930a9d6572c344e5129f6b
SHA1 d38fbd0c4c86eee14722f40cc607e2128c01b00f
SHA512 a69f5da8de8c9782769cca2e2fc5b28bbeba0c0d0027954dbe47b15610d82277abbe912f0e5921a18000f1a3a3c54eb5922f70c773537a22f4b35ff926d17a59
SSDEEP 6144:nxLHgtvsrT8Y82Mgp17GA1Ce9OkksWY0TNQlMAqgDqJW9HVh:nxTgtvUQl2Mi50hQlMlgz9/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 4d6ea522585b2cf1df410c7957fee92ed56dca7a84ea3e0ff998b52e6d63e4dc
MD5 7db726d112f0c80a4cfbc4e2686b68ce
SHA1 d2f97969be7b219cbe1a70f9ca677d0071116f84
SHA512 64323256e7b761ae2f68be1dd6a502d7c447ea7fef7b6a4a3d155d4df8352b0063b2adc0f5a2ca9720b472eca64262473ca6a5e24ef0b50627af407182299a35
MD5 SHA1 SHA512

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 81c13d3428fa8ad34490690feb7176a14301c9d35a64a45c74e13d0bc277d9eb
MD5 8c5cedc2738838f66b2ba7b569dee6ea
SHA1 4606bc1593e92ab21ee09fdd389ade86c62bb39c
SHA512 fa76018e44bfb124359db50e7d304db00be88c1a197507802f722d19a011faab9eba2a67922037f0808e50fe94f5924ff790560e95a8b08aee9a5f89190ce517
MD5 SHA1 SHA512

Submit Download

memory/548-866-0x0000000000810000-0x0000000000EC5000-memory.dmp

Download

memory/548-867-0x0000000000810000-0x0000000000EC5000-memory.dmp

Download

memory/1124-356-0x0000000000610000-0x0000000000618000-memory.dmp

Download

memory/1156-385-0x0000000000700000-0x0000000000DB5000-memory.dmp

Download

memory/1156-207-0x0000000000700000-0x0000000000DB5000-memory.dmp

Download

memory/1156-428-0x0000000000700000-0x0000000000DB5000-memory.dmp

Download

memory/1156-840-0x0000000000700000-0x0000000000DB5000-memory.dmp

Download

memory/1668-902-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/1668-909-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/1744-46-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1744-43-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1744-45-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1880-447-0x0000000000010000-0x0000000000271000-memory.dmp

Download

memory/1880-449-0x0000000000010000-0x0000000000271000-memory.dmp

Download

memory/2040-274-0x00000000007E0000-0x0000000000834000-memory.dmp

Download

memory/2040-907-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/2040-905-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/2152-93-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-19-0x0000000000291000-0x00000000002BF000-memory.dmp

Download

memory/2152-18-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-173-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-892-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-20-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-429-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-21-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-122-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-850-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-910-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2152-225-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/2472-146-0x000000001DAA0000-0x000000001DADC000-memory.dmp

Download

memory/2472-364-0x000000001E3A0000-0x000000001E4A2000-memory.dmp

Download

memory/2472-145-0x000000001DA80000-0x000000001DA92000-memory.dmp

Download

memory/2472-197-0x000000001E930000-0x000000001E9A6000-memory.dmp

Download

memory/2472-144-0x000000001DB50000-0x000000001DC5A000-memory.dmp

Download

memory/2472-198-0x000000001D920000-0x000000001D93E000-memory.dmp

Download

memory/2472-94-0x00000000006C0000-0x0000000000728000-memory.dmp

Download

memory/2472-230-0x000000001FD40000-0x0000000020268000-memory.dmp

Download

memory/2472-319-0x000000001E3A0000-0x000000001E4A2000-memory.dmp

Download

memory/2516-318-0x000000001DA70000-0x000000001DB72000-memory.dmp

Download

memory/2516-378-0x000000001DA70000-0x000000001DB72000-memory.dmp

Download

memory/2516-95-0x0000000000080000-0x000000000011C000-memory.dmp

Download

memory/2516-229-0x000000001E5D0000-0x000000001E792000-memory.dmp

Download

memory/2692-456-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/2692-455-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/2692-873-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/2692-952-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/2692-285-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/2692-899-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/3032-448-0x00000000096E0000-0x0000000009730000-memory.dmp

Download

memory/3032-423-0x0000000006E20000-0x0000000006E86000-memory.dmp

Download

memory/3032-440-0x0000000009E70000-0x000000000A39C000-memory.dmp

Download

memory/3032-438-0x0000000009770000-0x0000000009932000-memory.dmp

Download

memory/3032-287-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3404-68-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/3404-67-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/3404-90-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/3404-69-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/3816-141-0x0000000000A10000-0x0000000000A62000-memory.dmp

Download

memory/3816-143-0x0000000005390000-0x0000000005422000-memory.dmp

Download

memory/3816-142-0x00000000058A0000-0x0000000005E44000-memory.dmp

Download

memory/3816-172-0x0000000006C50000-0x0000000006C9C000-memory.dmp

Download

memory/3816-171-0x0000000006AE0000-0x0000000006B1C000-memory.dmp

Download

memory/3816-147-0x0000000005350000-0x000000000535A000-memory.dmp

Download

memory/3816-164-0x0000000005F50000-0x0000000005FC6000-memory.dmp

Download

memory/3816-170-0x0000000006A80000-0x0000000006A92000-memory.dmp

Download

memory/3816-169-0x0000000006B40000-0x0000000006C4A000-memory.dmp

Download

memory/3816-168-0x0000000006FF0000-0x0000000007608000-memory.dmp

Download

memory/3816-165-0x00000000069B0000-0x00000000069CE000-memory.dmp

Download

memory/3912-886-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3912-885-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3912-893-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3912-884-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3956-3369-0x0000000000290000-0x000000000074B000-memory.dmp

Download

memory/4184-246-0x0000000000D90000-0x000000000125B000-memory.dmp

Download

memory/4184-283-0x0000000000D90000-0x000000000125B000-memory.dmp

Download

memory/4536-4-0x0000000000FF0000-0x00000000014AB000-memory.dmp

Download

memory/4536-2-0x0000000000FF1000-0x000000000101F000-memory.dmp

Download

memory/4536-17-0x0000000000FF0000-0x00000000014AB000-memory.dmp

Download

memory/4536-0-0x0000000000FF0000-0x00000000014AB000-memory.dmp

Download

memory/4536-3-0x0000000000FF0000-0x00000000014AB000-memory.dmp

Download

memory/4536-1-0x0000000077054000-0x0000000077056000-memory.dmp

Download

memory/4604-422-0x00000000008D0000-0x00000000009E8000-memory.dmp

Download

memory/4604-424-0x000000000B440000-0x000000000B4C4000-memory.dmp

Download

memory/4884-111-0x0000000000BA0000-0x0000000000DE3000-memory.dmp

Download

memory/4884-174-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4884-427-0x0000000000BA0000-0x0000000000DE3000-memory.dmp

Download

memory/4936-42-0x0000000000497000-0x0000000000498000-memory.dmp

Download

memory/5288-3366-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/5288-3370-0x0000000000280000-0x000000000074B000-memory.dmp

Download

memory/5656-811-0x0000000069CC0000-0x000000006A377000-memory.dmp

Download

memory/5656-883-0x0000000000D80000-0x000000000144B000-memory.dmp

Download

memory/6080-838-0x0000000000CE0000-0x000000000117C000-memory.dmp

Download

memory/6080-844-0x0000000000CE0000-0x000000000117C000-memory.dmp

Download

memory/6124-1040-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/6124-914-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/6124-913-0x0000000000400000-0x0000000000471000-memory.dmp

Download