amadey | 1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
Size

1.8MB
MD5

1ffa4102583628826fa4536dbbf521a0
SHA1

c3cc8501e03cd7b7694c634bc78948dd493c6168
SHA256

1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69
SHA512

8a8b16f9b0d4073cb65fcc2c127ac1d724f5fe198ef1f80e0429b158fd7904fdaf627b4042a077bba79ab6b13c22a1e4c20712815c7850fe4b8395ee1d097c21
SSDEEP

24576:0ecBq+jT6+HkDP6KYigqqUpqjNdoBnMz45cRBTjUW8+AqaOeIJNJ472db8Onu9I7:sVTSDCIgqqmqb4qAnXoJ47Sb8OoIKjS

Score

10^/10

amadey cryptbot lumma redline stealc 1176f2 9c9aa5 default_valenciga doma fed3aa tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

https://drawwyobstacw.sbs

https://condifendteu.sbs

https://ehticsprocw.sbs

https://vennurviot.sbs

https://resinedyw.sbs

https://enlargkiw.sbs

https://allocatinow.sbs

https://mathcucom.sbs

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29862

Extracted

Family

stealc

Botnet

doma

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Detects CryptBot payload 1 IoCs

CryptBot is a C++ stealer distributed widely in bundle with other software.

spyware stealer

resource	yara_rule
behavioral2/memory/2576-410-0x0000000069CC0000-0x000000006A377000-memory.dmp	family_cryptbot_v3

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/916-233-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e32d09a575.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	65a5dc1e46.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	04bef77b59.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	12f292ffd1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	04bef77b59.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	65a5dc1e46.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	12f292ffd1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	12f292ffd1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e32d09a575.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e32d09a575.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	04bef77b59.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	65a5dc1e46.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	65a5dc1e46.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	processclass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Hkbsse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sadsay.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	app.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Nework.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	splwow64.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqdqsd.vbs	app.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	context.exe

Executes dropped EXE 29 IoCs

pid	Process
2300	axplong.exe
3244	gold.exe
2876	legas.exe
2740	nH3gTSwdIy.exe
452	I7goEtd30f.exe
4352	stealc_default2.exe
4796	e32d09a575.exe
4400	65a5dc1e46.exe
3680	MK.exe
4072	skotes.exe
4744	Nework.exe
1596	Hkbsse.exe
4816	processclass.exe
392	splwow64.exe
2576	sadsay.exe
4156	af7f25cb9b.exe
5064	num.exe
2172	Hkbsse.exe
4384	skotes.exe
1412	axplong.exe
5328	12f292ffd1.exe
4080	context.exe
5872	04bef77b59.exe
6036	app.exe
5276	service123.exe
5616	axplong.exe
5944	skotes.exe
3968	Hkbsse.exe
6588	service123.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	e32d09a575.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	65a5dc1e46.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	12f292ffd1.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	04bef77b59.exe

Loads dropped DLL 4 IoCs

pid	Process
4352	stealc_default2.exe
4352	stealc_default2.exe
5276	service123.exe
6588	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e32d09a575.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\e32d09a575.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\65a5dc1e46.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\65a5dc1e46.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\af7f25cb9b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000332001\\af7f25cb9b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\num.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000336001\\num.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12f292ffd1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000349001\\12f292ffd1.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04bef77b59.exe = "C:\\Users\\Admin\\1000350002\\04bef77b59.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0003000000022e1d-387.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
984	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
2300	axplong.exe
4796	e32d09a575.exe
4400	65a5dc1e46.exe
4072	skotes.exe
1412	axplong.exe
4384	skotes.exe
5328	12f292ffd1.exe
5872	04bef77b59.exe
5616	axplong.exe
5944	skotes.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 1844	3244	gold.exe	88
PID 2876 set thread context of 1928	2876	legas.exe	100
PID 3680 set thread context of 916	3680	MK.exe	114
PID 392 set thread context of 2788	392	splwow64.exe	157
PID 4080 set thread context of 6064	4080	context.exe	165
PID 6036 set thread context of 5852	6036	app.exe	177

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
File created	C:\Windows\Tasks\skotes.job	65a5dc1e46.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3820	3244	WerFault.exe	87
4960	2876	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af7f25cb9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12f292ffd1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sadsay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e32d09a575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	num.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04bef77b59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65a5dc1e46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	legas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sadsay.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sadsay.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4596	timeout.exe
5300	timeout.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
5244	taskkill.exe
1364	taskkill.exe
764	taskkill.exe
1416	taskkill.exe
2524	taskkill.exe
2348	taskkill.exe
3484	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
984	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
984	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
2300	axplong.exe
2300	axplong.exe
4352	stealc_default2.exe
4352	stealc_default2.exe
4796	e32d09a575.exe
4796	e32d09a575.exe
2740	nH3gTSwdIy.exe
452	I7goEtd30f.exe
4400	65a5dc1e46.exe
4400	65a5dc1e46.exe
4072	skotes.exe
4072	skotes.exe
4352	stealc_default2.exe
4352	stealc_default2.exe
916	RegAsm.exe
916	RegAsm.exe
916	RegAsm.exe
916	RegAsm.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4384	skotes.exe
4384	skotes.exe
1412	axplong.exe
1412	axplong.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
5328	12f292ffd1.exe
5328	12f292ffd1.exe
5872	04bef77b59.exe
5872	04bef77b59.exe
4080	context.exe
4080	context.exe
4080	context.exe
4080	context.exe
6140	powershell.exe
6140	powershell.exe
6140	powershell.exe
6036	app.exe
6036	app.exe
6036	app.exe
5616	axplong.exe
5616	axplong.exe
5944	skotes.exe
5944	skotes.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeBackupPrivilege	452	I7goEtd30f.exe
Token: SeSecurityPrivilege	452	I7goEtd30f.exe
Token: SeSecurityPrivilege	452	I7goEtd30f.exe
Token: SeSecurityPrivilege	452	I7goEtd30f.exe
Token: SeSecurityPrivilege	452	I7goEtd30f.exe
Token: SeBackupPrivilege	2740	nH3gTSwdIy.exe
Token: SeSecurityPrivilege	2740	nH3gTSwdIy.exe
Token: SeSecurityPrivilege	2740	nH3gTSwdIy.exe
Token: SeSecurityPrivilege	2740	nH3gTSwdIy.exe
Token: SeSecurityPrivilege	2740	nH3gTSwdIy.exe
Token: SeDebugPrivilege	452	I7goEtd30f.exe
Token: SeDebugPrivilege	2740	nH3gTSwdIy.exe
Token: SeDebugPrivilege	764	taskkill.exe
Token: SeDebugPrivilege	916	RegAsm.exe
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	3484	taskkill.exe
Token: SeDebugPrivilege	4816	processclass.exe
Token: SeDebugPrivilege	4056	firefox.exe
Token: SeDebugPrivilege	4056	firefox.exe
Token: SeDebugPrivilege	392	splwow64.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	4080	context.exe
Token: SeDebugPrivilege	1364	taskkill.exe
Token: SeDebugPrivilege	6036	app.exe
Token: SeDebugPrivilege	6140	powershell.exe
Token: SeDebugPrivilege	6036	app.exe
Token: SeDebugPrivilege	5852	AppLaunch.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4156	af7f25cb9b.exe
4156	af7f25cb9b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4056	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 2300	984	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe	86
PID 984 wrote to memory of 2300	984	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe	86
PID 984 wrote to memory of 2300	984	1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe	86
PID 2300 wrote to memory of 3244	2300	axplong.exe	87
PID 2300 wrote to memory of 3244	2300	axplong.exe	87
PID 2300 wrote to memory of 3244	2300	axplong.exe	87
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 3244 wrote to memory of 1844	3244	gold.exe	88
PID 2300 wrote to memory of 2876	2300	axplong.exe	92
PID 2300 wrote to memory of 2876	2300	axplong.exe	92
PID 2300 wrote to memory of 2876	2300	axplong.exe	92
PID 2876 wrote to memory of 3048	2876	legas.exe	93
PID 2876 wrote to memory of 3048	2876	legas.exe	93
PID 2876 wrote to memory of 3048	2876	legas.exe	93
PID 2876 wrote to memory of 1492	2876	legas.exe	94
PID 2876 wrote to memory of 1492	2876	legas.exe	94
PID 2876 wrote to memory of 1492	2876	legas.exe	94
PID 2876 wrote to memory of 2136	2876	legas.exe	95
PID 2876 wrote to memory of 2136	2876	legas.exe	95
PID 2876 wrote to memory of 2136	2876	legas.exe	95
PID 2876 wrote to memory of 4152	2876	legas.exe	96
PID 2876 wrote to memory of 4152	2876	legas.exe	96
PID 2876 wrote to memory of 4152	2876	legas.exe	96
PID 2876 wrote to memory of 2772	2876	legas.exe	97
PID 2876 wrote to memory of 2772	2876	legas.exe	97
PID 2876 wrote to memory of 2772	2876	legas.exe	97
PID 2876 wrote to memory of 3004	2876	legas.exe	98
PID 2876 wrote to memory of 3004	2876	legas.exe	98
PID 2876 wrote to memory of 3004	2876	legas.exe	98
PID 2876 wrote to memory of 884	2876	legas.exe	99
PID 2876 wrote to memory of 884	2876	legas.exe	99
PID 2876 wrote to memory of 884	2876	legas.exe	99
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 2876 wrote to memory of 1928	2876	legas.exe	100
PID 1928 wrote to memory of 2740	1928	MSBuild.exe	103
PID 1928 wrote to memory of 2740	1928	MSBuild.exe	103
PID 1928 wrote to memory of 452	1928	MSBuild.exe	104
PID 1928 wrote to memory of 452	1928	MSBuild.exe	104
PID 2300 wrote to memory of 4352	2300	axplong.exe	105
PID 2300 wrote to memory of 4352	2300	axplong.exe	105
PID 2300 wrote to memory of 4352	2300	axplong.exe	105
PID 2300 wrote to memory of 4796	2300	axplong.exe	106
PID 2300 wrote to memory of 4796	2300	axplong.exe	106
PID 2300 wrote to memory of 4796	2300	axplong.exe	106
PID 2300 wrote to memory of 4400	2300	axplong.exe	110
PID 2300 wrote to memory of 4400	2300	axplong.exe	110
PID 2300 wrote to memory of 4400	2300	axplong.exe	110
PID 2300 wrote to memory of 3680	2300	axplong.exe	111
PID 2300 wrote to memory of 3680	2300	axplong.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe
"C:\Users\Admin\AppData\Local\Temp\1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 284
      4⤵
      Program crash
      PID:3820
- - C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3048
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1492
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:2136
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:4152
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:2772
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3004
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:884
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Users\Admin\AppData\Roaming\nH3gTSwdIy.exe
        
        "C:\Users\Admin\AppData\Roaming\nH3gTSwdIy.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
    - - C:\Users\Admin\AppData\Roaming\I7goEtd30f.exe
        
        "C:\Users\Admin\AppData\Roaming\I7goEtd30f.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 320
      4⤵
      Program crash
      PID:4960
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\1000354001\e32d09a575.exe
    "C:\Users\Admin\AppData\Local\Temp\1000354001\e32d09a575.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\1000355001\65a5dc1e46.exe
    "C:\Users\Admin\AppData\Local\Temp\1000355001\65a5dc1e46.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\1000332001\af7f25cb9b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000332001\af7f25cb9b.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4156
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:764
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:552
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4056
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48c14b3b-5239-4ddd-92c8-ad103ad80624} 4056 "\\.\pipe\gecko-crash-server-pipe.4056" gpu
        8⤵
        
        PID:1600
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d6b24bf-e7f6-4de1-a3bc-f1f404d50085} 4056 "\\.\pipe\gecko-crash-server-pipe.4056" socket
        8⤵
        
        PID:4552
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3040 -childID 1 -isForBrowser -prefsHandle 3412 -prefMapHandle 3408 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57e74808-67e7-4dfe-bd31-4f55c8cb6b09} 4056 "\\.\pipe\gecko-crash-server-pipe.4056" tab
        8⤵
        
        PID:3748
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3668 -childID 2 -isForBrowser -prefsHandle 3696 -prefMapHandle 3692 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e60eb6e-d959-45ed-892c-c1a04c8f91fc} 4056 "\\.\pipe\gecko-crash-server-pipe.4056" tab
        8⤵
        
        PID:2040
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4628 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4616 -prefMapHandle 4592 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {312b0c85-262a-4e92-bacb-a30326319cfc} 4056 "\\.\pipe\gecko-crash-server-pipe.4056" utility
        8⤵
        Checks processor information in registry
        
        PID:5472
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5296 -childID 3 -isForBrowser -prefsHandle 5288 -prefMapHandle 5264 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c71eb1fa-75f2-4806-86f9-9932ee2ab66b} 4056 "\\.\pipe\gecko-crash-server-pipe.4056" tab
        8⤵
        
        PID:6040
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 4 -isForBrowser -prefsHandle 5536 -prefMapHandle 5412 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d2352ed-a3ff-4327-a679-82e0eb5be9cf} 4056 "\\.\pipe\gecko-crash-server-pipe.4056" tab
        8⤵
        
        PID:6052
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5640 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5756 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a48a8b5-5ec3-45a7-b065-1198ede64e56} 4056 "\\.\pipe\gecko-crash-server-pipe.4056" tab
        8⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\1000349001\12f292ffd1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000349001\12f292ffd1.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5328
    - - C:\Users\Admin\1000350002\04bef77b59.exe
        
        "C:\Users\Admin\1000350002\04bef77b59.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        
        PID:1988
- - C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
    "C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3680
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:916
- - C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
    "C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\1000082001\sadsay.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000082001\sadsay.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5276
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5424
- - C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
    "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start context.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        5⤵
        Drops startup file
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4080
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:6004
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:6048
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1284
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4596
- - C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
    "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:392
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5244
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5300
- - C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe
    "C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6036
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMAA0ADIANAAwADAAMQBcAGEAcABwAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADAANAAyADQAMAAwADEAXABhAHAAcAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABzAHEAZABxAHMAZAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAHMAcQBkAHEAcwBkAC4AZQB4AGUA
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6140
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3244 -ip 3244
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2876 -ip 2876
1⤵
PID:3412

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:2172

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4384

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1412

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5616

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5944

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3968

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
211aa12135531308c477a71a5218a4e5

SHA1
72987904719f8cee9e2b8f64914dc036a1d19b0a

SHA256
4b1e8f05b0e3f4075750f52a121a4c8d11c571bb7f11cc1ac44549c9b4746a53

SHA512
6118ab77b25bb18445ad924333118b407a8d254250576da8c59efd6c835aa1d77b34e4e76c3ccbefedec435420a2da9ecc51955bebc3771b41b602b4e5cd31a5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Filesize
13KB

MD5
83761095bc2c0307798fb3271c28c155

SHA1
cd12f05206409e4468a617e7f7dcee4fe09cd774

SHA256
cfa5554577385790a784e6b297459f72547d3fd57fc986ab2bcaaeb25d019608

SHA512
1be5f01d69a22baf43b1987428f8dbb7ed7df891349cc8ea522f75a4ca81091a8907491761989f1bd6c77522edbcdb3f5ac96c92df1b2ac5fb59e8d7bdd87fd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\045521122590

Filesize
96KB

MD5
7ceccbd6555bec0c589f5b295dee55ad

SHA1
a423dfee607179f87cb47a4b82e0f77d5b4cc26f

SHA256
304a61f45c17fd3cfc2cf6b5c1a3ea3929da376826dbd884671eeb78f21135dd

SHA512
8434ac3eee7140656bfd6de1c8b5828e31edf587542dbc1045f71b41652465a0cebd89d40393f36e0ab4d210d078153e37fb6324e47041a2fe1f4c6fd1abd897

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

Filesize
566KB

MD5
049b6fe48a8cfb927648ad626aba5551

SHA1
9555d23104167e4fad5a178b4352831ce620b374

SHA256
b78402483c46cd37e2c204d95690aa2a213616a1f904d779ceec0e22fcdd6531

SHA512
ed787f90966ca1ea4b1e67c4026dd44393c7d312cd52e376f4ba5e5c49616938ec9e913044def29b40b441eb4c913a5134bb78317a179f62067bef3f9d913c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe

Filesize
1.4MB

MD5
e6d27b60afe69ac02b1eaec864c882ae

SHA1
a72b881867b7eaa9187398bd0e9e144af02ffff4

SHA256
aac36ff20ea7bfc0591c1d6b145b456bad394ee8e619343ec10d1809188edd75

SHA512
4f11fc2b36589fc9ff7dc5afd27cb91614f6a89bfd60942baebef025f53cb56ed7413abeff57fc7c85b3a2a4b0feec2649d5c5a856d3e2e9c13f6a0d8c777764

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000080001\fikbbm0902845.exe

Filesize
18B

MD5
174ef859dfe296a48628dc40ef8e05ed

SHA1
59a0e43e3ae9c8f638932b9cf83bf62ad91fb2b7

SHA256
84520353f099eee2117b00aa16cde461e573a835e8ddd64334efd871d4ce292c

SHA512
c6d0e9d1842a4ce05929f8941b8e30729567626cf1594f3b11958cde9347e1d8e8cde5f9f9584953122fd035fedec0b09c0bd184abc0f33eac4862d85e164ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000082001\sadsay.exe

Filesize
7.4MB

MD5
735bb5f55a17215700840c04a8b40a03

SHA1
55e0828c6d08653939eee2b1af8fd737e92266c4

SHA256
5ea6a5e3bc6c02cc41637028050c3738c38a07917e373637928b314c5d22f84d

SHA512
7e742677e35099d8cd4a5163eea6633e3ec7deeb4840aba1f8adad8f0022e72f7416ac6367802eceab8f9f2e9dd04e1546b141e911495d025b98575a92f3865c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000254001\red.exe

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000332001\af7f25cb9b.exe

Filesize
898KB

MD5
0ad2049d8b4df183c06164d94d4b6508

SHA1
48961f704a95e903fa891703508da8e06e8eba8f

SHA256
89b7c67769013b26ca8c34cb2cd64c4de25a24f30073995064ea4364a7004ffc

SHA512
e32b7be09d8d654086af0f339de9aed19e6fcd672b6028944493904efb1dfd6a1dfc28baaf70c633faa9c846f2a53faaf3a35cb281892d55c5cd23262b0c5e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe

Filesize
307KB

MD5
791fcee57312d4a20cc86ae1cea8dfc4

SHA1
04a88c60ae1539a63411fe4765e9b931e8d2d992

SHA256
27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d

SHA512
2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000349001\12f292ffd1.exe

Filesize
1.8MB

MD5
048b91203c2fdaa52742e70aa99f2760

SHA1
f019f2f95da287543af40f0c41b4d004847fbfec

SHA256
cde9b0a7742f4ed0bfe52113b99df9f1f19c3220a8684d6ecf56858c603da8e6

SHA512
735cd553bac41c0dfdf173af979edfaa7599665155d59d601c133ca1c64f03678e6246a2868b5c4e0de44c998c139e3b5e5f14b5022d6e4797b72754b692327b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000354001\e32d09a575.exe

Filesize
1.7MB

MD5
c3dee17f7a6e04c6a94900e983d7b1de

SHA1
abf9960500584291502a13c673b1d61a532abea7

SHA256
cdae0c43f4c349865f4102d5245233090455ca440d90c3def212fbf67f9ed3ab

SHA512
7bb07b0cc46566ac49783ae49b9dbb876c792ffd49921a622f936471d8adda717aa54d5a5b31422eb86519e15e031c3f603cc22b9140da58a8b7885eb1618da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000355001\65a5dc1e46.exe

Filesize
1.8MB

MD5
80e870365fc11d4d9719aa90ac55e9b1

SHA1
10c4a55d2efa7fbdd66c45472db32265697fe22b

SHA256
5113adc392bf57e65e9c8acc1daca89897837d169572b9b8ec2d226b5efe8d56

SHA512
aadf3549cd8c7dbad88c18619a0a244d7d2a55ba8d6f42e10382cc2e6310fe7c2fb826666624929fad55314b5ec6edd0ce289a96e3877b038c334eb6c8d842a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe

Filesize
314KB

MD5
ff5afed0a8b802d74af1c1422c720446

SHA1
7135acfa641a873cb0c4c37afc49266bfeec91d8

SHA256
17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

SHA512
11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe

Filesize
6KB

MD5
c042782226565f89ce3954489075e516

SHA1
256dd5ba42837a33c7aa6cb71cef33d5617117ee

SHA256
a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

SHA512
9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe

Filesize
1.1MB

MD5
ed9393d5765529c845c623e35c1b1a34

SHA1
d3eca07f5ce0df847070d2d7fe5253067f624285

SHA256
53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

SHA512
565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe

Filesize
20.4MB

MD5
7172ee8de6490094d4a5112eceaaaa90

SHA1
46a82d7628f31d91fb883056dfbd4d15d26bbd77

SHA256
11cabbb368deb30bc1f45feb6509b222c2b360707ff31c8b1e056c617477f28e

SHA512
91e2da0921f8d2596ac2e99e91b108e4d7dba6a97800c775bc9d9b4411fae3b7f0d811f48b107054664aff69c7cdd2c052220960cec9c525470f7266de5780d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
1ffa4102583628826fa4536dbbf521a0

SHA1
c3cc8501e03cd7b7694c634bc78948dd493c6168

SHA256
1f6f88a416bd360be8829d32372972eff5e83d7e25fcd2e789862ca482a5fb69

SHA512
8a8b16f9b0d4073cb65fcc2c127ac1d724f5fe198ef1f80e0429b158fd7904fdaf627b4042a077bba79ab6b13c22a1e4c20712815c7850fe4b8395ee1d097c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp41D6.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xtiormgs.dz2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\I7goEtd30f.exe

Filesize
393KB

MD5
7d7366ab79d6d3d8d83d13a8b30de999

SHA1
75c6c49a6701d254c3ce184054a4a01329c1a6f3

SHA256
3d66fed04c76d055c6149b33dcfda544b509c57087c57a861e1d6256b59f8465

SHA512
64f4551b3be1c21ce7c2d49608463e5aec4166e3e6893883c33a5b7d1109ef0fc8ab6bd15c70d9d606e2706f12a937c2d90d5bc8f6c629ad6f30f212dc25f022

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url

Filesize
70B

MD5
1c5c0d2105718982915d88e1e34b7c24

SHA1
ecb11df5274a3a37c81fc19b95ec316d39bb6f03

SHA256
b5fd05a1a23d90dee32a1f61158a1e0859fde6882b289267c90845bb995b0c09

SHA512
9e1f86ca561c034078acbce22e6b3b2dc938a883f4897167c96ad7c61f28d30075d66557335825c18a00f96467fbd1dee067bb756388ba60b21443ba964ba331

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
12KB

MD5
94a4659dc13c42342cacbcfd67c162ad

SHA1
760c449f7302ed7e4900cdad6a5351ebd59df528

SHA256
7195de95311a68416f8a19943bcc92dc35fa7089bd910a018214f9588ca231d2

SHA512
b2d1e559391884548258f1c952d0fa90480c3d0bde8f3c40c42093f338659184cb8b7ff97be66f41d6eb7962a2f6f7830e18b8f5803bf45dd8a85042b3c82b91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
962b60b3c948dfa92038059144a7ad0d

SHA1
51b5acf83fae67903c292f04659b691cd29fd6cf

SHA256
ca9ea13712f5495033635bc9987a28dc1e9c172e6842eca08d1cd7f88917613c

SHA512
77d004872a590a3746964ce9e339fcfc1f5e9297028e9ca59fd12475a37eed727fec1ec3ce880004cc060a108cff5c9ae83226554e08396eb837152811383750

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
b6cb8dd6e013037888736d26f220e374

SHA1
d7b2032d08802b3c306c0c294342b9ed097113d2

SHA256
4be3383936f50e8e2a89491b2ac2aa69684e45d90f053f02ea50bad6ea8105e5

SHA512
5b26ee02b4055ec10507a9b2488693bb3b7c2e88b6162f9fe8e37276809df8ce1ce92aaeb2185bab155c1db48095b1bd10d42cfc2e6b0fb7ad7166a5588dd2ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
23d85e03848c24673bc95930c7376755

SHA1
9734b9a47e193aae8da3e43fd7b8980ac00ef2fa

SHA256
4d20be43a13edbadcd2a00689c1173884f6ae8844d7b223b75858f14c8f622eb

SHA512
7080f5255fb64c815a2d80e89c4db339685dff25e9b3f44f7c7d185c6789a2cfbf98c5c9eb55735da05f626ee9bcc97e1b2220c17ed378526dd5a7d9b3b076bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
51cd2fe189c2ca20fdd6f407d95935c9

SHA1
a3e7c8c0d00a812059e944a01e016f04ba8b18e4

SHA256
0df75d097b0512ea45ea2c9f9374fae3bd7861cab14182c3abec775962767219

SHA512
e7962a22f27476c4acb4b35e7b048ec567f5240abd69a76f233fbed7586b5b17f853c8af8d1325a5573609a1c87c176d3910f3505c407c3e1494f6b5f8d11f31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\9abaf092-80d1-4ff7-b886-bc413a55d819

Filesize
26KB

MD5
74c3ef99f63a3acaf9d707902b92ec4d

SHA1
093db36f0d49239d07e0ce77105b47f993a64667

SHA256
77c2f5f73666c969c36445dc584b8ba717969de7b77c7c173377824ceffea951

SHA512
f0ed189b28e8a496412fb761c6d07a1708085a9d8989856ec9dc880a71ee3a263341026b880e3556209c8845870b05473c08dcd03c7f8675e26fc2db75a5fd6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\ab3952f4-e90b-4fad-95b0-2bb0206e46e8

Filesize
982B

MD5
5b55a6f307befa29c82995a357592a74

SHA1
d534979edcc69403ef82fe7a653d4e9c3370d2bf

SHA256
77d74c6b7843510bf1994a5c93516e0baa9c1224d4c2cd5aaa58a112c375f187

SHA512
fa649b8189087e38c295f06c2573935bb64372f0f4e7b1ccca9d2005c144806e7b4548dda06b70d9b7fc83e449b8e11be2fd2d489d286bb0fe02ce44ae5f847d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\d6795208-3aee-4bc6-8be3-bbb3b3970639

Filesize
671B

MD5
2eb83bd8fbba4dd4a0642aab7a3d8826

SHA1
e7ebfc9e0dcc96b55333c169faf52a875c6498d3

SHA256
47a7460b22cc92c0a32b8eb17368a5129a822d666415787d72163c305a7d9f39

SHA512
f0dd54b29eca34e8efb5e644910d41c5ec5c7d8fd6cdec0b6701aa306062694f1d3892e0787a79d30b673e30f1227fe4fd5dabe9f9349e50e4ff215a134a525a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
11KB

MD5
f417c757922bcd27ba165acbeed484f3

SHA1
e1940d57e8306ac100910a901b1a9b62a178904e

SHA256
8f10d73ebda79cdf08315203cd3be3d8898775da37030ae80b7ba45fcf40419d

SHA512
9dfaf44efd7c8449572c8423f9c8d8d2617efb172aa889bb31f400276b42f8781f3dd685be067a695eae964f45f48a23343f6c94a1489223895a39f97387c17b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
16KB

MD5
0712975dd1841d840a5edeece7838987

SHA1
ccfc449938ad6b3ea8202326774bf327173e6e1e

SHA256
668437f8fc607116f2542c4583c65bcb4cdcd3aed0928c1047f6f2d1208866d5

SHA512
c31f9bd23b3df268b7845d31851323c6bb82adb5f6d4a0b34b3b06a63db5c940f538ba532de66e0f2c69e6a2072e09dc20353011f8ad3fe7d42d2b0c62a8f782

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
12KB

MD5
563979c2512eb2f7aa13db7a238ce674

SHA1
716637449258a6012ebe838c96f55ec7458e8649

SHA256
fc106be4b596fe811e6b5011ab9d8ddbaa29b2653971a0f371c17aaac9aa08c5

SHA512
dfb78e8d1c00e7360f1e82bf3bf3d0b2fb58fd934c9ca9a1a1f9d95f0e3e6bb34c6d26973fcb4d6d2bdd757c33eb4a13f1144d9c64f690908ef2725fc86c74c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
10KB

MD5
19d646e4c382edb9d05da30ccba8914e

SHA1
787bf1989633808b1a4aff1c29e9b413993d75d8

SHA256
ed2b712d18a4d4347ac8b04d40810630b9cb2a0c16dcea3e77bea33232f98c39

SHA512
d626155e8dab487e30e47461b012dc10a4db9cf2d0e48ca0cbb089ebf7d8d84d45d08b50d074c803b142ea6742024a11037442a2b763d8212e37fc013d16a95a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.8MB

MD5
4ac9ae1752de9a95e5e3a744574c31f9

SHA1
e635216f73ec96c81b40cb0c2474b0bf74098c44

SHA256
d8db6ab31d6f7e7ec4e75596ffe0838c0cb4eb47ea6d06e24593869dac000499

SHA512
968d226c09a58c7a4f207ad92613929eef685441a83fd19a37346671c47075b10a52ff028e751adf665eacef253bd071f59197b13f3a3ad9079de78e5263ae85

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
888KB

MD5
7eabd314eabcf61f6b120aae688ebb18

SHA1
11e1b1430451c0b28188fe2ea7eeb90dbcc39d38

SHA256
976bcbd005a2e5f97f5f07a9b6e43371667b9c0b693f080f7085684cf438e331

SHA512
a583d066cf6d05fae2dd43007d056f85f44938cf76fb3bc5746ea17eda6f805ed7b2dd4eb61aa6178bfc29cfa1f04836b49e54e6038f41e42e4469a45fce36a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.1MB

MD5
3b52047ab5e008b3b49eedb840ab7e3c

SHA1
f32f3632ae849e8b06e794ab7dac87c73bacc1aa

SHA256
6ed58875d4e00616196d81b360c30712ca6f5dda11937e6b2b2f479f3df9beef

SHA512
56edf884aaef2e76bcbc4aaafc95e61066ee5a47c7fadac4eb8aff933d6afb64f8ec94e01469ce845d7780328240073ddb5a8e0ce5ecd6add3f378320dcac5b1

Download Submit
C:\Users\Admin\AppData\Roaming\nH3gTSwdIy.exe

Filesize
602KB

MD5
e4fc58d334930a9d6572c344e5129f6b

SHA1
d38fbd0c4c86eee14722f40cc607e2128c01b00f

SHA256
973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a

SHA512
a69f5da8de8c9782769cca2e2fc5b28bbeba0c0d0027954dbe47b15610d82277abbe912f0e5921a18000f1a3a3c54eb5922f70c773537a22f4b35ff926d17a59

Download Submit
memory/392-361-0x000000000B480000-0x000000000B504000-memory.dmp

Filesize
528KB

Download
memory/392-352-0x0000000000900000-0x0000000000A18000-memory.dmp

Filesize
1.1MB

Download
memory/452-164-0x000000001BBC0000-0x000000001BBDE000-memory.dmp

Filesize
120KB

Download
memory/452-163-0x000000001DFC0000-0x000000001E036000-memory.dmp

Filesize
472KB

Download
memory/452-118-0x000000001BE30000-0x000000001BE6C000-memory.dmp

Filesize
240KB

Download
memory/452-117-0x000000001BBE0000-0x000000001BBF2000-memory.dmp

Filesize
72KB

Download
memory/452-116-0x000000001D3F0000-0x000000001D4FA000-memory.dmp

Filesize
1.0MB

Download
memory/452-98-0x00000000001F0000-0x0000000000258000-memory.dmp

Filesize
416KB

Download
memory/916-420-0x0000000009BB0000-0x000000000A0DC000-memory.dmp

Filesize
5.2MB

Download
memory/916-280-0x0000000005550000-0x00000000055C6000-memory.dmp

Filesize
472KB

Download
memory/916-304-0x0000000006DF0000-0x0000000007408000-memory.dmp

Filesize
6.1MB

Download
memory/916-306-0x0000000006CE0000-0x0000000006CF2000-memory.dmp

Filesize
72KB

Download
memory/916-305-0x0000000008670000-0x000000000877A000-memory.dmp

Filesize
1.0MB

Download
memory/916-311-0x0000000006D80000-0x0000000006DCC000-memory.dmp

Filesize
304KB

Download
memory/916-307-0x0000000006D40000-0x0000000006D7C000-memory.dmp

Filesize
240KB

Download
memory/916-290-0x0000000006460000-0x000000000647E000-memory.dmp

Filesize
120KB

Download
memory/916-233-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/916-421-0x00000000093C0000-0x0000000009410000-memory.dmp

Filesize
320KB

Download
memory/916-372-0x0000000006840000-0x00000000068A6000-memory.dmp

Filesize
408KB

Download
memory/916-419-0x00000000094B0000-0x0000000009672000-memory.dmp

Filesize
1.8MB

Download
memory/916-236-0x00000000050E0000-0x0000000005172000-memory.dmp

Filesize
584KB

Download
memory/916-253-0x0000000005070000-0x000000000507A000-memory.dmp

Filesize
40KB

Download
memory/984-0-0x0000000000910000-0x0000000000DC7000-memory.dmp

Filesize
4.7MB

Download
memory/984-3-0x0000000000910000-0x0000000000DC7000-memory.dmp

Filesize
4.7MB

Download
memory/984-5-0x0000000000910000-0x0000000000DC7000-memory.dmp

Filesize
4.7MB

Download
memory/984-2-0x0000000000911000-0x000000000093F000-memory.dmp

Filesize
184KB

Download
memory/984-16-0x0000000000910000-0x0000000000DC7000-memory.dmp

Filesize
4.7MB

Download
memory/984-1-0x0000000077E14000-0x0000000077E16000-memory.dmp

Filesize
8KB

Download
memory/1412-445-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/1412-453-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/1844-46-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1844-43-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1844-45-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1928-64-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1928-65-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1928-87-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1928-63-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2300-856-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-133-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-443-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-353-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-21-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-47-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-20-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-19-0x0000000000381000-0x00000000003AF000-memory.dmp

Filesize
184KB

Download
memory/2300-1210-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-18-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-876-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-66-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2300-115-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/2576-1249-0x0000000000CB0000-0x0000000001427000-memory.dmp

Filesize
7.5MB

Download
memory/2576-410-0x0000000069CC0000-0x000000006A377000-memory.dmp

Filesize
6.7MB

Download
memory/2576-807-0x0000000000CB0000-0x0000000001427000-memory.dmp

Filesize
7.5MB

Download
memory/2740-172-0x000000001F510000-0x000000001FA38000-memory.dmp

Filesize
5.2MB

Download
memory/2740-171-0x000000001EE10000-0x000000001EFD2000-memory.dmp

Filesize
1.8MB

Download
memory/2740-99-0x00000000002C0000-0x000000000035C000-memory.dmp

Filesize
624KB

Download
memory/2788-866-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2788-858-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2788-857-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2788-859-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3244-42-0x0000000000487000-0x0000000000488000-memory.dmp

Filesize
4KB

Download
memory/3680-230-0x0000000000560000-0x00000000005B4000-memory.dmp

Filesize
336KB

Download
memory/3680-231-0x0000000005310000-0x00000000058B4000-memory.dmp

Filesize
5.6MB

Download
memory/4072-228-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/4072-895-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/4072-806-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/4072-418-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/4072-407-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/4072-873-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/4352-107-0x00000000005B0000-0x0000000000811000-memory.dmp

Filesize
2.4MB

Download
memory/4352-362-0x00000000005B0000-0x0000000000811000-memory.dmp

Filesize
2.4MB

Download
memory/4352-136-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4384-451-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/4384-444-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/4400-190-0x0000000000250000-0x00000000006FC000-memory.dmp

Filesize
4.7MB

Download
memory/4400-229-0x0000000000250000-0x00000000006FC000-memory.dmp

Filesize
4.7MB

Download
memory/4796-371-0x00000000006A0000-0x0000000000D1E000-memory.dmp

Filesize
6.5MB

Download
memory/4796-341-0x00000000006A0000-0x0000000000D1E000-memory.dmp

Filesize
6.5MB

Download
memory/4796-354-0x00000000006A0000-0x0000000000D1E000-memory.dmp

Filesize
6.5MB

Download
memory/4796-134-0x00000000006A0000-0x0000000000D1E000-memory.dmp

Filesize
6.5MB

Download
memory/4816-303-0x0000000000B90000-0x0000000000B98000-memory.dmp

Filesize
32KB

Download
memory/5064-438-0x0000000000720000-0x0000000000981000-memory.dmp

Filesize
2.4MB

Download
memory/5064-437-0x0000000000720000-0x0000000000981000-memory.dmp

Filesize
2.4MB

Download
memory/5328-812-0x00000000003A0000-0x0000000000843000-memory.dmp

Filesize
4.6MB

Download
memory/5328-837-0x00000000003A0000-0x0000000000843000-memory.dmp

Filesize
4.6MB

Download
memory/5616-4369-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/5616-4373-0x0000000000380000-0x0000000000837000-memory.dmp

Filesize
4.7MB

Download
memory/5852-2908-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/5852-2914-0x0000000005300000-0x00000000053BC000-memory.dmp

Filesize
752KB

Download
memory/5872-845-0x00000000007A0000-0x0000000000E1E000-memory.dmp

Filesize
6.5MB

Download
memory/5872-846-0x00000000007A0000-0x0000000000E1E000-memory.dmp

Filesize
6.5MB

Download
memory/5944-4370-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/5944-4375-0x0000000000170000-0x000000000061C000-memory.dmp

Filesize
4.7MB

Download
memory/6036-1311-0x0000000007690000-0x00000000077BC000-memory.dmp

Filesize
1.2MB

Download
memory/6036-2896-0x0000000005C30000-0x0000000005C84000-memory.dmp

Filesize
336KB

Download
memory/6036-1198-0x0000000000660000-0x0000000001AC6000-memory.dmp

Filesize
20.4MB

Download
memory/6036-1314-0x0000000007690000-0x00000000077B5000-memory.dmp

Filesize
1.1MB

Download
memory/6036-2501-0x0000000007850000-0x00000000078F6000-memory.dmp

Filesize
664KB

Download
memory/6036-2502-0x0000000007A60000-0x0000000007AAC000-memory.dmp

Filesize
304KB

Download
memory/6064-980-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/6064-991-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/6064-1082-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/6140-2713-0x00000000067A0000-0x00000000067D2000-memory.dmp

Filesize
200KB

Download
memory/6140-2807-0x0000000007810000-0x0000000007824000-memory.dmp

Filesize
80KB

Download
memory/6140-2737-0x0000000007320000-0x00000000073C3000-memory.dmp

Filesize
652KB

Download
memory/6140-2742-0x0000000007C50000-0x00000000082CA000-memory.dmp

Filesize
6.5MB

Download
memory/6140-2745-0x00000000075D0000-0x00000000075EA000-memory.dmp

Filesize
104KB

Download
memory/6140-2760-0x0000000007640000-0x000000000764A000-memory.dmp

Filesize
40KB

Download
memory/6140-2776-0x0000000007850000-0x00000000078E6000-memory.dmp

Filesize
600KB

Download
memory/6140-2778-0x00000000077D0000-0x00000000077E1000-memory.dmp

Filesize
68KB

Download
memory/6140-2806-0x0000000007800000-0x000000000780E000-memory.dmp

Filesize
56KB

Download
memory/6140-2732-0x0000000006800000-0x000000000681E000-memory.dmp

Filesize
120KB

Download
memory/6140-2816-0x0000000007910000-0x000000000792A000-memory.dmp

Filesize
104KB

Download
memory/6140-2817-0x00000000078F0000-0x00000000078F8000-memory.dmp

Filesize
32KB

Download
memory/6140-2718-0x00000000736F0000-0x000000007373C000-memory.dmp

Filesize
304KB

Download
memory/6140-2579-0x0000000005650000-0x0000000005C78000-memory.dmp

Filesize
6.2MB

Download
memory/6140-2619-0x0000000006280000-0x000000000629E000-memory.dmp

Filesize
120KB

Download
memory/6140-2620-0x00000000062C0000-0x000000000630C000-memory.dmp

Filesize
304KB

Download
memory/6140-2603-0x0000000005DA0000-0x00000000060F4000-memory.dmp

Filesize
3.3MB

Download
memory/6140-2588-0x00000000053D0000-0x00000000053F2000-memory.dmp

Filesize
136KB

Download
memory/6140-2570-0x0000000002CE0000-0x0000000002D16000-memory.dmp

Filesize
216KB

Download
memory/6140-2589-0x0000000005570000-0x00000000055D6000-memory.dmp

Filesize
408KB

Download