amadey | a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-11-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
Size

1.8MB
MD5

b58725b0a514974aae36a20730adc4b3
SHA1

a99eb4395fc9a95cad952a7d4bd444fb3baa9103
SHA256

a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76
SHA512

21ed4926463abff571fa30161607cfc58ef2106683295830764a6008d9e6c1228271966c951c030b13db295217b7f568797ebf74fb02a4ed86d198a34d9b7a29
SSDEEP

49152:ugpWvpPq4PRzgbjv65CIjyoNaA1bKGfBMK:usWvzgbkaA1TSK

Score

10^/10

amadey cryptbot lumma stealc 7c4393 default_valenciga fed3aa credential_access discovery evasion execution persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

lumma

https://moutheventushz.shop/api

https://respectabosiz.shop/api

https://bakedstusteeb.shop/api

https://conceszustyb.shop/api

https://nightybinybz.shop/api

https://standartedby.shop/api

https://mutterissuen.shop/api

https://worddosofrm.shop/api

https://terracedjz.cyou

Extracted

Family

amadey

Version

5.03

Botnet

7c4393

http://185.215.113.217

Attributes

install_dir
f9c76c1660
install_file
corept.exe
strings_key
9808a67f01d2f0720518035acbde7521
url_paths
/CoreOPT/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Detects CryptBot payload 1 IoCs

CryptBot is a C++ stealer distributed widely in bundle with other software.

spyware stealer

resource	yara_rule
behavioral1/memory/2416-865-0x0000000069CC0000-0x000000006A71B000-memory.dmp	family_cryptbot_v3

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	explorer.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2656 created 1076	2656	Jurisdiction.pif	18
PID 2656 created 1076	2656	Jurisdiction.pif	18

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	202b57979b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0cfa972fa5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3404	powershell.exe

Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Yddftopda\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\Fbhost_alpha\\Newfts.exe"	explorer.exe

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2376	chrome.exe
2512	chrome.exe
2136	chrome.exe
1532	chrome.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0cfa972fa5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	202b57979b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	202b57979b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0cfa972fa5.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url	cmd.exe

Executes dropped EXE 24 IoCs

pid	Process
2628	axplong.exe
1128	stealc_default2.exe
2484	AllNew.exe
1360	Gxtuum.exe
2912	splwow64.exe
2656	Jurisdiction.pif
1212	9926397eaa.exe
2416	Javvvum.exe
1888	ji2xlo1f.exe
688	stail.exe
852	stail.tmp
1036	avidenta.exe
784	ha7dur10.exe
1528	ha7dur10.exe
2388	dmn6qzwr.exe
2472	202b57979b.exe
2524	0cfa972fa5.exe
1896	31544ceb11.exe
3388	service123.exe
3552	Newfts.exe
3636	service123.exe
4056	Newfts.exe
1208	tcpvcon.exe
4064	service123.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	202b57979b.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	0cfa972fa5.exe

Loads dropped DLL 44 IoCs

pid	Process
3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
2628	axplong.exe
2628	axplong.exe
2628	axplong.exe
2484	AllNew.exe
2628	axplong.exe
1436	cmd.exe
2628	axplong.exe
2628	axplong.exe
1128	stealc_default2.exe
1128	stealc_default2.exe
1360	Gxtuum.exe
1360	Gxtuum.exe
2628	axplong.exe
1360	Gxtuum.exe
688	stail.exe
852	stail.tmp
852	stail.tmp
2628	axplong.exe
784	ha7dur10.exe
1528	ha7dur10.exe
2628	axplong.exe
2628	axplong.exe
2628	axplong.exe
2628	axplong.exe
2628	axplong.exe
2628	axplong.exe
2628	axplong.exe
2416	Javvvum.exe
2416	Javvvum.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3388	service123.exe
1528	ha7dur10.exe
3552	Newfts.exe
3552	Newfts.exe
3636	service123.exe
3552	Newfts.exe
4056	Newfts.exe
4056	Newfts.exe
4056	Newfts.exe
4064	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\0cfa972fa5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002897001\\0cfa972fa5.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\31544ceb11.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002898001\\31544ceb11.exe"	axplong.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0006000000012268-1072.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2328	tasklist.exe
2672	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
2628	axplong.exe
2472	202b57979b.exe
2524	0cfa972fa5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4056 set thread context of 1208	4056	Newfts.exe	210

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	explorer.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\EauOfficial	splwow64.exe
File created	C:\Windows\Tasks\uninstallBeacon.job	tcpvcon.exe
File created	C:\Windows\Tasks\axplong.job	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
File created	C:\Windows\Tasks\Gxtuum.job	AllNew.exe
File opened for modification	C:\Windows\LuggageRepresentations	splwow64.exe
File opened for modification	C:\Windows\AdditionsSalvation	splwow64.exe
File opened for modification	C:\Windows\HomelessLaser	splwow64.exe
File opened for modification	C:\Windows\SixCream	splwow64.exe
File opened for modification	C:\Windows\ActuallyFtp	splwow64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0008000000019625-741.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3444	2416	WerFault.exe	55

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Javvvum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	202b57979b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31544ceb11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Newfts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avidenta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AllNew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Newfts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ha7dur10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cfa972fa5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcpvcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ji2xlo1f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ha7dur10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dmn6qzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jurisdiction.pif

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Javvvum.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Javvvum.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	explorer.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2452	taskkill.exe
1180	taskkill.exe
1440	taskkill.exe
908	taskkill.exe
2412	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	ji2xlo1f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ji2xlo1f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ji2xlo1f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	dmn6qzwr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	dmn6qzwr.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2140	schtasks.exe
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
2628	axplong.exe
1128	stealc_default2.exe
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
1128	stealc_default2.exe
852	stail.tmp
852	stail.tmp
2376	chrome.exe
2376	chrome.exe
2472	202b57979b.exe
2524	0cfa972fa5.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
3552	Newfts.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe
1212	9926397eaa.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4056	Newfts.exe
1208	tcpvcon.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	tasklist.exe
Token: SeDebugPrivilege	2328	tasklist.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	1440	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	1212	9926397eaa.exe
Token: SeDebugPrivilege	1208	tcpvcon.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	2140	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
2484	AllNew.exe
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
852	stail.tmp
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
2376	chrome.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2656	Jurisdiction.pif
2656	Jurisdiction.pif
2656	Jurisdiction.pif
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe
1896	31544ceb11.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2628	3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe	30
PID 3044 wrote to memory of 2628	3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe	30
PID 3044 wrote to memory of 2628	3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe	30
PID 3044 wrote to memory of 2628	3044	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe	30
PID 2628 wrote to memory of 1128	2628	axplong.exe	33
PID 2628 wrote to memory of 1128	2628	axplong.exe	33
PID 2628 wrote to memory of 1128	2628	axplong.exe	33
PID 2628 wrote to memory of 1128	2628	axplong.exe	33
PID 2628 wrote to memory of 2484	2628	axplong.exe	34
PID 2628 wrote to memory of 2484	2628	axplong.exe	34
PID 2628 wrote to memory of 2484	2628	axplong.exe	34
PID 2628 wrote to memory of 2484	2628	axplong.exe	34
PID 2484 wrote to memory of 1360	2484	AllNew.exe	35
PID 2484 wrote to memory of 1360	2484	AllNew.exe	35
PID 2484 wrote to memory of 1360	2484	AllNew.exe	35
PID 2484 wrote to memory of 1360	2484	AllNew.exe	35
PID 2628 wrote to memory of 2912	2628	axplong.exe	36
PID 2628 wrote to memory of 2912	2628	axplong.exe	36
PID 2628 wrote to memory of 2912	2628	axplong.exe	36
PID 2628 wrote to memory of 2912	2628	axplong.exe	36
PID 2912 wrote to memory of 1436	2912	splwow64.exe	37
PID 2912 wrote to memory of 1436	2912	splwow64.exe	37
PID 2912 wrote to memory of 1436	2912	splwow64.exe	37
PID 2912 wrote to memory of 1436	2912	splwow64.exe	37
PID 1436 wrote to memory of 2672	1436	cmd.exe	39
PID 1436 wrote to memory of 2672	1436	cmd.exe	39
PID 1436 wrote to memory of 2672	1436	cmd.exe	39
PID 1436 wrote to memory of 2672	1436	cmd.exe	39
PID 1436 wrote to memory of 3068	1436	cmd.exe	40
PID 1436 wrote to memory of 3068	1436	cmd.exe	40
PID 1436 wrote to memory of 3068	1436	cmd.exe	40
PID 1436 wrote to memory of 3068	1436	cmd.exe	40
PID 1436 wrote to memory of 2328	1436	cmd.exe	42
PID 1436 wrote to memory of 2328	1436	cmd.exe	42
PID 1436 wrote to memory of 2328	1436	cmd.exe	42
PID 1436 wrote to memory of 2328	1436	cmd.exe	42
PID 1436 wrote to memory of 1964	1436	cmd.exe	43
PID 1436 wrote to memory of 1964	1436	cmd.exe	43
PID 1436 wrote to memory of 1964	1436	cmd.exe	43
PID 1436 wrote to memory of 1964	1436	cmd.exe	43
PID 1436 wrote to memory of 1732	1436	cmd.exe	44
PID 1436 wrote to memory of 1732	1436	cmd.exe	44
PID 1436 wrote to memory of 1732	1436	cmd.exe	44
PID 1436 wrote to memory of 1732	1436	cmd.exe	44
PID 1436 wrote to memory of 1740	1436	cmd.exe	45
PID 1436 wrote to memory of 1740	1436	cmd.exe	45
PID 1436 wrote to memory of 1740	1436	cmd.exe	45
PID 1436 wrote to memory of 1740	1436	cmd.exe	45
PID 1436 wrote to memory of 380	1436	cmd.exe	46
PID 1436 wrote to memory of 380	1436	cmd.exe	46
PID 1436 wrote to memory of 380	1436	cmd.exe	46
PID 1436 wrote to memory of 380	1436	cmd.exe	46
PID 1436 wrote to memory of 2656	1436	cmd.exe	47
PID 1436 wrote to memory of 2656	1436	cmd.exe	47
PID 1436 wrote to memory of 2656	1436	cmd.exe	47
PID 1436 wrote to memory of 2656	1436	cmd.exe	47
PID 2628 wrote to memory of 1212	2628	axplong.exe	48
PID 2628 wrote to memory of 1212	2628	axplong.exe	48
PID 2628 wrote to memory of 1212	2628	axplong.exe	48
PID 2628 wrote to memory of 1212	2628	axplong.exe	48
PID 1436 wrote to memory of 552	1436	cmd.exe	49
PID 1436 wrote to memory of 552	1436	cmd.exe	49
PID 1436 wrote to memory of 552	1436	cmd.exe	49
PID 1436 wrote to memory of 552	1436	cmd.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1076
- C:\Users\Admin\AppData\Local\Temp\a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe
  "C:\Users\Admin\AppData\Local\Temp\a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\1000477001\AllNew.exe
      "C:\Users\Admin\AppData\Local\Temp\1000477001\AllNew.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\10000220101\Javvvum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000220101\Javvvum.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2416
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef01f9758,0x7fef01f9768,0x7fef01f9778
        8⤵
        
        PID:2164
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        8⤵
        
        PID:1728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:2
        8⤵
        
        PID:1704
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:8
        8⤵
        
        PID:1732
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:8
        8⤵
        
        PID:1068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1548 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:2
        8⤵
        
        PID:1108
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2292 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:1532
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3492 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:8
        8⤵
        
        PID:2756
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3608 --field-trial-handle=1320,i,3980041670669637306,11643295274054356878,131072 /prefetch:8
        8⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3388
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 776
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\10000231101\stail.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000231101\stail.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\is-22D14.tmp\stail.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-22D14.tmp\stail.tmp" /SL5="$60188,5276717,721408,C:\Users\Admin\AppData\Local\Temp\10000231101\stail.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:852
        
        C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause avidenta_11131
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause avidenta_11131
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Avidenta 2.7.7\avidenta.exe
        
        "C:\Users\Admin\AppData\Local\Avidenta 2.7.7\avidenta.exe" -i
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Beijing Beijing.bat & Beijing.bat
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1436
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1964
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 197036
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1732
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "CRAWFORDFILLEDVERIFYSCALE" Mtv
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Twisted + ..\Molecular + ..\Sponsorship + ..\Various + ..\Witch + ..\Spirit + ..\See + ..\Fitting T
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\197036\Jurisdiction.pif
        
        Jurisdiction.pif T
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2656
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:552
  - - C:\Users\Admin\AppData\Local\Temp\1000833001\9926397eaa.exe
      "C:\Users\Admin\AppData\Local\Temp\1000833001\9926397eaa.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1212
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3100
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1980
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1424
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:664
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2388
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3344
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3116
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3124
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2752
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:960
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2768
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2336
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1236
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2456
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1656
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1304
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1416
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1996
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1952
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1664
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2896
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:900
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2096
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1072
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2472
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3112
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3360
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3148
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:776
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:584
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1708
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2448
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3168
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3172
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2808
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3176
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3208
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3180
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3188
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3164
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3320
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3204
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2080
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3200
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:560
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:928
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2964
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3368
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2452
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3376
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3312
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1712
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3036
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3396
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3332
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3348
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3392
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3400
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3432
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3460
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3480
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3472
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3436
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3452
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1252
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1316
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3548
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1940
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3560
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3572
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3608
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3748
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3656
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1276
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3804
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3800
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3816
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3484
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3468
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1860
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1804
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1768
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2320
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3828
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2528
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3832
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2552
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:2536
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3836
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3872
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3848
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3852
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3864
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3716
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:4044
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:4052
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3600
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:604
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:3552
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Applaunch.exe"
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\1001527001\ji2xlo1f.exe
      "C:\Users\Admin\AppData\Local\Temp\1001527001\ji2xlo1f.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe
      "C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:784
    - - C:\Windows\Temp\{7C72E564-E941-44FA-9164-14D4D13025DD}\.cr\ha7dur10.exe
        
        "C:\Windows\Temp\{7C72E564-E941-44FA-9164-14D4D13025DD}\.cr\ha7dur10.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1528
      - C:\Windows\Temp\{45C269F3-26C3-4DCF-8AE3-28313DAF54BE}\.ba\Newfts.exe
        
        "C:\Windows\Temp\{45C269F3-26C3-4DCF-8AE3-28313DAF54BE}\.ba\Newfts.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3552
        
        C:\Users\Admin\AppData\Roaming\Fbhost_alpha\Newfts.exe
        
        C:\Users\Admin\AppData\Roaming\Fbhost_alpha\Newfts.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:4056
        
        C:\Users\Admin\AppData\Roaming\Fbhost_alpha\tcpvcon.exe
        
        "C:\Users\Admin\AppData\Roaming\Fbhost_alpha\tcpvcon.exe" "C:\Users\Admin\AppData\Roaming\Fbhost_alpha\tcpvcon.exe" /accepteula
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        9⤵
        Modifies visibility of file extensions in Explorer
        Sets service image path in registry
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Fbhost_alpha\Newfts.exe
        10⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\565ba04e.exe
        
        C:\Users\Admin\AppData\Local\Temp\565ba04e.exe
        10⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Polymorphres1111.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Polymorphres1111.exe
        11⤵
        
        PID:700
  - - C:\Users\Admin\AppData\Local\Temp\1002811001\dmn6qzwr.exe
      "C:\Users\Admin\AppData\Local\Temp\1002811001\dmn6qzwr.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\1002824001\202b57979b.exe
      "C:\Users\Admin\AppData\Local\Temp\1002824001\202b57979b.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\1002897001\0cfa972fa5.exe
      "C:\Users\Admin\AppData\Local\Temp\1002897001\0cfa972fa5.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\1002898001\31544ceb11.exe
      "C:\Users\Admin\AppData\Local\Temp\1002898001\31544ceb11.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1896
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1440
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:1464
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2944
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.0.1995758041\1553202589" -parentBuildID 20221007134813 -prefsHandle 1244 -prefMapHandle 1236 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1a2a5bc-e9a2-4b3c-96af-1773ca2cbb8f} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 1348 107d7458 gpu
        7⤵
        
        PID:2136
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.1.1520967545\786720870" -parentBuildID 20221007134813 -prefsHandle 1548 -prefMapHandle 1544 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80bf30d4-6b05-44ce-bcf1-c11977f19725} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 1560 de4d58 socket
        7⤵
        
        PID:2504
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.2.932352014\1945417135" -childID 1 -isForBrowser -prefsHandle 1968 -prefMapHandle 1964 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ece0b037-a9bd-4e33-8d78-a0b94506054e} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 1980 10766d58 tab
        7⤵
        
        PID:1472
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.3.1496337752\128825640" -childID 2 -isForBrowser -prefsHandle 2680 -prefMapHandle 2676 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53ae724c-36d9-49f5-8a93-e4bf52a58657} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 2692 d63958 tab
        7⤵
        
        PID:1280
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.4.750271639\218536099" -childID 3 -isForBrowser -prefsHandle 2296 -prefMapHandle 2292 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ba0e6bf-28d8-4c6b-8778-c44ad9c1c351} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 3792 1d44e658 tab
        7⤵
        
        PID:3496
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.5.1578954169\400861772" -childID 4 -isForBrowser -prefsHandle 3904 -prefMapHandle 3908 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72e4b4bb-acd6-4aed-9a79-4cea29f7fde0} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 3896 1d44dd58 tab
        7⤵
        
        PID:3508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.6.427903047\1175470143" -childID 5 -isForBrowser -prefsHandle 4072 -prefMapHandle 4076 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {309f4a7d-671e-4c34-8e8b-b28e98494861} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 4064 1d44f558 tab
        7⤵
        
        PID:3516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:1020

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2360

C:\Windows\system32\taskeng.exe
taskeng.exe {D3B291F4-7E9B-4F9B-B948-BE121C4705D8} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
PID:3616
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
21fb4196e635d7e38eb537220120bfef

SHA1
78c03dede92c318f55e1ab0ffa2f5b02a8d87c16

SHA256
c4f10ecdab268c6faf23c444fc0ff24c4975dc7b669e770dce1ec9b611486a2b

SHA512
9cc0f9c18f2422aa7e3c7beb9ae99a9803d31b550ca5b29bf3221fbc0f869185e8d150f761aff7e2911f1b02167008c53f61d7812776f259d7a339c5be42b22c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
13KB

MD5
f99b4984bd93547ff4ab09d35b9ed6d5

SHA1
73bf4d313cb094bb6ead04460da9547106794007

SHA256
402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

SHA512
cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000220101\Javvvum.exe

Filesize
7.3MB

MD5
ec3f5feab262807dbfca306e8456b1fe

SHA1
a518cb7e8f73aa6fc927868c805ddf666d0daf91

SHA256
18b9b073f44dc79731988397997f8875aaf0025f17f89300ca16205b17c0ea35

SHA512
c0cf2afdd733114b39b9753dc672e92c7ace94bd2ddba93200b6a02c7654167b35d052fa5cd8643067e01aaa7f4bb462d49d753311faf9740cd3605ef474a709

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000231101\stail.exe

Filesize
5.7MB

MD5
3e22e7d564e175e7ae7e4e2bdfe0220d

SHA1
beb731c2cbf1d3fe1a64315e5b0d0f12a3c6a6f6

SHA256
bda6238b6a1671e4f159146102431704d1da0e8340a7cbe5e313438ee2673678

SHA512
475512fd49d6b8cc05ed5efd9089352817aa733fb0955752c512f2a7fa668a489c09ce52d0c3b61d130a0c07cc9057d9f1ab3a637ca1f9ae7be210ac083cba34

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000477001\AllNew.exe

Filesize
429KB

MD5
c07e06e76de584bcddd59073a4161dbb

SHA1
08954ac6f6cf51fd5d9d034060a9ae25a8448971

SHA256
cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

SHA512
e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe

Filesize
1.2MB

MD5
5d97c2475c8a4d52e140ef4650d1028b

SHA1
da20d0a43d6f8db44ff8212875a7e0f7bb223223

SHA256
f34dd7ec6030b1879d60faa8705fa1668adc210ddd52bcb2b0c2406606c5bccf

SHA512
22c684b21d0a9eb2eaa47329832e8ee64b003cfb3a9a5d8b719445a8532b18aad913f84025a27c95296ebeb34920fa62d64f28145ccfa3aa7d82ba95381924ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000833001\9926397eaa.exe

Filesize
734KB

MD5
98e538d63ec5a23a3acc374236ae20b6

SHA1
f3fec38f80199e346cac912bf8b65249988a2a7e

SHA256
4d8fbc7578dca954407746a1d73e3232cd8db79dccd57acbeef80da369069a91

SHA512
951a750998448cd3653153bdf24705101136305ff4744ee2092952d773121817fa36347cb797586c58d0f3efc9cfa40ae6d9ce6ea5d2e8ec41acf8d9a03b0827

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe

Filesize
1.5MB

MD5
3f7e96e5c2f519346582e23375fe6f18

SHA1
a18524ae612587a4057d21d63332fef47d0ec266

SHA256
c5448b50c4b8eab8c642248ab62a2bc95cb3a9515792462190732906ebac7d73

SHA512
35329634487e5c7eade8b307b240499c3127305d911d9de30b7bbdc3a77bef6f2cdca59e5f54a363e00d13c1236b3d714ac10efbfe22bf677786d37f8ccba369

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001527001\ji2xlo1f.exe

Filesize
6.0MB

MD5
9f8ca917737b3233abb943edc065659c

SHA1
ea6df1e154c02f0089c8f3c4b3acc69c01d30774

SHA256
cd4061786081eb01aa278dfff5adca5a80d827e456719e40d06f3dc9353bed22

SHA512
2ffbab3c1b8518a4a2f75a20dd475949ad326adbe34b7f20d47840ec925b60af886839f55fd8360297bf573e2590b268091822b6c6daf1d349476cdef68c3780

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe

Filesize
8.4MB

MD5
2f8fd18eb8f7832baa360c7ea352fb4f

SHA1
e6e35646162c50941cb04767c3efb6e877800660

SHA256
6c68d28c2fd55a424a21ba96b76d383f652bbed8cb68d7fbfaafcd139a689e44

SHA512
1323985d00c239059d490357ee58d6ac70a804da77a706d793774ef1c8feeec52bc1b33ae01b9b51bb8ba787ebbed11b94e7f30c482ad9a7ee89a91bd6189434

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002811001\dmn6qzwr.exe

Filesize
298KB

MD5
b8cbf16f3fd69a9bbcd161526098ef5e

SHA1
c23a523e254abdb0d74e3648f89c5348a7821600

SHA256
cd841b99d43c7adf96e0ffd2541ec05ee03308756e19f68cfb4296e250128acf

SHA512
5de60c3c8ee5a74824a05734c1459f7ff431264e061e42e3edbe4a431ea9f109e7fe66e7d7cbcf78580df67917a89293d69653dc8748c267836b452740990a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002824001\202b57979b.exe

Filesize
2.8MB

MD5
6a3268db51b26c41418351e516bc33a6

SHA1
57a12903fff8cd7ea5aa3a2d2308c910ac455428

SHA256
eaebfc5e60378bbc47a603ca1310440c290a396cb2446de36ff6e7afb624ee0c

SHA512
43f257dbb7e444355e29a8023e8c8838c9e0ca7538a86c25ac41db1e0308bf73c3adda1b0fe5d0bcf536387b9ce5f8fed216f5f7d92c80bcc12e7bffde979b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002897001\0cfa972fa5.exe

Filesize
1.7MB

MD5
3ca8bc51a46d28cd2c36f6b94bee0d17

SHA1
1498ce6793fda819d62911f88a8ed2c786af9e34

SHA256
15dc6f72c24e3ceefc2cd21c5b16027c5d3302407cc5774fa2950aa03b3c1d8c

SHA512
107394060b82d37d448b7ab64c8ed1c912c33b3016a2ff498569cb84ac3def41a67a982e69365a24145477a6971d7a1a45b0e5eb1a86f7e6a5c3a70a13e5c3f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002898001\31544ceb11.exe

Filesize
898KB

MD5
40d330c53214f3ea83bac07783ea23bc

SHA1
86fcef370558cf19489a314be137d8bb4732dfd5

SHA256
916e71da7c81bd64fbe6500a1344ba79b9729453a868607ec0f6968a17f3ba01

SHA512
ccc5364cbf1430eb6a8836ae99f62347cf7c2a521674643b41821036c7b4b868e3a9f6d9e6fcece08c2dffa85b95fb059580c09adf804dbacf45495c56250e18

Download Submit
C:\Users\Admin\AppData\Local\Temp\177215427744

Filesize
74KB

MD5
775624641ec7f2a3f1db7c021eb405e8

SHA1
33d608655455951e4e3d5240916ca898622b81bb

SHA256
17b1e3510e9aed3cfb7e19ae57fb2a93053a8ed041a89f05bad54c4ca93e06aa

SHA512
80f61d57a5b4ce86b34ae82b6b7e2dd576aaf2411395826ff531b5c07513d7a629ab2f80ad20bbfe70b2d101f6aa0f1d795206a6ef931be3cd5324cfad3448d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\197036\T

Filesize
580KB

MD5
4b0812fabc1ba34d8d45d28180f6c75f

SHA1
b9d99c00a6f9d5f23e244cc0555f82a7d0eeb950

SHA256
73312c3ea63faf89e2067e034a9148bf73efb5140c1ba6a67aaf62170ee98103

SHA512
7f72ffd39f7b66ea701ec642a427c90f9c3ee9be69a3e431c492be76ae9a73e8b2b1fbb16553a5a6d8722baf30b2a392a47c7c998d618459bf398d47d218d158

Download Submit
C:\Users\Admin\AppData\Local\Temp\Beijing

Filesize
24KB

MD5
2a84a77ad125a30e442d57c63c18e00e

SHA1
68567ee0d279087a12374c10a8b7981f401b20b8

SHA256
0c6ead18e99077a5dde401987a0674b156c07ccf9b7796768df8e881923e1769

SHA512
9d6a720f970f8d24ed4c74bed25c5e21c90191930b0cc7e310c8dd45f6ed7a0b3d9b3abbd8f0b4979f992c90630d215b1852b3242c5d0a6e7a42ecef03c0076a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5736.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fitting

Filesize
62KB

MD5
46a51002cdbe912d860ce08c83c0376b

SHA1
6d0ae63850bd8d5c86e45cba938609a7f051f59b

SHA256
18070c4700df6609e096f2e79f353844e3e98c9aacca69919a8baeb9f9890017

SHA512
ed7c8d09e305687dc687ab23f6a83692232677c120836c8f4b876c4dfa867b47e29684e7e1c7973f6c29eeed1b8530b96f609a6111dde36d94f6657c9b5a4e44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Molecular

Filesize
69KB

MD5
8ca4bbb4e4ddf045ff547cb2d438615c

SHA1
3e2fc0fdc0359a08c7782f44a5ccebf3a52b5152

SHA256
4e4bb4aa1f996e96db8e18e4f2a6576673c00b76126f846ba821b4cd3998afed

SHA512
b45ed05fa6d846c0a38cefcd5d256fdee997b9010bc249a34d830953100ca779ab88547353cc8badaf2908f59ff3a8c780f7cac189c0f549246feb504ecb5af9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mtv

Filesize
7KB

MD5
f3d7abb7a7c91203886dd0f2df4fc0d6

SHA1
60ffbb095fceeb2ea2b9e65355e9dbf1de736d6c

SHA256
5867350b8ad8bb5d83111aed8b296b8c28328ba72b5bedb0cbeb99b3dc600cb3

SHA512
9af80787c63fa7de9a22eea3d1f13d25ff1558ed95321a8178da734dce5126f0b7322f13cddd40c1bc67b65140f684a190dd117247f06600a07db97b015aa367

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rdorufieeruh

Filesize
92KB

MD5
bae565bc385845e730347df331491051

SHA1
5da4a3def18f75d007cee6ee334f8e36b0c377bc

SHA256
c6aeae82d3a49e6ce016e1f02fa93c918d50934f93847ae371816e5fdeb79dd5

SHA512
6e9120dca1ec8acadbccff6c99bf81ccb6e91b53019be1b5bda35fa5a5be8e18fd001fcda8f01096123d3aae1e71e0262910dad846f756c513493c92387232a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\See

Filesize
58KB

MD5
84c831b7996dfc78c7e4902ad97e8179

SHA1
739c580a19561b6cde4432a002a502bea9f32754

SHA256
1ac7db51182a2fc38e7831a67d3ff4e08911e4fca81a9f2aa0b7c7e393cc2575

SHA512
ae8e53499535938352660db161c768482438f5f6f5afb632ce7ae2e28d9c547fcf4ed939dd136e17c05ed14711368bdd6f3d4ae2e3f0d78a21790b0955745991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spirit

Filesize
80KB

MD5
0814e2558c8e63169d393fac20c668f9

SHA1
52e8b77554cc098410408668e3d4f127fa02d8bd

SHA256
cfdc18b19fe2c0f099fd9f733fe4494aa25b2828d735c226d06c654694fcf96d

SHA512
80e70a6eb57df698fe85d4599645c71678a76340380d880e108b391c922adadf42721df5aa994fcfb293ab90e7b04ff3d595736354b93fcb6b5111e90b475319

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sponsorship

Filesize
71KB

MD5
6785e2e985143a33c5c3557788f12a2b

SHA1
7a86e94bc7bc10bd8dd54ade696e10a0ae5b4bf0

SHA256
66bbe1741f98dbb750aa82a19bc7b5dc1cdbecf31f0d9ddb03ff7cf489f318c7

SHA512
3edad611d150c99dbb24a169967cc31e1d3942c3f77b3af2de621a6912356400c8003b1c99a7236b6bed65bd136d683414e96c698eabd33d66d7ab231cdfee91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sweet

Filesize
865KB

MD5
6cee6bd1b0b8230a1c792a0e8f72f7eb

SHA1
66a7d26ed56924f31e681c1af47d6978d1d6e4e8

SHA256
08ac328ad30dfc0715f8692b9290d7ac55ce93755c9aca17f1b787b6e96667ab

SHA512
4d78417accf1378194e4f58d552a1ea324747bdec41b3c59a6784ee767f863853eebafe2f2bc6315549bddc4d7dc7ce42c42ff7f383b96ae400cac8cf4c64193

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5759.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twisted

Filesize
95KB

MD5
ba8c4239470d59c50a35a25b7950187f

SHA1
855a8f85182dd03f79787147b73ae5ed61fb8d7b

SHA256
a6272116dc959a3197a969923f85c000a1388b0a02df633dec59b7273bdb421b

SHA512
1e6d42c249d206815000cc85d5216d13729246e114647d8ccf174b9bd679530b6b39dfab2bfcc5d957cc0778a8cf029e544228978682fa285c5e3f9564c2eaf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Various

Filesize
92KB

MD5
2759c67bccd900a1689d627f38f0a635

SHA1
d71b170715ed2b304167545af2bd42834ccf1881

SHA256
510cfd9523a0f8462e8cbdcbbf1afccf2aa69a9153472ee48fd28ad4fe06ca05

SHA512
aa9e26ad8824ed2ca8bf45c24939e305660cbc19f821a84a7407a16f91d71b2eb9daba9059d379908f17c9e5a17c0c3e873e5cd7350ee8715e45b2b3eff2531e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Witch

Filesize
53KB

MD5
79156afddd310be36f037a8f0708a794

SHA1
09ef36ae22b5eab65d1f62166542601b8919399d

SHA256
7faaf10d09a27842330725e6510d2754487c5b69bd40e11181dd75b03df61503

SHA512
d1449126f2365f607a390e3b6fecb3be100bff9fae1a773cf5815cab29eeb72ab4e341022bde9de653fd62ede0fb0c26d9010e524d87060aa364bf92a14e9d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yssedsowh

Filesize
46KB

MD5
b13fcb3223116f6eec60be9143cae98b

SHA1
9a9eb6da6d8e008a51e6ce6212c49bfbe7cb3c88

SHA256
961fc9bf866c5b58401d3c91735f9a7b7b4fc93c94038c504c965491f622b52b

SHA512
89d72b893acd2ec537b3c3deffcc71d1ce02211f9f5b931c561625ee7162052b511e46d4b4596c0a715e1c992310f2536ebdd512db400eeab23c8960ec4d312d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Fbhost_alpha\Newfts.exe

Filesize
2.1MB

MD5
db7e67835fce6cf9889f0f68ca9c29a9

SHA1
5565afda37006a66f0e4546105be60bbe7970616

SHA256
dbd3057a58fd3407c95418bc5d9c253adc8c658ee338f22d58374ed3ea37b738

SHA512
bc2714bb408715e5e1cec1337b831e26dbda208183955a07ec8653a38c9c0f25f60f333a154b738927ce085e7bbff438963b941a6c2773b3e7325cd900e7651b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
13672ac4c075b1ee8e911e3fcca4ef6c

SHA1
c91c9bec59fe7ae5b87c4cc6ff51f658914aa231

SHA256
d19fb774ce11602c0c3ada0fc31080067858e267240d88dade555816a82ff11e

SHA512
6ade5818e4cd289ca07b53462f8aae5820bdf2f0a21ba30cce702ddcb73ee245a64a890babf6ca65acfb8bf0204ab6a7a39c1bf6432f2680ebab30c53175cef6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\cb7b4fb9-eced-4685-b93a-f096f31d5475

Filesize
13KB

MD5
8b7ca77ca683230d1d9cbfdd920bec78

SHA1
28cb3d8b570d22e472e5a4907ca9728d27077f8b

SHA256
ef4f3724b3655839c1002fedd8f6713dbf9829074750380f837e786b04ccaa36

SHA512
928cd25fe4dcb5fe5015e20033d56faaea075d69697f65e52b56daa0080012f3081e1c5fc75a873c5a5995b20fb055042383ce5d3cbfc6723f47859aed858433

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\db289647-06fc-406d-9aa8-7fe69c62541d

Filesize
745B

MD5
1ce62dad40f3a7c17dc77f0736241316

SHA1
082cf1a3b03c6c9baf394a03950a7b1808b6b168

SHA256
93e853f412c7fe0386e5aa2166ac7f44c9156221a64fd5ab85763515e6071188

SHA512
cc82643685a3a2e4be43de78ec9a37f8cf35e2ca1dd6b0db1ea89a41812ed854f9d4a46864a80719e0a31e56f461488726b9fc5edf67f3d61eeb47e2acb9b166

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
7KB

MD5
a5d6b8a75d7274cf847152eea610c728

SHA1
05c6ec5a814bc70092040ca612325147ac9701ba

SHA256
10281be413d0d24975274d8723cf9cd4afaa5ec0cf47d3e0487edb4855ca7e1f

SHA512
2e29853aa56ce302af0ad90e9961d5b44b666b9835c6030c6e91e58a7a5090d3ea0f27b86f461a8cb9fd31d9417784008c92ac57b6781314c069b5cf25d2223f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
6KB

MD5
3e7f38e245c98d9fd5212efbebe654e8

SHA1
bcd2b1b4084291cfd6b7585fea9996404049e284

SHA256
2d93d8435b1ca857743b368afdfe045fc7545991487048d7b3d4e61a8660b973

SHA512
dbdd94c39258cc2de2b82e858587ad6a3df1fa1d66117a2924df2ba98aba4c975b00076bf535b5411613f58db23e2fdc045d1130c529fd30cf7f7c55395e2cc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js

Filesize
6KB

MD5
6bb8f7c00077515cc8c1af292099ca29

SHA1
f8eccedc7939c1a3516f9fd9136db74be2ea1f34

SHA256
4dc8430cb402bce07ece0ee47305ee8d90f2ac7ae5601a06b5b90000667d65a5

SHA512
e3a0add6a974da6338ba71942f494fabb832c0fd2a869a39219c78bf47cc1f570447a79391d5a63332658af60cf0026c7d696b640e1304ca35ae73df700561d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js

Filesize
6KB

MD5
37ce1236668d918e409cf8fce435a5d5

SHA1
6b52b26de66823cd627738b516094d88ab052571

SHA256
ab60208de70cb75c2a1e85bbae77258a3a1b7c8cff27238434de77f56cb036b3

SHA512
ea055ef981378a338f0987eb0b53d10a089fb5b4eec41637506579015959e08f1a7020476ab006fa4804fbac3904c743f150829c9f0cdb0b045f7adef823c309

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
464b261798b6b55b7834416f56599e53

SHA1
ca50ede5ab26a76d474a103ba5113f1ae3d8d7f0

SHA256
9b79f0e3c2e93e61c1586f9c234faa041342e24ce29d063dc5fe734a9cc51f66

SHA512
aef8b6aea609947d91413bb688f2f2c4d8f574e96cc57b8cb1a7f533f7eb1dc5d8230a0fb5ef7af0a508e5733e0627dc502fc12067541f8feb3e7463f6bbde5f

Download Submit
C:\Windows\Temp\{7C72E564-E941-44FA-9164-14D4D13025DD}\.cr\ha7dur10.exe

Filesize
8.1MB

MD5
8543de5d216f8112e80867337dec74db

SHA1
1cb2462e70718245cd4cb023576c74e2d4a9b213

SHA256
3cc98ab01aa1fb3ab9f6147ae0d0d7f82ad965f09520511ce1456eeb9aac7d58

SHA512
af285d51cf45e1b3a8caa89e0ce73d14c2ea76eb5cf72f09aa7fab97c486e349b5ebd0936f756e4ca8817f97182819aa1ede186a73c45c96f5d9ed138fdf8e12

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Avidenta 2.7.7\avidenta.exe

Filesize
3.5MB

MD5
a522905c3c4210e35704bfc033e21161

SHA1
f76452c87ae44004607f7c33bb9389701c692944

SHA256
48e4f9fb2e28adbf455d091aaf996abe503c3d23e2cbece0649f3c4dafea6159

SHA512
077e62875e2551292ca48538bc60df2f7b034815be6f2c0793acb69b48629b7adf706ef90cba67db01d7942a7ddf364826036d5c21590dfc0d471667b37813bf

Download Submit
\Users\Admin\AppData\Local\Temp\197036\Jurisdiction.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
b58725b0a514974aae36a20730adc4b3

SHA1
a99eb4395fc9a95cad952a7d4bd444fb3baa9103

SHA256
a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76

SHA512
21ed4926463abff571fa30161607cfc58ef2106683295830764a6008d9e6c1228271966c951c030b13db295217b7f568797ebf74fb02a4ed86d198a34d9b7a29

Download Submit
\Users\Admin\AppData\Local\Temp\is-22D14.tmp\stail.tmp

Filesize
2.4MB

MD5
438f4076e92d3c839405bab4652fe2ce

SHA1
046567cf90b9e87f4b3913030e1acfc0a4341279

SHA256
ad1772bd4f07c11a626de2f257d2cc44b63ff9150be9386512840a2381e97b7e

SHA512
44985fe1773cc9d1a4ee5ed0e5bcac058c0cd064d3a1e782d9c424efeb89185528e19a177ecfafa173b76b049301d5ff95dafc0b36715a0847eec3f6b4e1506b

Download Submit
\Users\Admin\AppData\Local\Temp\is-QD439.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Windows\Temp\{45C269F3-26C3-4DCF-8AE3-28313DAF54BE}\.ba\Medial.dll

Filesize
312KB

MD5
1a4efbc6b661d10a1a4fdbe1a7fa54f0

SHA1
79f665dcb75db8d711728bab172e444cae2d8133

SHA256
b3baa312189da8828d8e3c2b8c20ad3df76da96908d961aa03fed98a61b9bc86

SHA512
7cbb77e084f0b8c1af1c7f0451fc0bddfb6b97bb0f9a563a982be8df8effb6816c0aa992448c354d3dc1b13520d440b67bb9e33bd03739e06dee7bf80d32ee39

Download Submit
memory/688-793-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/688-935-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/700-1505-0x00000000010F0000-0x0000000001106000-memory.dmp

Filesize
88KB

Download
memory/700-1506-0x0000000000990000-0x0000000000A30000-memory.dmp

Filesize
640KB

Download
memory/852-859-0x0000000005B10000-0x0000000005E9D000-memory.dmp

Filesize
3.6MB

Download
memory/852-936-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/852-1435-0x0000000005B10000-0x0000000005E9D000-memory.dmp

Filesize
3.6MB

Download
memory/1036-1281-0x0000000000400000-0x000000000078D000-memory.dmp

Filesize
3.6MB

Download
memory/1036-862-0x0000000000400000-0x000000000078D000-memory.dmp

Filesize
3.6MB

Download
memory/1036-1255-0x0000000000400000-0x000000000078D000-memory.dmp

Filesize
3.6MB

Download
memory/1036-861-0x0000000000400000-0x000000000078D000-memory.dmp

Filesize
3.6MB

Download
memory/1036-949-0x0000000000400000-0x000000000078D000-memory.dmp

Filesize
3.6MB

Download
memory/1036-1438-0x0000000000400000-0x000000000078D000-memory.dmp

Filesize
3.6MB

Download
memory/1036-1081-0x0000000000400000-0x000000000078D000-memory.dmp

Filesize
3.6MB

Download
memory/1128-46-0x00000000000B0000-0x0000000000311000-memory.dmp

Filesize
2.4MB

Download
memory/1128-726-0x00000000000B0000-0x0000000000311000-memory.dmp

Filesize
2.4MB

Download
memory/1128-74-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1212-725-0x000000001A600000-0x000000001A682000-memory.dmp

Filesize
520KB

Download
memory/1212-701-0x0000000000080000-0x000000000013E000-memory.dmp

Filesize
760KB

Download
memory/1888-777-0x00000000009E0000-0x000000000133E000-memory.dmp

Filesize
9.4MB

Download
memory/2416-1247-0x0000000000BA0000-0x00000000012F0000-memory.dmp

Filesize
7.3MB

Download
memory/2416-780-0x0000000000BA0000-0x00000000012F0000-memory.dmp

Filesize
7.3MB

Download
memory/2416-865-0x0000000069CC0000-0x000000006A71B000-memory.dmp

Filesize
10.4MB

Download
memory/2416-921-0x0000000000BA0000-0x00000000012F0000-memory.dmp

Filesize
7.3MB

Download
memory/2416-1067-0x0000000000BA0000-0x00000000012F0000-memory.dmp

Filesize
7.3MB

Download
memory/2472-1210-0x0000000001240000-0x000000000153B000-memory.dmp

Filesize
3.0MB

Download
memory/2472-1040-0x0000000001240000-0x000000000153B000-memory.dmp

Filesize
3.0MB

Download
memory/2472-1251-0x0000000001240000-0x000000000153B000-memory.dmp

Filesize
3.0MB

Download
memory/2472-1242-0x0000000001240000-0x000000000153B000-memory.dmp

Filesize
3.0MB

Download
memory/2524-1065-0x0000000000920000-0x0000000000FA6000-memory.dmp

Filesize
6.5MB

Download
memory/2524-1066-0x0000000000920000-0x0000000000FA6000-memory.dmp

Filesize
6.5MB

Download
memory/2628-1088-0x0000000006280000-0x000000000657B000-memory.dmp

Filesize
3.0MB

Download
memory/2628-1243-0x0000000006830000-0x0000000006EB6000-memory.dmp

Filesize
6.5MB

Download
memory/2628-1087-0x0000000006280000-0x000000000657B000-memory.dmp

Filesize
3.0MB

Download
memory/2628-73-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-72-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-70-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-22-0x0000000000D01000-0x0000000000D2F000-memory.dmp

Filesize
184KB

Download
memory/2628-719-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-42-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-44-0x0000000006210000-0x0000000006471000-memory.dmp

Filesize
2.4MB

Download
memory/2628-23-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-1241-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-1064-0x0000000006830000-0x0000000006EB6000-memory.dmp

Filesize
6.5MB

Download
memory/2628-25-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-763-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-1063-0x0000000006830000-0x0000000006EB6000-memory.dmp

Filesize
6.5MB

Download
memory/2628-20-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-1262-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-919-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-45-0x0000000006210000-0x0000000006471000-memory.dmp

Filesize
2.4MB

Download
memory/2628-1039-0x0000000006280000-0x000000000657B000-memory.dmp

Filesize
3.0MB

Download
memory/2628-1038-0x0000000006280000-0x000000000657B000-memory.dmp

Filesize
3.0MB

Download
memory/2628-1288-0x0000000006210000-0x0000000006471000-memory.dmp

Filesize
2.4MB

Download
memory/2628-1287-0x0000000006210000-0x0000000006471000-memory.dmp

Filesize
2.4MB

Download
memory/2628-1016-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2628-26-0x0000000000D00000-0x00000000011CC000-memory.dmp

Filesize
4.8MB

Download
memory/2656-881-0x00000000039F0000-0x0000000003A63000-memory.dmp

Filesize
460KB

Download
memory/2656-914-0x00000000039F0000-0x0000000003A63000-memory.dmp

Filesize
460KB

Download
memory/2656-897-0x00000000039F0000-0x0000000003A63000-memory.dmp

Filesize
460KB

Download
memory/2656-883-0x00000000039F0000-0x0000000003A63000-memory.dmp

Filesize
460KB

Download
memory/2656-882-0x00000000039F0000-0x0000000003A63000-memory.dmp

Filesize
460KB

Download
memory/2656-896-0x00000000039F0000-0x0000000003A63000-memory.dmp

Filesize
460KB

Download
memory/2656-893-0x00000000039F0000-0x0000000003A63000-memory.dmp

Filesize
460KB

Download
memory/3044-0-0x0000000001300000-0x00000000017CC000-memory.dmp

Filesize
4.8MB

Download
memory/3044-4-0x0000000001300000-0x00000000017CC000-memory.dmp

Filesize
4.8MB

Download
memory/3044-2-0x0000000001301000-0x000000000132F000-memory.dmp

Filesize
184KB

Download
memory/3044-3-0x0000000001300000-0x00000000017CC000-memory.dmp

Filesize
4.8MB

Download
memory/3044-1-0x0000000077660000-0x0000000077662000-memory.dmp

Filesize
8KB

Download
memory/3044-18-0x0000000001300000-0x00000000017CC000-memory.dmp

Filesize
4.8MB

Download
memory/3044-19-0x00000000072C0000-0x000000000778C000-memory.dmp

Filesize
4.8MB

Download
memory/3044-21-0x00000000072C0000-0x000000000778C000-memory.dmp

Filesize
4.8MB

Download
memory/3552-1284-0x0000000003240000-0x000000000335E000-memory.dmp

Filesize
1.1MB

Download
memory/3552-1285-0x0000000003660000-0x00000000037D2000-memory.dmp

Filesize
1.4MB

Download