Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2024 09:08

General

  • Target

    file.exe

  • Size

    1.7MB

  • MD5

    e7423cd132a8b0550213c0fb9175ae31

  • SHA1

    378d1048fecb53673ea33b910ae2d8ae08e578a5

  • SHA256

    a80a31d0c26650521c50df60611832e214a9fde86a8eae0ca3d05356ae9e0e63

  • SHA512

    7f35984008878a5bbbdca9ba891304720669f631ec6f4560dbf148bcbabc61434502a0313bed93eeeaf01691335732a06b70c7b8a228d4f6946419910ee0bb73

  • SSDEEP

    49152:woefc2gUyHcqm0QD22qg/5LKI75mJKqkwKIT:w5fcFUyHm0C221mIqz

Malware Config

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Detect Poverty Stealer Payload 1 IoCs
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

  • Povertystealer family
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 25 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70c9758,0x7fef70c9768,0x7fef70c9778
        3⤵
          PID:2988
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:1932
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1928,i,11153571805517080895,10273170166040358431,131072 /prefetch:2
            3⤵
              PID:1528
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1928,i,11153571805517080895,10273170166040358431,131072 /prefetch:8
              3⤵
                PID:3068
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1468 --field-trial-handle=1928,i,11153571805517080895,10273170166040358431,131072 /prefetch:8
                3⤵
                  PID:1740
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2344 --field-trial-handle=1928,i,11153571805517080895,10273170166040358431,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:3024
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2352 --field-trial-handle=1928,i,11153571805517080895,10273170166040358431,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1764
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2156 --field-trial-handle=1928,i,11153571805517080895,10273170166040358431,131072 /prefetch:2
                  3⤵
                    PID:2676
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2540 --field-trial-handle=1928,i,11153571805517080895,10273170166040358431,131072 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:2668
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1928,i,11153571805517080895,10273170166040358431,131072 /prefetch:8
                    3⤵
                      PID:1656
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DocumentsEGIJEBGDAF.exe"
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:1856
                    • C:\Users\Admin\DocumentsEGIJEBGDAF.exe
                      "C:\Users\Admin\DocumentsEGIJEBGDAF.exe"
                      3⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Loads dropped DLL
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      PID:2996
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                        4⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Modifies system certificate store
                        • Suspicious behavior: EnumeratesProcesses
                        PID:680
                        • C:\Users\Admin\AppData\Local\Temp\1009146001\Zefoysm.exe
                          "C:\Users\Admin\AppData\Local\Temp\1009146001\Zefoysm.exe"
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2148
                        • C:\Users\Admin\AppData\Local\Temp\1009157001\1Shasou.exe
                          "C:\Users\Admin\AppData\Local\Temp\1009157001\1Shasou.exe"
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1820
                        • C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe
                          "C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe"
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:1392
                          • C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe
                            "C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:2984
                          • C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe
                            "C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe"
                            6⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies system certificate store
                            PID:1744
                        • C:\Users\Admin\AppData\Local\Temp\1009251001\35ec7c68af.exe
                          "C:\Users\Admin\AppData\Local\Temp\1009251001\35ec7c68af.exe"
                          5⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Loads dropped DLL
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2860
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                            6⤵
                            • Uses browser remote debugging
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:2808
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e99758,0x7fef6e99768,0x7fef6e99778
                              7⤵
                                PID:892
                              • C:\Windows\system32\ctfmon.exe
                                ctfmon.exe
                                7⤵
                                  PID:2020
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1364,i,17078376085993132260,1896703161514980576,131072 /prefetch:2
                                  7⤵
                                    PID:1604
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1376 --field-trial-handle=1364,i,17078376085993132260,1896703161514980576,131072 /prefetch:8
                                    7⤵
                                      PID:1828
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1364,i,17078376085993132260,1896703161514980576,131072 /prefetch:8
                                      7⤵
                                        PID:2652
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1364,i,17078376085993132260,1896703161514980576,131072 /prefetch:1
                                        7⤵
                                        • Uses browser remote debugging
                                        PID:2092
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1364,i,17078376085993132260,1896703161514980576,131072 /prefetch:1
                                        7⤵
                                        • Uses browser remote debugging
                                        PID:2416
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1572 --field-trial-handle=1364,i,17078376085993132260,1896703161514980576,131072 /prefetch:2
                                        7⤵
                                          PID:2620
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1076 --field-trial-handle=1364,i,17078376085993132260,1896703161514980576,131072 /prefetch:1
                                          7⤵
                                          • Uses browser remote debugging
                                          PID:1660
                                      • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:2628
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1280
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 968
                                        6⤵
                                        • Loads dropped DLL
                                        • Program crash
                                        PID:1332
                                    • C:\Users\Admin\AppData\Local\Temp\1009252001\1a521adeb0.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1009252001\1a521adeb0.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2308
                                    • C:\Users\Admin\AppData\Local\Temp\1009253001\fde018d92a.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1009253001\fde018d92a.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2732
                                    • C:\Users\Admin\AppData\Local\Temp\1009254001\c01ab66a6a.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1009254001\c01ab66a6a.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of SendNotifyMessage
                                      PID:2676
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM firefox.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1600
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM chrome.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2176
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM msedge.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:816
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM opera.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1048
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM brave.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2848
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                        6⤵
                                          PID:2936
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                            7⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SendNotifyMessage
                                            PID:2952
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.0.2045453552\704502739" -parentBuildID 20221007134813 -prefsHandle 1272 -prefMapHandle 1048 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b7005ad-7742-4542-b016-48309fe3799e} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 1352 106e4d58 gpu
                                              8⤵
                                                PID:1828
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.1.429051654\644939847" -parentBuildID 20221007134813 -prefsHandle 1528 -prefMapHandle 1524 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd0297c1-4c30-46bd-99cb-3d5ebc0c1ad4} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 1552 e74e58 socket
                                                8⤵
                                                  PID:1432
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.2.45764000\1539743372" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3325303a-abfb-41d2-8c1d-659d7c51faa4} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 2104 1065cb58 tab
                                                  8⤵
                                                    PID:2892
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.3.1263338966\1026634791" -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 2892 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d3bac23-25f4-4980-9d36-2f8e9b3e4372} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 2908 e64558 tab
                                                    8⤵
                                                      PID:868
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.4.2062247715\690032959" -childID 3 -isForBrowser -prefsHandle 3752 -prefMapHandle 3452 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7985d82-7d77-45d2-aa66-f25ac74c778d} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 3764 1fded058 tab
                                                      8⤵
                                                        PID:1276
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.5.1082195016\1912244300" -childID 4 -isForBrowser -prefsHandle 3872 -prefMapHandle 3876 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {416422df-5b71-456b-8484-8fc44c929d94} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 3860 1fdeca58 tab
                                                        8⤵
                                                          PID:2704
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.6.1562283527\293767545" -childID 5 -isForBrowser -prefsHandle 4036 -prefMapHandle 4040 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20ea1dae-b800-42c8-9cd1-4109d81275d1} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 4024 1fdecd58 tab
                                                          8⤵
                                                            PID:1752
                                                    • C:\Users\Admin\AppData\Local\Temp\1009255001\e6e9a52678.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1009255001\e6e9a52678.exe"
                                                      5⤵
                                                      • Modifies Windows Defender Real-time Protection settings
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Windows security modification
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2676
                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                              1⤵
                                                PID:1680
                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                1⤵
                                                  PID:2360

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  40B

                                                  MD5

                                                  4a665889f3436960b716c066cc9f7818

                                                  SHA1

                                                  3ba9ad9a24de57891e3a837bbfd74e16327f290b

                                                  SHA256

                                                  682fec0092076f4b284dca80067793252e2217bdf47b47a690bdb46d1a2f0483

                                                  SHA512

                                                  ad3a3a6df89587c6d4bf504bbb60602e20639875fa97b257b808306ba9de3903453ce62eddf94619e781f2aff0c0ce8cadf399a4de0863fe74794a2788d13f72

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  979c29c2917bed63ccf520ece1d18cda

                                                  SHA1

                                                  65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                                  SHA256

                                                  b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                                  SHA512

                                                  e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                  Filesize

                                                  264KB

                                                  MD5

                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                  SHA1

                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                  SHA256

                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                  SHA512

                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  18e723571b00fb1694a3bad6c78e4054

                                                  SHA1

                                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                  SHA256

                                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                  SHA512

                                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

                                                  Filesize

                                                  136B

                                                  MD5

                                                  1f2fc8cf5a8ebb07a35fe9cf729da4d2

                                                  SHA1

                                                  fbec4cab248e45e65318941b2a300d173378f104

                                                  SHA256

                                                  6d11fc33a5c248cf0c72c152fa4c1855cbbb8d893fe91e35a2a18185637c5e13

                                                  SHA512

                                                  ee49330b6c9056b25d45a375527ac80c815a59cad72a7fbb0db4b46e47ff02bc381d9ac5e029c5b91993f70b1360a079040d04e2f310f65e7bb5f0a073e7d111

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000007

                                                  Filesize

                                                  107B

                                                  MD5

                                                  22b937965712bdbc90f3c4e5cd2a8950

                                                  SHA1

                                                  25a5df32156e12134996410c5f7d9e59b1d6c155

                                                  SHA256

                                                  cad3bbec41899ea5205612fc1494fa7ba88847fb75437a2def22211a4003e2eb

                                                  SHA512

                                                  931427ad4609ab4ca12b2ee852d4965680f58602b00c182a2d340acf3163d888be6cfad87ca089f2b47929ddfa66be03ab13a6d24922397334d6997d4c8ede3b

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000008.ldb

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  2e42c8b4136f9f2b392ef5feea05f6d7

                                                  SHA1

                                                  8b9aa824e4505ff78732fd7e2eb9f906a1705d72

                                                  SHA256

                                                  eedc63545b0a1fbea84c2a3543892d72ca20f8c2f2602d4d6bd6c94342ad3f55

                                                  SHA512

                                                  c9ee47d5ba17077ab2b6ed1c1a9f932249612070536d6849401c6c4bed008cb99d0752dddd57ae0b3db3a95960b62f5a2c4ad320eefc9f2e07659b927f6ce503

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000009.log

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  4a7d630f64ea4ba6675450630ce6d8f5

                                                  SHA1

                                                  d1eba486454e2e66461d7a453fd6fe8f52988a26

                                                  SHA256

                                                  e1c3bdac2019dcb4e83239072ab7ecb66b3f53851532b9f703a01b853b478a69

                                                  SHA512

                                                  ce62e4341542f18051f405ba74171a852ea189e18b08b248282169ca3b902a098890347cd3af67e84e35e63e1b13c2714883986c4a1948197c106db7178eaf76

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

                                                  Filesize

                                                  250B

                                                  MD5

                                                  082356f2eb58cdf330ca17fe4389e9e7

                                                  SHA1

                                                  f97a5bbf6ce4da0026cec505b6d803b9111daec1

                                                  SHA256

                                                  b63cfc12d327b2c71dcc35f7f52e757e576d9e004447047574b66e6ef4c3face

                                                  SHA512

                                                  5f9d19b719a0cec315a83730875d2b96133f548227066a1cfe520fe0096c68597f26170d64f08377ed35306dcf17da1018a5a2d22eaaf98ea1220d8166389c86

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000007

                                                  Filesize

                                                  250B

                                                  MD5

                                                  17955c6a1bfe62d0dc5fef82ef990a13

                                                  SHA1

                                                  c4bc3f9ccf3fa9626c9279ecb1a4cbfbf4a0fcf5

                                                  SHA256

                                                  1cba135964cd409db09911c7cd4699112622596ff633cea868a83c54088c03a7

                                                  SHA512

                                                  5fb73bb4f7eb1c9e26f34e5d0f310783c7e629e717760ee38731a52a8e3fba6831d77abf0f37631fed820839a00c9242a582e59266de08d3c92c5c4f83c8e7a3

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000009.log

                                                  Filesize

                                                  57B

                                                  MD5

                                                  50e0a00e9e3eca5dd3e80d3e6e8b8eb6

                                                  SHA1

                                                  f0afa409c7ab927938c8dedf7e57c0f355103cba

                                                  SHA256

                                                  7c820f099ace6ab1f6694f5b610412ce0cd81c64a500bc8558ae5ff9042a9c8c

                                                  SHA512

                                                  7834f7052e6d21e6aba4b5445b555103bfb9f1e04457a5aa7363918e97e0d7dfd0e08a9136c377600fd3a1c8818296b76e9eb09c7217b4e8b9229bb81689a79e

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

                                                  Filesize

                                                  249B

                                                  MD5

                                                  0073a06f1b7db0639e596959dfe7728c

                                                  SHA1

                                                  6fdfe45514e208ddb970d55bb5ff063370179aa2

                                                  SHA256

                                                  d1d82cc149cd4d4e01a30d39c46e2b9ea11bfa93e0f27ca85760360f34f64b90

                                                  SHA512

                                                  ddd22b6f540037c80735810273ed369bf9cccc69f01f0a6b40cace6d7e6ce6286477d7cf16c37cee7605998d9a31a1056a41d3008f765ac4ab60cb5595624710

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\MANIFEST-000007

                                                  Filesize

                                                  98B

                                                  MD5

                                                  cce6d9e0a2fca760e3a7904fca2fa80b

                                                  SHA1

                                                  b637051510893c6688ef301bd59532f3255b3a01

                                                  SHA256

                                                  7833d6eb2a94306bd3d04cf593243cda062e5deb67528a767a43f42d8a12e159

                                                  SHA512

                                                  17740ac23a35c466429bd338214cff75d51321a95eac7785e3ff2b5597a1d6cc01a52bdfbd4143b0510affd86b4a892a6f0d337d057ee464d788abd8a4b7b2f7

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000009.log

                                                  Filesize

                                                  34B

                                                  MD5

                                                  12275f46db968e27e4edb23a4517904d

                                                  SHA1

                                                  1bd41f5f55dc8532c45c5ed91bd0823deabe3d3a

                                                  SHA256

                                                  0b9769e63620205002586d7dbefa19d6c3573ffa65bc86eb49113ec271feea4a

                                                  SHA512

                                                  084364c331be5c6b8c537a6c56b732ccdbb45f0d74a1e0ed89ac195e9ae43e15f15c953e3ed188990f0abb7e0e6456fa4b6b34562a02c180f7c061a7728c8b66

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  60e3f691077715586b918375dd23c6b0

                                                  SHA1

                                                  476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                  SHA256

                                                  e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                  SHA512

                                                  d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

                                                  Filesize

                                                  249B

                                                  MD5

                                                  453596dafd6940896adb1afbde4bfcc0

                                                  SHA1

                                                  ef3849e5df111632e59e04fb7b94ed2f22f37ba3

                                                  SHA256

                                                  56204634834bb551ff0cfdd3e0c4e07b25d0a89df04f86b245ddcbd4b081a55b

                                                  SHA512

                                                  590a9639d98bea6ccc46c48e431c21da895218c3061e7c77cf3e315fba629c6db507f5d37b05481117a7184c6afa8a490171615c793167587151a1ebe251f778

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000007

                                                  Filesize

                                                  118B

                                                  MD5

                                                  799ec7fe3eea5adb74029f4b64b291e0

                                                  SHA1

                                                  aa50caa4f5631ee0d6f6ccbb3a6ed3e36482f11b

                                                  SHA256

                                                  a8f16494d87c4a3b9292d978a0a75d60c6672e96dba1d92d659b6b8267b89f13

                                                  SHA512

                                                  0e28235a8986a3722ab5b118f9c15773819cf71441abef7c36902da65a6662e31d061bedce9d8409eb63de33647a637aa9efb5660f97cb20574a584fb23ec797

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                  Filesize

                                                  14B

                                                  MD5

                                                  9eae63c7a967fc314dd311d9f46a45b7

                                                  SHA1

                                                  caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

                                                  SHA256

                                                  4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

                                                  SHA512

                                                  bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                  Filesize

                                                  86B

                                                  MD5

                                                  961e3604f228b0d10541ebf921500c86

                                                  SHA1

                                                  6e00570d9f78d9cfebe67d4da5efe546543949a7

                                                  SHA256

                                                  f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

                                                  SHA512

                                                  535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                  Filesize

                                                  2B

                                                  MD5

                                                  99914b932bd37a50b983c5e7c90ae93b

                                                  SHA1

                                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                  SHA256

                                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                  SHA512

                                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp

                                                  Filesize

                                                  29KB

                                                  MD5

                                                  a86d1675cd07052a5f4615252df582ba

                                                  SHA1

                                                  562b498654c6c9c30dc49e284de10895e3ad7c18

                                                  SHA256

                                                  03d5265dfec0bf4283c68020c70ce9e0d226fdbcb64db29ea1d9c9a0abf2bb5d

                                                  SHA512

                                                  4a2daa2f361a6931fb01ce6f5969a0cdfdeafc01195b6b5696b2e1f11c77da0f8c5dcfa7e252732582c33548f5a1d58d0b7f58a302a1501d0dd7a178149f2fa6

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  f99b4984bd93547ff4ab09d35b9ed6d5

                                                  SHA1

                                                  73bf4d313cb094bb6ead04460da9547106794007

                                                  SHA256

                                                  402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

                                                  SHA512

                                                  cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

                                                • C:\Users\Admin\AppData\Local\Temp\1009146001\Zefoysm.exe

                                                  Filesize

                                                  211KB

                                                  MD5

                                                  ebbaf388ef32ae0785459ea0e57f0b68

                                                  SHA1

                                                  2604c1636a3479667df404117fa3b57d1ac8849f

                                                  SHA256

                                                  dca6babd2e9709e4f2f56946626b7919a84b09a8d4679f34a985eabb255aba20

                                                  SHA512

                                                  d787214d90bb99be76fe4ede63ca50487b80c0da7c190faa4120b845cea42e631e1b59989d7b4fb07f2eb83ca7187890d40a36a07cc40236e76d1d1806aba4e7

                                                • C:\Users\Admin\AppData\Local\Temp\1009157001\1Shasou.exe

                                                  Filesize

                                                  29KB

                                                  MD5

                                                  d0038532ae6cec64be83bc19d0b8f695

                                                  SHA1

                                                  17a23380f80068d15ebc014cb2b1748bb45fb5c1

                                                  SHA256

                                                  b412dd132cb21a0d4d7bb622c6fe49f9e6c5c934201815d570db774ac80194f5

                                                  SHA512

                                                  af269471f7093445fb05bc6d6d185f9e48d0666674a3de50c4217757d3fdf39b067668bf2ca37eac91d5cb203c3ce3d4d634661e470d84d12c80c332344503ea

                                                • C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe

                                                  Filesize

                                                  460KB

                                                  MD5

                                                  20160349422aeb131ed9da71a82eb7ab

                                                  SHA1

                                                  bb01e4225a1e1797c9b5858d0edf063d5f8bc44f

                                                  SHA256

                                                  d8f6ce51eba058276c4722747655b68711682afc5654414e8c195ada38fdc0ea

                                                  SHA512

                                                  907f3f61ac9ebeda534b3a330fd8673e8d09b243847b6a7a8d8d30f74ba8c699eafb8338a8d4f36824871609c1f226cb4db1e4a931fdf312f0e4331e7110c6b8

                                                • C:\Users\Admin\AppData\Local\Temp\1009251001\35ec7c68af.exe

                                                  Filesize

                                                  4.2MB

                                                  MD5

                                                  b4de34dcc96d16ec82f6fa3a7d037d4f

                                                  SHA1

                                                  a61abdbcf17bd347b2f0733d921100bf5503e844

                                                  SHA256

                                                  176260afa9071597e2a1a9947ae1394acf082932fbbb78b3c830c6d7c63bfa76

                                                  SHA512

                                                  619dd38b27a461164a5541a42d4796b5f946df776d7e8e5e0849580c7148a6bbd7afb50db9e7ee0fb0f2dce02962a260fa7545c14d70f1e005243e1fd600aa33

                                                • C:\Users\Admin\AppData\Local\Temp\1009252001\1a521adeb0.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  c0027647c26af68b744a4be6494bdebd

                                                  SHA1

                                                  b8fd87584d9eac22277e16c022e04ac12a9c7478

                                                  SHA256

                                                  b735699c90385dd43f7c72897fee81aa998d7fb7fbb070639e5fb3ab20251548

                                                  SHA512

                                                  ff05626d5679b51ecc5362e2ec4bcbc2af85a0e137728f32c0602dfa856ec154c8e40d0e15be1b8951db35496a4f790927514c17416c2733af245e5a3277da3b

                                                • C:\Users\Admin\AppData\Local\Temp\1009253001\fde018d92a.exe

                                                  Filesize

                                                  1.7MB

                                                  MD5

                                                  e7423cd132a8b0550213c0fb9175ae31

                                                  SHA1

                                                  378d1048fecb53673ea33b910ae2d8ae08e578a5

                                                  SHA256

                                                  a80a31d0c26650521c50df60611832e214a9fde86a8eae0ca3d05356ae9e0e63

                                                  SHA512

                                                  7f35984008878a5bbbdca9ba891304720669f631ec6f4560dbf148bcbabc61434502a0313bed93eeeaf01691335732a06b70c7b8a228d4f6946419910ee0bb73

                                                • C:\Users\Admin\AppData\Local\Temp\1009254001\c01ab66a6a.exe

                                                  Filesize

                                                  901KB

                                                  MD5

                                                  402239d87cbfb0a1f3cdf2d641a32b32

                                                  SHA1

                                                  4c6474475af1accace9a5b996b072fb954b08d42

                                                  SHA256

                                                  47cb2f71bff73cf7bdc551c6e2bc2275c4286d52bb9b77c967806ae34b61b77a

                                                  SHA512

                                                  ecf2beeac89f4a431e8628cd30e00e103ecfd6c75671b13092d2854facbad1c66c5e2b9313165cbeae59c0bbba00e505d891132d3b5b89294e9d966e6545692d

                                                • C:\Users\Admin\AppData\Local\Temp\1009255001\e6e9a52678.exe

                                                  Filesize

                                                  2.7MB

                                                  MD5

                                                  eaa89cb86d24875d5f654023b97a448b

                                                  SHA1

                                                  cca6df2324d6e1d5a4d5be100a97164c9bee9a67

                                                  SHA256

                                                  39194f598806ee3a073197675b49e18730978be74138703e2c91a3a332d41e0d

                                                  SHA512

                                                  6274bc80a172d856d03e403615b8c8d31cc8e74cc55991e90037785ace7db86df54d785188dc42e16f5afbbbc764a78a5b40eddb9e9683e4a59baffc2546707f

                                                • C:\Users\Admin\AppData\Local\Temp\Cab983A.tmp

                                                  Filesize

                                                  70KB

                                                  MD5

                                                  49aebf8cbd62d92ac215b2923fb1b9f5

                                                  SHA1

                                                  1723be06719828dda65ad804298d0431f6aff976

                                                  SHA256

                                                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                  SHA512

                                                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                • C:\Users\Admin\AppData\Local\Temp\Tar9917.tmp

                                                  Filesize

                                                  181KB

                                                  MD5

                                                  4ea6026cf93ec6338144661bf1202cd1

                                                  SHA1

                                                  a1dec9044f750ad887935a01430bf49322fbdcb7

                                                  SHA256

                                                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                  SHA512

                                                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  b03b8ff22eaba3946fb4875ca3f71043

                                                  SHA1

                                                  c38fbfdb6198e2995f4ea094dd8063f25235a283

                                                  SHA256

                                                  58ddb25cf0787857e44a84e115b25a7c0e12af29e2ac6d1a6874aee309eb572e

                                                  SHA512

                                                  6ba83f665ed6d25f4cebade0a45c42f8ded3a159508a7b00d2a28b973f0df2c1ae0acb517f438d38dfccd34dcf8733bcaed7cd6a254e60f7af87d9e3a8228851

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\0200eccf-5767-4df9-ad34-6d4820c11f69

                                                  Filesize

                                                  745B

                                                  MD5

                                                  47c254377cbb60f169960c50cb0af77a

                                                  SHA1

                                                  ab0759c6cc62b19ce582256cf6f9505a627444a7

                                                  SHA256

                                                  7f0286fc59dfd9c804008134418ca03580353a14eb998ce900fcb84cc60fc2b3

                                                  SHA512

                                                  58aed22c40a978eaed6f6f12a43e386a6e47bfed2e6c303e6a8dc93dde193fb1e69a1dee6402fe1585fc184dba51255c3b24ce0164a8ea6a2a6336941b12a008

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\b4168aa4-f5eb-4962-b240-47a3268958d1

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  0771c61abed5edc225e1e35c64dcb86e

                                                  SHA1

                                                  cd411630eeb9060f7cec06e9f34f974d560b8f42

                                                  SHA256

                                                  d080681f7fd0368349b7c1ea0b986b9d443917a225c58da4f55dce0bab77745c

                                                  SHA512

                                                  da4a880d0f92621e2ca4ae5a12cab75621ba59904fb57d88e5dc1dfedc1b7b02423cc4bbaf46497cc823db7aca46c0f3d6436f15abc4834274dadacba8f000de

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  d3f3d1217ed0fc846f1c9f5b5542d00c

                                                  SHA1

                                                  ed1c767d289475c0fabab9be26ca02b7dc8ab451

                                                  SHA256

                                                  3146bd9e76821f43b91154b5f50047e9b03a2f8605e04656000037493e31eabc

                                                  SHA512

                                                  f6de9a94014b8a44886249a41eeb4df13194f949f452cdbfb255505c0da88d713894e79f7ad1bc4fc44e9bd4c0bb2366fb7a2a189e3e9c5f3c2b91125daaf28f

                                                • \ProgramData\mozglue.dll

                                                  Filesize

                                                  593KB

                                                  MD5

                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                  SHA1

                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                  SHA256

                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                  SHA512

                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                • \ProgramData\nss3.dll

                                                  Filesize

                                                  2.0MB

                                                  MD5

                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                  SHA1

                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                  SHA256

                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                  SHA512

                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                • \Users\Admin\DocumentsEGIJEBGDAF.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  b136d71b7374063413830db122aede59

                                                  SHA1

                                                  443c7629c02f9b95dd36c11dabfffd4c01dc89e6

                                                  SHA256

                                                  e7dc2940de34f5fe0350f2eda5e1eaaa1cfb7675453f3b421edfef5174bbca5e

                                                  SHA512

                                                  f9ee75b93b0568948b14edc93d5c70a66dc78af3d79674057131db49d3197fa44b990c80c91eca9b52f8eba20be897a2bdd9ac79583167032a441d173f217b75

                                                • memory/680-395-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/680-314-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/680-280-0x0000000007070000-0x0000000007CCF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/680-263-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/680-144-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/680-420-0x0000000007070000-0x00000000076F6000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/680-305-0x0000000007070000-0x0000000007516000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/680-308-0x0000000007070000-0x0000000007CCF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/680-309-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/680-321-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/680-398-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/680-312-0x0000000007070000-0x0000000007516000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/680-192-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/680-281-0x0000000007070000-0x0000000007CCF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/680-601-0x0000000006910000-0x0000000006BCC000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/680-532-0x0000000007070000-0x00000000076F6000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/680-317-0x00000000001D0000-0x000000000067E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/1744-219-0x0000000000400000-0x000000000045B000-memory.dmp

                                                  Filesize

                                                  364KB

                                                • memory/1744-221-0x0000000000400000-0x000000000045B000-memory.dmp

                                                  Filesize

                                                  364KB

                                                • memory/1744-223-0x0000000000400000-0x000000000045B000-memory.dmp

                                                  Filesize

                                                  364KB

                                                • memory/1744-217-0x0000000000400000-0x000000000045B000-memory.dmp

                                                  Filesize

                                                  364KB

                                                • memory/1744-225-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/1744-226-0x0000000000400000-0x000000000045B000-memory.dmp

                                                  Filesize

                                                  364KB

                                                • memory/1744-215-0x0000000000400000-0x000000000045B000-memory.dmp

                                                  Filesize

                                                  364KB

                                                • memory/1744-228-0x0000000000400000-0x000000000045B000-memory.dmp

                                                  Filesize

                                                  364KB

                                                • memory/1744-214-0x0000000000400000-0x000000000045B000-memory.dmp

                                                  Filesize

                                                  364KB

                                                • memory/2148-174-0x00000000004B0000-0x00000000004B6000-memory.dmp

                                                  Filesize

                                                  24KB

                                                • memory/2148-173-0x0000000000AF0000-0x0000000000B2A000-memory.dmp

                                                  Filesize

                                                  232KB

                                                • memory/2308-319-0x0000000001340000-0x00000000017E6000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2308-320-0x0000000001340000-0x00000000017E6000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2308-313-0x0000000001340000-0x00000000017E6000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2308-316-0x0000000001340000-0x00000000017E6000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2308-306-0x0000000001340000-0x00000000017E6000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2360-87-0x0000000001290000-0x0000000001916000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2360-55-0x0000000001290000-0x0000000001916000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2360-64-0x0000000001290000-0x0000000001916000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2360-5-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                  Filesize

                                                  972KB

                                                • memory/2360-4-0x0000000001290000-0x0000000001916000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2360-3-0x0000000001290000-0x0000000001916000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2360-119-0x0000000001290000-0x0000000001916000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2360-1-0x0000000077AF0000-0x0000000077AF2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2360-128-0x0000000001290000-0x0000000001916000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2360-0-0x0000000001290000-0x0000000001916000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2360-2-0x0000000001291000-0x00000000012A8000-memory.dmp

                                                  Filesize

                                                  92KB

                                                • memory/2676-602-0x0000000000E90000-0x000000000114C000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2676-604-0x0000000000E90000-0x000000000114C000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2676-626-0x0000000000E90000-0x000000000114C000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2676-628-0x0000000000E90000-0x000000000114C000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2676-603-0x0000000000E90000-0x000000000114C000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2732-421-0x0000000000A00000-0x0000000001086000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2732-423-0x0000000000A00000-0x0000000001086000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/2860-396-0x0000000000B80000-0x00000000017DF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/2860-408-0x0000000000B80000-0x00000000017DF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/2860-392-0x0000000000B80000-0x00000000017DF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/2860-318-0x0000000000B80000-0x00000000017DF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/2860-315-0x0000000000B80000-0x00000000017DF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/2860-311-0x0000000000B80000-0x00000000017DF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/2860-310-0x0000000000B80000-0x00000000017DF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/2860-283-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                                  Filesize

                                                  10.4MB

                                                • memory/2860-282-0x0000000000B80000-0x00000000017DF000-memory.dmp

                                                  Filesize

                                                  12.4MB

                                                • memory/2996-126-0x00000000013C0000-0x000000000186E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/2996-143-0x00000000013C0000-0x000000000186E000-memory.dmp

                                                  Filesize

                                                  4.7MB

                                                • memory/2996-141-0x0000000006BA0000-0x000000000704E000-memory.dmp

                                                  Filesize

                                                  4.7MB