amadey | 786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312

Analysis

max time kernel
110s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
Size

3.2MB
MD5

7229bce5ce94ad8c3efdac6116ca0dfd
SHA1

bab536edb7b176deedc34f51bca00786358a9238
SHA256

786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312
SHA512

147165e60b94781f32180d41107d81504cf6c8a08a7b235c0680af1708447341ab6cb42e4d8ba310b4425d30bb4961f91da1801f45285f32974ccd9f5a419f4b
SSDEEP

49152:CB2DsthgCxRK8k9rmlS2nRqGXqiR4h5inlI:FsthgCxRK8k9rmfRqGMelI

Score

10^/10

amadey gcleaner lumma stealc 9c9aa5 stok credential_access discovery evasion execution loader persistence spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://drive-connect.cyou/api

https://covery-mover.biz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dacdda974f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd69ea0e4b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b6e920c6c6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
700	powershell.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
552	chrome.exe
4276	chrome.exe
4672	chrome.exe
4892	chrome.exe
4948	chrome.exe
3952	chrome.exe
3212	chrome.exe
3436	chrome.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd69ea0e4b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b6e920c6c6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b6e920c6c6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dacdda974f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dacdda974f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd69ea0e4b.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs	7U5ylzK.exe

Executes dropped EXE 29 IoCs

pid	Process
2508	skotes.exe
1500	8b2b836034.exe
2796	8b2b836034.exe
1248	M5iFR20.exe
2996	W4KLQf7.exe
3036	dwVrTdy.exe
1564	AzVRM7c.exe
2060	t5abhIx.exe
2276	graph.exe
896	graph.exe
2040	7U5ylzK.exe
2656	dacdda974f.exe
2192	1b65869b6d.exe
1296	7z.exe
2720	7z.exe
1980	7z.exe
2028	7z.exe
2456	7z.exe
2340	7z.exe
2404	7z.exe
1776	7z.exe
796	in.exe
772	e68bee03c9.exe
2552	e68bee03c9.exe
1604	dfa4605230.exe
2040	Intel_PTT_EK_Recertification.exe
676	c6b89199d7.exe
1956	cd69ea0e4b.exe
3448	b6e920c6c6.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	dacdda974f.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	cd69ea0e4b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	b6e920c6c6.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	skotes.exe

Loads dropped DLL 50 IoCs

pid	Process
1860	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
2508	skotes.exe
2508	skotes.exe
1500	8b2b836034.exe
2508	skotes.exe
2508	skotes.exe
2508	skotes.exe
2508	skotes.exe
2508	skotes.exe
3036	dwVrTdy.exe
2508	skotes.exe
2508	skotes.exe
2508	skotes.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
2508	skotes.exe
2336	cmd.exe
1296	7z.exe
2336	cmd.exe
2720	7z.exe
2336	cmd.exe
1980	7z.exe
2336	cmd.exe
2028	7z.exe
2336	cmd.exe
2456	7z.exe
2336	cmd.exe
2340	7z.exe
2336	cmd.exe
2404	7z.exe
2336	cmd.exe
1776	7z.exe
2336	cmd.exe
2336	cmd.exe
2508	skotes.exe
2508	skotes.exe
772	e68bee03c9.exe
2508	skotes.exe
2508	skotes.exe
1964	taskeng.exe
1964	taskeng.exe
2508	skotes.exe
2656	dacdda974f.exe
2508	skotes.exe
2508	skotes.exe
2508	skotes.exe
2508	skotes.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Graph = "C:\\Program Files\\Windows Media Player\\graph\\graph.exe"	dwVrTdy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Graph = "C:\\Program Files\\Windows Media Player\\graph\\graph.exe"	AzVRM7c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\c6b89199d7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014508001\\c6b89199d7.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\cd69ea0e4b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014509001\\cd69ea0e4b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\b6e920c6c6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014510001\\b6e920c6c6.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
22	drive.google.com
23	drive.google.com
33	drive.google.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ipinfo.io
48	ipinfo.io
35	ipinfo.io
37	ipinfo.io
38	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0006000000016d11-63.dat	autoit_exe
behavioral1/files/0x000500000001961b-1740.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1860	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
2508	skotes.exe
2656	dacdda974f.exe
1956	cd69ea0e4b.exe
3448	b6e920c6c6.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 2796	1500	8b2b836034.exe	32
PID 772 set thread context of 2552	772	e68bee03c9.exe	80
PID 2040 set thread context of 1668	2040	Intel_PTT_EK_Recertification.exe	85

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/796-1589-0x000000013F0C0000-0x000000013F550000-memory.dmp	upx
behavioral1/memory/2040-1654-0x000000013F680000-0x000000013FB10000-memory.dmp	upx
behavioral1/memory/2040-1659-0x000000013F680000-0x000000013FB10000-memory.dmp	upx
behavioral1/memory/4316-2682-0x000000013F240000-0x000000013F6D0000-memory.dmp	upx
behavioral1/memory/4316-2697-0x000000013F240000-0x000000013F6D0000-memory.dmp	upx

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\graph	t5abhIx.exe
File opened for modification	C:\Program Files\Windows Media Player\graph\graph.exe	t5abhIx.exe
File created	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	AzVRM7c.exe
File created	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	AzVRM7c.exe
File opened for modification	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	AzVRM7c.exe
File created	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	dwVrTdy.exe
File created	C:\Program Files\Windows Media Player\graph\graph.exe	dwVrTdy.exe
File opened for modification	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	dwVrTdy.exe
File opened for modification	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	AzVRM7c.exe
File created	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	dwVrTdy.exe
File opened for modification	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	dwVrTdy.exe
File created	C:\Program Files\Windows Media Player\graph\graph.exe	AzVRM7c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5000	1956	WerFault.exe	109

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e68bee03c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6b89199d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd69ea0e4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e68bee03c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	W4KLQf7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b65869b6d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfa4605230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	c6b89199d7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	c6b89199d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6e920c6c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M5iFR20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dacdda974f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b2b836034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b2b836034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2016	powershell.exe
2876	PING.EXE
1980	powershell.exe
560	PING.EXE
5116	powershell.exe
4704	PING.EXE

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dfa4605230.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cd69ea0e4b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dfa4605230.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cd69ea0e4b.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3408	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2196	systeminfo.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1832	taskkill.exe
2464	taskkill.exe
2704	taskkill.exe
860	taskkill.exe
2820	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	dfa4605230.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	dwVrTdy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	dwVrTdy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e1900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	dwVrTdy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	t5abhIx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	dfa4605230.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	dwVrTdy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	dwVrTdy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	t5abhIx.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2876	PING.EXE
560	PING.EXE
4704	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1860	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
2508	skotes.exe
3036	dwVrTdy.exe
3036	dwVrTdy.exe
3036	dwVrTdy.exe
1564	AzVRM7c.exe
1564	AzVRM7c.exe
1564	AzVRM7c.exe
2060	t5abhIx.exe
2060	t5abhIx.exe
2060	t5abhIx.exe
2276	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
896	graph.exe
896	graph.exe
2276	graph.exe
896	graph.exe
2276	graph.exe
2040	7U5ylzK.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	7U5ylzK.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	2040	7U5ylzK.exe
Token: SeRestorePrivilege	1296	7z.exe
Token: 35	1296	7z.exe
Token: SeSecurityPrivilege	1296	7z.exe
Token: SeSecurityPrivilege	1296	7z.exe
Token: SeRestorePrivilege	2720	7z.exe
Token: 35	2720	7z.exe
Token: SeSecurityPrivilege	2720	7z.exe
Token: SeSecurityPrivilege	2720	7z.exe
Token: SeRestorePrivilege	1980	7z.exe
Token: 35	1980	7z.exe
Token: SeSecurityPrivilege	1980	7z.exe
Token: SeSecurityPrivilege	1980	7z.exe
Token: SeRestorePrivilege	2028	7z.exe
Token: 35	2028	7z.exe
Token: SeSecurityPrivilege	2028	7z.exe
Token: SeSecurityPrivilege	2028	7z.exe
Token: SeRestorePrivilege	2456	7z.exe
Token: 35	2456	7z.exe
Token: SeSecurityPrivilege	2456	7z.exe
Token: SeSecurityPrivilege	2456	7z.exe
Token: SeRestorePrivilege	2340	7z.exe
Token: 35	2340	7z.exe
Token: SeSecurityPrivilege	2340	7z.exe
Token: SeSecurityPrivilege	2340	7z.exe
Token: SeRestorePrivilege	2404	7z.exe
Token: 35	2404	7z.exe
Token: SeSecurityPrivilege	2404	7z.exe
Token: SeSecurityPrivilege	2404	7z.exe
Token: SeRestorePrivilege	1776	7z.exe
Token: 35	1776	7z.exe
Token: SeSecurityPrivilege	1776	7z.exe
Token: SeSecurityPrivilege	1776	7z.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeLockMemoryPrivilege	1668	explorer.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	860	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	1832	taskkill.exe
Token: SeDebugPrivilege	1940	firefox.exe
Token: SeDebugPrivilege	1940	firefox.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeDebugPrivilege	3448	b6e920c6c6.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1860	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
1248	M5iFR20.exe
1248	M5iFR20.exe
1248	M5iFR20.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
3952	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1248	M5iFR20.exe
1248	M5iFR20.exe
1248	M5iFR20.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
676	c6b89199d7.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2508	1860	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe	28
PID 1860 wrote to memory of 2508	1860	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe	28
PID 1860 wrote to memory of 2508	1860	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe	28
PID 1860 wrote to memory of 2508	1860	786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe	28
PID 2508 wrote to memory of 1500	2508	skotes.exe	30
PID 2508 wrote to memory of 1500	2508	skotes.exe	30
PID 2508 wrote to memory of 1500	2508	skotes.exe	30
PID 2508 wrote to memory of 1500	2508	skotes.exe	30
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 1500 wrote to memory of 2796	1500	8b2b836034.exe	32
PID 2508 wrote to memory of 1248	2508	skotes.exe	33
PID 2508 wrote to memory of 1248	2508	skotes.exe	33
PID 2508 wrote to memory of 1248	2508	skotes.exe	33
PID 2508 wrote to memory of 1248	2508	skotes.exe	33
PID 2508 wrote to memory of 2996	2508	skotes.exe	34
PID 2508 wrote to memory of 2996	2508	skotes.exe	34
PID 2508 wrote to memory of 2996	2508	skotes.exe	34
PID 2508 wrote to memory of 2996	2508	skotes.exe	34
PID 2508 wrote to memory of 3036	2508	skotes.exe	35
PID 2508 wrote to memory of 3036	2508	skotes.exe	35
PID 2508 wrote to memory of 3036	2508	skotes.exe	35
PID 2508 wrote to memory of 3036	2508	skotes.exe	35
PID 2508 wrote to memory of 1564	2508	skotes.exe	36
PID 2508 wrote to memory of 1564	2508	skotes.exe	36
PID 2508 wrote to memory of 1564	2508	skotes.exe	36
PID 2508 wrote to memory of 1564	2508	skotes.exe	36
PID 2508 wrote to memory of 2060	2508	skotes.exe	40
PID 2508 wrote to memory of 2060	2508	skotes.exe	40
PID 2508 wrote to memory of 2060	2508	skotes.exe	40
PID 2508 wrote to memory of 2060	2508	skotes.exe	40
PID 3036 wrote to memory of 2276	3036	dwVrTdy.exe	41
PID 3036 wrote to memory of 2276	3036	dwVrTdy.exe	41
PID 3036 wrote to memory of 2276	3036	dwVrTdy.exe	41
PID 1564 wrote to memory of 896	1564	AzVRM7c.exe	42
PID 1564 wrote to memory of 896	1564	AzVRM7c.exe	42
PID 1564 wrote to memory of 896	1564	AzVRM7c.exe	42
PID 2508 wrote to memory of 2040	2508	skotes.exe	43
PID 2508 wrote to memory of 2040	2508	skotes.exe	43
PID 2508 wrote to memory of 2040	2508	skotes.exe	43
PID 2508 wrote to memory of 2040	2508	skotes.exe	43
PID 2040 wrote to memory of 1560	2040	7U5ylzK.exe	45
PID 2040 wrote to memory of 1560	2040	7U5ylzK.exe	45
PID 2040 wrote to memory of 1560	2040	7U5ylzK.exe	45
PID 2996 wrote to memory of 700	2996	W4KLQf7.exe	47
PID 2996 wrote to memory of 700	2996	W4KLQf7.exe	47
PID 2996 wrote to memory of 700	2996	W4KLQf7.exe	47
PID 2996 wrote to memory of 700	2996	W4KLQf7.exe	47
PID 2508 wrote to memory of 2656	2508	skotes.exe	49
PID 2508 wrote to memory of 2656	2508	skotes.exe	49
PID 2508 wrote to memory of 2656	2508	skotes.exe	49
PID 2508 wrote to memory of 2656	2508	skotes.exe	49
PID 2996 wrote to memory of 2196	2996	W4KLQf7.exe	50
PID 2996 wrote to memory of 2196	2996	W4KLQf7.exe	50
PID 2996 wrote to memory of 2196	2996	W4KLQf7.exe	50
PID 2996 wrote to memory of 2196	2996	W4KLQf7.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2596	attrib.exe
2468	attrib.exe
1208	attrib.exe

C:\Users\Admin\AppData\Local\Temp\786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe
"C:\Users\Admin\AppData\Local\Temp\786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\1014060001\8b2b836034.exe
    "C:\Users\Admin\AppData\Local\Temp\1014060001\8b2b836034.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\1014060001\8b2b836034.exe
      "C:\Users\Admin\AppData\Local\Temp\1014060001\8b2b836034.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2796
- - C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe
    "C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe
    "C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:700
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:2196
- - C:\Users\Admin\AppData\Local\Temp\1014430001\dwVrTdy.exe
    "C:\Users\Admin\AppData\Local\Temp\1014430001\dwVrTdy.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Program Files\Windows Media Player\graph\graph.exe
      "C:\Program Files\Windows Media Player\graph\graph.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
        5⤵
        
        PID:4196
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4729758,0x7fef4729768,0x7fef4729778
        6⤵
        
        PID:4208
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1172,i,1546338736252372701,9905693842053596112,131072 /prefetch:2
        6⤵
        
        PID:3508
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1172,i,1546338736252372701,9905693842053596112,131072 /prefetch:8
        6⤵
        
        PID:3244
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1172,i,1546338736252372701,9905693842053596112,131072 /prefetch:8
        6⤵
        
        PID:3552
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2340 --field-trial-handle=1172,i,1546338736252372701,9905693842053596112,131072 /prefetch:1
        6⤵
        
        PID:3140
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1172,i,1546338736252372701,9905693842053596112,131072 /prefetch:1
        6⤵
        
        PID:3996
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1324 --field-trial-handle=1172,i,1546338736252372701,9905693842053596112,131072 /prefetch:2
        6⤵
        
        PID:4460
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1424 --field-trial-handle=1172,i,1546338736252372701,9905693842053596112,131072 /prefetch:1
        6⤵
        
        PID:4760
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1172,i,1546338736252372701,9905693842053596112,131072 /prefetch:8
        6⤵
        
        PID:4860
- - C:\Users\Admin\AppData\Local\Temp\1014431001\AzVRM7c.exe
    "C:\Users\Admin\AppData\Local\Temp\1014431001\AzVRM7c.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Program Files\Windows Media Player\graph\graph.exe
      "C:\Program Files\Windows Media Player\graph\graph.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
        5⤵
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3988
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef45d9758,0x7fef45d9768,0x7fef45d9778
        6⤵
        
        PID:3992
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1384,i,8706300012002333596,17593908019613127592,131072 /prefetch:2
        6⤵
        
        PID:280
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1384,i,8706300012002333596,17593908019613127592,131072 /prefetch:8
        6⤵
        
        PID:2832
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1384,i,8706300012002333596,17593908019613127592,131072 /prefetch:8
        6⤵
        
        PID:1644
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1600 --field-trial-handle=1384,i,8706300012002333596,17593908019613127592,131072 /prefetch:1
        6⤵
        
        PID:1824
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2128 --field-trial-handle=1384,i,8706300012002333596,17593908019613127592,131072 /prefetch:1
        6⤵
        
        PID:3504
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1404 --field-trial-handle=1384,i,8706300012002333596,17593908019613127592,131072 /prefetch:2
        6⤵
        
        PID:1604
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2264 --field-trial-handle=1384,i,8706300012002333596,17593908019613127592,131072 /prefetch:1
        6⤵
        
        PID:1156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
        5⤵
        
        PID:4324
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4729758,0x7fef4729768,0x7fef4729778
        6⤵
        
        PID:4976
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1312,i,9637486979418791401,9524543329329432751,131072 /prefetch:2
        6⤵
        
        PID:4156
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1312,i,9637486979418791401,9524543329329432751,131072 /prefetch:8
        6⤵
        
        PID:4896
- - C:\Users\Admin\AppData\Local\Temp\1014432001\t5abhIx.exe
    "C:\Users\Admin\AppData\Local\Temp\1014432001\t5abhIx.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\1014503001\7U5ylzK.exe
    "C:\Users\Admin\AppData\Local\Temp\1014503001\7U5ylzK.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANAA1ADAAMwAwADAAMQBcADcAVQA1AHkAbAB6AEsALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANAA1ADAAMwAwADAAMQBcADcAVQA1AHkAbAB6AEsALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFcAaQBuAGQAbwBzAEMAUABVAHMAeQBzAHQAZQBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFcAaQBuAGQAbwBzAEMAUABVAHMAeQBzAHQAZQBtAC4AZQB4AGUA
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1560
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2040 -s 984
      4⤵
      Loads dropped DLL
      PID:1956
- - C:\Users\Admin\AppData\Local\Temp\1014504001\dacdda974f.exe
    "C:\Users\Admin\AppData\Local\Temp\1014504001\dacdda974f.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\1014505001\1b65869b6d.exe
    "C:\Users\Admin\AppData\Local\Temp\1014505001\1b65869b6d.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2192
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      PID:2336
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:796
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:1208
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:2468
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2876
- - C:\Users\Admin\AppData\Local\Temp\1014506001\e68bee03c9.exe
    "C:\Users\Admin\AppData\Local\Temp\1014506001\e68bee03c9.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\1014506001\e68bee03c9.exe
      "C:\Users\Admin\AppData\Local\Temp\1014506001\e68bee03c9.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2552
- - C:\Users\Admin\AppData\Local\Temp\1014507001\dfa4605230.exe
    "C:\Users\Admin\AppData\Local\Temp\1014507001\dfa4605230.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014507001\dfa4605230.exe" & rd /s /q "C:\ProgramData\FCBAAA1VKF3E" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:4032
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3408
- - C:\Users\Admin\AppData\Local\Temp\1014508001\c6b89199d7.exe
    "C:\Users\Admin\AppData\Local\Temp\1014508001\c6b89199d7.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:2208
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1940
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1940.0.2044184982\1474888274" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {473f8939-120a-4211-a560-ed57a28a05ce} 1940 "\\.\pipe\gecko-crash-server-pipe.1940" 1304 112d7658 gpu
        6⤵
        
        PID:1668
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1940.1.1138387571\742338174" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {19f87878-bafd-4c15-8e38-d60d4f4bba35} 1940 "\\.\pipe\gecko-crash-server-pipe.1940" 1504 103e6358 socket
        6⤵
        
        PID:852
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1940.2.34149053\403869293" -childID 1 -isForBrowser -prefsHandle 2100 -prefMapHandle 2096 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96562003-4aad-4670-a22c-656a916ee3f0} 1940 "\\.\pipe\gecko-crash-server-pipe.1940" 2112 1a3cf158 tab
        6⤵
        
        PID:1088
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1940.3.2097119573\1762240018" -childID 2 -isForBrowser -prefsHandle 2812 -prefMapHandle 2808 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb3a8f75-0a83-4da7-a800-710cf7bafe31} 1940 "\\.\pipe\gecko-crash-server-pipe.1940" 2824 1b625358 tab
        6⤵
        
        PID:2924
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1940.4.1898301701\78749533" -childID 3 -isForBrowser -prefsHandle 3800 -prefMapHandle 3796 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ee9a1cb-8afa-4bf4-a6c9-3a578209e19b} 1940 "\\.\pipe\gecko-crash-server-pipe.1940" 3812 20046858 tab
        6⤵
        
        PID:3532
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1940.5.1699543891\277621550" -childID 4 -isForBrowser -prefsHandle 3940 -prefMapHandle 3944 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd23fc56-399b-4379-8ce6-b715de8257c9} 1940 "\\.\pipe\gecko-crash-server-pipe.1940" 3928 20043558 tab
        6⤵
        
        PID:3544
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1940.6.42217737\803014170" -childID 5 -isForBrowser -prefsHandle 4120 -prefMapHandle 4124 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d8abd1c-8454-4e2c-8385-0d70968e1854} 1940 "\\.\pipe\gecko-crash-server-pipe.1940" 4108 20043b58 tab
        6⤵
        
        PID:3556
- - C:\Users\Admin\AppData\Local\Temp\1014509001\cd69ea0e4b.exe
    "C:\Users\Admin\AppData\Local\Temp\1014509001\cd69ea0e4b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      PID:3952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4729758,0x7fef4729768,0x7fef4729778
        5⤵
        
        PID:1880
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1116 --field-trial-handle=1316,i,3764565572557862610,7314289806108202112,131072 /prefetch:2
        5⤵
        
        PID:4072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1316,i,3764565572557862610,7314289806108202112,131072 /prefetch:8
        5⤵
        
        PID:3984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1316,i,3764565572557862610,7314289806108202112,131072 /prefetch:8
        5⤵
        
        PID:3144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2104 --field-trial-handle=1316,i,3764565572557862610,7314289806108202112,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2232 --field-trial-handle=1316,i,3764565572557862610,7314289806108202112,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2240 --field-trial-handle=1316,i,3764565572557862610,7314289806108202112,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      4⤵
      Uses browser remote debugging
      PID:4276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef45d9758,0x7fef45d9768,0x7fef45d9778
        5⤵
        
        PID:4296
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:4412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1356,i,6356691342551687955,6395249944951786468,131072 /prefetch:2
        5⤵
        
        PID:4448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1356,i,6356691342551687955,6395249944951786468,131072 /prefetch:8
        5⤵
        
        PID:4464
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1356,i,6356691342551687955,6395249944951786468,131072 /prefetch:8
        5⤵
        
        PID:4496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2388 --field-trial-handle=1356,i,6356691342551687955,6395249944951786468,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2640 --field-trial-handle=1356,i,6356691342551687955,6395249944951786468,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2652 --field-trial-handle=1356,i,6356691342551687955,6395249944951786468,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1396
      4⤵
      Program crash
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\1014510001\b6e920c6c6.exe
    "C:\Users\Admin\AppData\Local\Temp\1014510001\b6e920c6c6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3448

C:\Windows\system32\taskeng.exe
taskeng.exe {3886F3A9-EC1E-492A-837F-0A4BB6327EC0} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:1964
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2040
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:560
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  PID:4316
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5116
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4704

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3236

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3884

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3720

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f

Filesize
153KB

MD5
f89267b24ecf471c16add613cec34473

SHA1
c3aad9d69a3848cedb8912e237b06d21e1e9974f

SHA256
21f12abb6de14e72d085bc0bd90d630956c399433e85275c4c144cd9818cbf92

SHA512
c29176c7e1d58dd4e1deafcbd72956b8c27e923fb79d511ee244c91777d3b3e41d0c3977a8a9fbe094bac371253481dde5b58abf4f2df989f303e5d262e1ce4d

Download Submit
C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip

Filesize
120KB

MD5
53e54ac43786c11e0dde9db8f4eb27ab

SHA1
9c5768d5ee037e90da77f174ef9401970060520e

SHA256
2f606d24809902af1bb9cb59c16a2c82960d95bff923ea26f6a42076772f1db8

SHA512
cd1f6d5f4d8cd19226151b6674124ab1e10950af5a049e8c082531867d71bfae9d7bc65641171fd55d203e4fba9756c80d11906d85a30b35ee4e8991adb21950

Download Submit
C:\Program Files\Windows Media Player\graph\graph.exe

Filesize
245KB

MD5
7d254439af7b1caaa765420bea7fbd3f

SHA1
7bd1d979de4a86cb0d8c2ad9e1945bd351339ad0

SHA256
d6e7ceb5b05634efbd06c3e28233e92f1bd362a36473688fbaf952504b76d394

SHA512
c3164b2f09dc914066201562be6483f61d3c368675ac5d3466c2d5b754813b8b23fd09af86b1f15ab8cc91be8a52b3488323e7a65198e5b104f9c635ec5ed5cc

Download Submit
C:\ProgramData\AECFCAAECBGDGDHIEHJE

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
84525ac2c52cedf67aa38131b3f41efb

SHA1
080afd23b33aabd0285594d580d21acde7229173

SHA256
ae524d9d757bed48d552b059f951ffd25a7d963ae44a554cb1f3a9641e524080

SHA512
d898b0913b4005bbbf22a5457ad1e86345860868bc2e53187ad8267c07824d592160a27d850978ebfe78392db784fffb80b73e27418d3a71708383d738ea1d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_19CA6F55DA8A3B0AB12F649B745C90D5

Filesize
471B

MD5
f82d5aca5ed5100b9c82259f5c97bd5f

SHA1
c5fe6c4d597a84244e0330d53887d7865bc8d430

SHA256
8484447947db2ae840af4235ae99c704d8048091b0a71f098d18d755759d7178

SHA512
5a9f1b0cba4a1c6974a1d3929c4cf4d6c2b11041bc61cdeac68f8f5915bc19bf56e589b1a8739c8ff3cd4a6e7912405b35bd7f6dbd5ce66dfd465163d638ef47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_6F7C58D8F5DC37AD0C4A3BEB81BE1660

Filesize
472B

MD5
6e21d4c7d76f1411934abcec47aa4f6f

SHA1
6b1ca4ee9524085a35c2f4f99d1603b4a31829e9

SHA256
a77a50019d85cd5c6ce6592dfa4b8dcc63399f279e15c06288d13e2dde338e13

SHA512
ad2bdb52d35f926ae93710e5a3c7775787fb1b2c1a2802f502b70954b1b41c5aafb24ef6d98bebce19bad0fe6a8f29b1f169b55fa49bc5592fa196a42d8c2868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D73CE810F817D372CC78C5824C36E338

Filesize
504B

MD5
7534282617c6278db5ebc9da5b2c673b

SHA1
4d804a0a0e7c4f0ab1791e9c68c58833d7fc7811

SHA256
2904a768575e22df734148cd01c687a5dd23a6d2b378ad3a972f6e7f38fa77cc

SHA512
c45746c38c1e8f0d694a05ef0785070b4f7e3df34a264a3693983d555232bc7b61e78e24187fce8e093448d1724f1226afc3baf262860ad75f076bf57f5929a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
6af4fd26c857f992e748bbcc37c2a7f8

SHA1
c85ad204944453f5fb81fd3dfc728fc46b6d532b

SHA256
1d2d68d351b8b6aa899a276b24c16b6cbbbaf96ff146651586d775be0fda5342

SHA512
829cc958d0418e66126af25187dea9068ef4b824ec9d232c4ee9b4e58f3659a829af55b109b15a2c0362c461ee58fc368941644a30e44ad5c1ed8fca708ee91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
06cb6323000b7f602ebe58586e7defd0

SHA1
dce871e94f8011944988931495a2dc528c21873c

SHA256
b39dc6456c2f7073a958f7a8c496ff03ce22fde6e0cdc0a23f065bfd19361531

SHA512
2b0e583e55b5b29170868477e6c499c308650bb5f201c584fbf252e5a82583341027e0add1e1bafd698f32320e00bc7415c7c7893121702c7aefe01812b886a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ee4e23c73ba2c68b5ffe4c42afc7e915

SHA1
93457e856d131d84a4537a9429ecfb9fa996a3cc

SHA256
a177d0dfa51f2625dd8ab30240f5bfa34d968957f76e247e0ab632ed30854d5c

SHA512
5e08292b5859232308062fa432cb04c26a8ed0343091fc1ccf96086a416cb2d9318613dfbcf92062e676a582e38e5a971f88616f61c5dc8b049616b53cba2d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_19CA6F55DA8A3B0AB12F649B745C90D5

Filesize
402B

MD5
c2848f1b8414925abb328c128aa60a8b

SHA1
2a0a6238f4c9c3a93c72954a273dd7c27327f098

SHA256
276c676093cd4ec5bae90bb1ce0c6f8d5e0dbf0538674c3b7bf5849999bbee33

SHA512
e4dec3d29404f8d2c36999ff13fb212e950d3e8d9dbf4413269c6f89e351cb23e47a6035a6d4477e7ad6b8d35d42c5c7ece71d32dbeb80ef514f1525433197b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ff9c5bd3f89286d6f5895e20978db1d

SHA1
a8dccd12f5439d7fe2c95f4c5de2b127817b18a7

SHA256
b5b0b12de8cabe1d7c554fc275dd33b30f909eb3a9c6f02e9974a3863a45a2bb

SHA512
73ad6ded5771bbfb83999f2b2e43f49906377aaccbf9ad0f05c1f90d7d4a8dbbbf5ab5442120be9c5efa28152604b77a99985d39d7c4c11dfcbc07813b937567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
404335daa267df50f5777b2324efb0fd

SHA1
34ebbea083bd82bb0e93f1c996777b1a2d5b2f3a

SHA256
db5d6f17c5f8945cc9350727c7f3b0e058de5023dab3a8799b74a9e8c09d8e15

SHA512
3c3eab229674b5a6da4b24a406dae86f66135580bced7e58f267e64232ca59ab36463fe651b4b0d7ba30490bc9378171bd1654f0d012ce5fc9f0b07c1474fb8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_6F7C58D8F5DC37AD0C4A3BEB81BE1660

Filesize
398B

MD5
f6fa7a2c6cc2f71271d497ae0d17d9c8

SHA1
ec040d021e410010bd8c2743af2cbc8356eb64c2

SHA256
74d65e4f9fb84fa8c0f6b1578e87ab32109daad2c7f6c12f3c0f83e7241d7ede

SHA512
6fd917f9f3b43c2a1e938eaec7a5af1486bc28adb510f3fff1f9deb39015f000d307c042d93a8561ac5f0102cae92e501ba748dbf42f12fa9ea11abb407c8685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D73CE810F817D372CC78C5824C36E338

Filesize
550B

MD5
df67b18ad2331610d02a3ddd4fea1085

SHA1
6eb96c2e69384ee6eb9cdbb901c77856941adeee

SHA256
2d170a6238a6e94e4b60357b926205fa09d5ebe4b00ddfd020899eaf9aab4920

SHA512
06f0a9fc3e52f82fc0a9c72dc7096c90ced2f00f735e5d97eaf00cc8a5bed1a099a0b4c8d68e0815ff7230c43be9f8a99f524a32e98a85b86d0baca65b592d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
45ca4b73db6c1e7df15e2216ade7b1f6

SHA1
7a807b6fe3f6f738dea6ccf8104414c2cc31fdc6

SHA256
a7835ab33e1817faec695b6fdb4fa0e6bb9938a355975db9345a8e4c3a2a261d

SHA512
1fa49e6d1a1e439e5ef2328c0909e4fe1a4928561537ab06bb42443d5101f25f815dd32883ac256f5232fdb3efe5cdaad2240a3306588e26d8c3ee023b8f4fc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0415fe00-3a02-4173-98f0-b8bee69c512d.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
a5ff7b8d3f9da95f3edc95416ad0ee3a

SHA1
a1d3fb57133e5369e14db282af76e1c6593cc9b2

SHA256
7237c8d0f62cf771e73c5e6099e0ff332f3bd57474348b304390afb190f9fcfd

SHA512
d0ac399fbcf673e3045e62b5bdeee954cf08fe562f2aba8c718980b504e00af2cb3c14ee28c719fc46058cb9ede922f373f2d53e585e29c4d7e1d2eecea2898e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e28d1a15-2704-4540-98bb-0f4cd5bcce38.tmp

Filesize
5KB

MD5
499f202355d71e6e2ec7e9e7c4ec5fb8

SHA1
bfd560ba71e2e4b7bd1070dcefc7bcab8e29a0f4

SHA256
052de02b02943693088df818878d55020ffd7c02f5c0d6402bcc648ff27dd69a

SHA512
ed091509438bb8f9e95cba564e66ae214a4ef71745c755c5a950a8b4c0a3a8cf2747deed7f9f260d1f20a3ff34581e1cce273442c2cf351dc3a92dde86c2cf50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\f95a2e92-4913-4003-b97d-ae05c49ff7a7.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT~RFf77f3e0.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a27e23a2-adaf-45d6-b8b5-35ebed9c54bd.tmp

Filesize
169KB

MD5
e8d98a227172ef14bcdc26a96f681810

SHA1
c3ada10ecf9749dcd58c8cbf57023aa833035532

SHA256
328e99660e9179c47bd537b7142b2a473aa29d73ba145353800fff053c888a35

SHA512
685b84a656eb684b2bf846bc6c5c4bccc51e38590262fbd0271beceb3b21aaba7b7d77c66c78c8a57b0f61796aba2adb32e36cb67998b4006bfedf5c9d7e9e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
dbdacf79d3ee2612e88dc27a9067eb30

SHA1
018af15b0254cd236da9466754f088238069b104

SHA256
e0aa59d10433b04005da073ca85c4bf842b2d624d64f9c46ef7abfd273d51ff8

SHA512
0daf97673c5d07014124769a28d62450a1050b88c7eb7ac9c0227839e54bf7d2d514e074348ebaa26e3bf852e3618c7b9b3c24c4e1fdc01bfd180c4e9a9f05c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014060001\8b2b836034.exe

Filesize
710KB

MD5
28e568616a7b792cac1726deb77d9039

SHA1
39890a418fb391b823ed5084533e2e24dff021e1

SHA256
9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

SHA512
85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe

Filesize
898KB

MD5
5950611ed70f90b758610609e2aee8e6

SHA1
798588341c108850c79da309be33495faf2f3246

SHA256
5270c4c6881b7d3ebaea8f51c410bba8689acb67c34f20440527a5f15f3bc1e4

SHA512
7e51c458a9a2440c778361eb19f0c13ea4de75b2cf54a5828f6230419fbf52c4702be4f0784e7984367d67fabf038018e264e030e4a4c7dac7ba93e5c1395b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe

Filesize
3.7MB

MD5
12c766cab30c7a0ef110f0199beda18b

SHA1
efdc8eb63df5aae563c7153c3bd607812debeba4

SHA256
7b2070ca45ec370acba43623fb52931ee52bee6f0ce74e6230179b058fa2c316

SHA512
32cad9086d9c7a8d88c3bfcb0806f350f0df9624637439f1e34ab2efffa0c273faef0c226c388ed28f07381aef0655af9e3eb3e9557cbfd2d8c915b556b1cf10

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014430001\dwVrTdy.exe

Filesize
591KB

MD5
3567cb15156760b2f111512ffdbc1451

SHA1
2fdb1f235fc5a9a32477dab4220ece5fda1539d4

SHA256
0285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630

SHA512
e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014503001\7U5ylzK.exe

Filesize
5.6MB

MD5
53e3f2baca38239bd6025b9e18e5f202

SHA1
c8d0d5d1fcce95e253ad60d639f418ab3d98f094

SHA256
012789b93b6d8186346fd774b7e428a8982c409b59fa845ba196ae89ac6706cb

SHA512
0b5132e9c127c428ac6109f45834f62b5f38efe6d36011e5fc2d6b5557de5e41da7a5000269d290262368cf9da1fdfe784b830a211b7b4a680bad455ddd86420

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014504001\dacdda974f.exe

Filesize
1.9MB

MD5
b8501b9ad61e6247049c8c36bf6eaf57

SHA1
dae7d1e7561fafa903152a139af6f406ce1a2d85

SHA256
12e5a10025f316a2ce8b05a5e4170d3a5f6578ab97088c77ff9a552afaf592f6

SHA512
0a622fef06dc61e4572f6059619bfdfc095e7463d1e9f0ad3e2bb37916554655e36086d492a3f7b59a42567c546b2ead2fdd90f432d7258e216331ca98fac6a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014505001\1b65869b6d.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014507001\dfa4605230.exe

Filesize
384KB

MD5
dfd5f78a711fa92337010ecc028470b4

SHA1
1a389091178f2be8ce486cd860de16263f8e902e

SHA256
da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

SHA512
a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014508001\c6b89199d7.exe

Filesize
944KB

MD5
89f43935dd16af2945da61db6c46a02d

SHA1
34d9961fd89eec180030abb87c4da5dddca4a5d6

SHA256
fc35c405e322a7f4ffb96c76b76d62dbb3297925e47a492e657f48a28312c793

SHA512
c087f473db2ab38e8dabf71eb5d859e723b1102926777144696bf45bf8eb8741fca53cb3683b845911e74c756b5a065a6320b5cd32d3199800941007fcc577c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014509001\cd69ea0e4b.exe

Filesize
1.7MB

MD5
36ce95040ed17e3c4ccf84ef67666738

SHA1
6bd06628eb201fb91f20e3905bbf1f052bab16c5

SHA256
888781cacec83eae2a8ea38778dc47d6787ef7bf54f6e05122b9c75a9349c84b

SHA512
3ed7c233e6f90ecd461073db2e80e321416cdc1da6c6c3295ff321357084f6ad1232bd537d715b8ca979177287b19a7efca9d804060682bb559055c9239e0e7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014510001\b6e920c6c6.exe

Filesize
2.6MB

MD5
39d7cc067a59d8f1770a51c3bbef5b32

SHA1
79c6ae975688b81552a74bad9d0b4c59210b5f4d

SHA256
2126a93fc9cd6b40d454914419705a7d70c19d79b1c7beb11aeaa39a1c8a566f

SHA512
5f211708fd7353499d73314056798665ebad1e8a7cf4b3818018d0fe3978062aea35d2e15f8d7782d7d97e04353f04cfefaedb12b84c3c2e691888fc0a0d63f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB00F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB022.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
3.3MB

MD5
045b0a3d5be6f10ddf19ae6d92dfdd70

SHA1
0387715b6681d7097d372cd0005b664f76c933c7

SHA256
94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

SHA512
58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DYQEMQJRZ3ICOXN7HQFD.temp

Filesize
7KB

MD5
b2393600418c93f68cfb59a2a127b086

SHA1
1a8cd7c23130f2a0a9d2fb72b5177b14d4b3cca5

SHA256
bacdb638ca959ed033760aebabc6863eed70c4afd8d473719ee8c451ee897aaf

SHA512
4795b5c13a51bad3b860f82e3931a06c875213092da56c9e8e16d6559ea08f0b2feddc954b47ae1a1c90a16bc9f3283dd47e8a2ad745fc9c4489bc86448f9481

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
d75679ec791241b9492424d510fe9354

SHA1
1726c3e6b273804344d163a29fed86665079968b

SHA256
012acc191ea087ab3e40e5d8d98e6258cd377be336c0ebd5bed8aeaad3b1f620

SHA512
115e04f0d50c56acce9b7fe872e8df4efcc365356356c3b4097775c8af4608347f553673f7cb6bcdf3f7ad0b24e1ef07bed4e5c94a7dd39520ff57ff42993857

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\3c847301-edbe-433f-8f5d-dfd002df12fc

Filesize
745B

MD5
ee617e00bd556596adfb08d1d37a54e1

SHA1
832952c2247d61ed932d077147028511ff2abb5a

SHA256
f65b8a500d5f6b7b657250beea2baebc621ea41a808750cb6549bdd980245284

SHA512
dc0eb7f05d8eb60d3d8c5b09ec8d571eb9aeefdaca3e6c981bd3c0b3ac6a485fc20487bc6e5bbab0a219b596ff29d2a2eb860c6ea510a61ea0fe62e30510229e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\45586077-d230-43f1-b7a1-55a15bd152ac

Filesize
11KB

MD5
3c5f3badb3fcdd6a6ff7c09e470fd783

SHA1
18dbc03fe6f00acf9c827151a5603d6663b9278e

SHA256
188651a843d2ce6cb806a2e826b627a59487ea2873a25ae1700469c7764eb7ad

SHA512
a35b360c4ada585d21a9761148536738fc5260485d2cda0fc61904b7bc32ddb89fefd03e0a81713d171e60156f27166d8bb45d79ba7bf4aa129f3f8c15d5931f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

Filesize
6KB

MD5
0521f781dc64de8dd089f0cd4819a3cf

SHA1
b08758a86812e5cdb0ad84eb4745441b0a90a651

SHA256
8758df805caad3d2c6b857e95da054e6312d4f5ca004db25b84a01442d76da1f

SHA512
e3be58a8a895e32b205b53064553000d6a6ddb46faa1e2a4e9c7bc598d3cf84c4ca3011c4ff3ed7f8abbe1bcf7de35b030152f2f3ab56994b71c220568cd4fd7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

Filesize
6KB

MD5
e92d4ab0f016c2687f51877f3b627aee

SHA1
40beb1d69c8b0096451335a0e51f61ba1cb860e2

SHA256
fcfeecd0226c2f5086b26f54ab4b88168265de93c6c80a66231a964f5ac48fdd

SHA512
eefa48800d4eeab538fcbaec283c5f85ffa7cd2a0f72d635b923161901ebf8583fee911ff4f322ea6059957b14405cada4e617cc8ab81bbe55e0abbae26653b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs.js

Filesize
7KB

MD5
d428e6397b9edfb64cc9a06eb48f595e

SHA1
e1fe1be4867a214690ab528839051209ead849b1

SHA256
93f85a624f923091476186694adc28e2591802d125e8a03efeb55ac68533b751

SHA512
d651ef5ab913c3c5bf795c855d6c51b31efbb7edbd9af07e551e17f3db501837640a24e72a9b075cd7159e79e07aae4643e582d4a02adbebfaadd67a18e00708

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs.js

Filesize
6KB

MD5
fdce3d0372c11d66e04e3bdec69a352f

SHA1
bd8374b120824c7bcd3b796d3fb9fa2e4eddb2f1

SHA256
8e7cc4e2ea8ebc37d12a8161cd40bbb609f6e4cea2ea5b08ae56e79157dc027d

SHA512
f995d2c5956233897de9d6a750e4556fa09abf8f43357539f82cee9cf1a6c9f407f4e23a0aa2dadce558d0b6a274cb2be0cdf0e1ff3ba8844eae5012960b86df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
50a69f56b458d4a73d19bfa7da4095df

SHA1
4a3ab361c9f64c49a8f070e084fd4cef9f3e4613

SHA256
20d33daf405ae6acd0b6db8288bcf6beb32b09d54242331d0a33a6907295ca73

SHA512
11a5df01fe2499fbe18e1ff5903e9f7b9fff2fd75db8496f30f54f0c69ea7b3076ea4ff8095bdd5fcf78b94d344ea4ebf8973fee40210f3f760310cbd741ceca

Download Submit
\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.2MB

MD5
7229bce5ce94ad8c3efdac6116ca0dfd

SHA1
bab536edb7b176deedc34f51bca00786358a9238

SHA256
786cacdf01a6f995fa366ec96f869e36aea02b478426595de4d72ce297b92312

SHA512
147165e60b94781f32180d41107d81504cf6c8a08a7b235c0680af1708447341ab6cb42e4d8ba310b4425d30bb4961f91da1801f45285f32974ccd9f5a419f4b

Download Submit
memory/796-1656-0x000000013F0C0000-0x000000013F550000-memory.dmp

Filesize
4.6MB

Download
memory/796-1589-0x000000013F0C0000-0x000000013F550000-memory.dmp

Filesize
4.6MB

Download
memory/1500-54-0x0000000000D2E000-0x0000000000D2F000-memory.dmp

Filesize
4KB

Download
memory/1560-1458-0x0000000002050000-0x0000000002058000-memory.dmp

Filesize
32KB

Download
memory/1560-1456-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/1860-3-0x00000000009E0000-0x0000000000D20000-memory.dmp

Filesize
3.2MB

Download
memory/1860-18-0x00000000009E1000-0x0000000000A49000-memory.dmp

Filesize
416KB

Download
memory/1860-0-0x00000000009E0000-0x0000000000D20000-memory.dmp

Filesize
3.2MB

Download
memory/1860-2-0x00000000009E1000-0x0000000000A49000-memory.dmp

Filesize
416KB

Download
memory/1860-15-0x00000000009E0000-0x0000000000D20000-memory.dmp

Filesize
3.2MB

Download
memory/1860-5-0x00000000009E0000-0x0000000000D20000-memory.dmp

Filesize
3.2MB

Download
memory/1860-16-0x0000000006670000-0x00000000069B0000-memory.dmp

Filesize
3.2MB

Download
memory/1860-1-0x00000000770D0000-0x00000000770D2000-memory.dmp

Filesize
8KB

Download
memory/1956-2341-0x0000000000E20000-0x00000000014B6000-memory.dmp

Filesize
6.6MB

Download
memory/1956-1927-0x0000000000E20000-0x00000000014B6000-memory.dmp

Filesize
6.6MB

Download
memory/1956-2595-0x0000000000E20000-0x00000000014B6000-memory.dmp

Filesize
6.6MB

Download
memory/1964-1734-0x000000013F680000-0x000000013FB10000-memory.dmp

Filesize
4.6MB

Download
memory/1964-1721-0x000000013F680000-0x000000013FB10000-memory.dmp

Filesize
4.6MB

Download
memory/1964-1655-0x000000013F680000-0x000000013FB10000-memory.dmp

Filesize
4.6MB

Download
memory/1964-2681-0x000000013F240000-0x000000013F6D0000-memory.dmp

Filesize
4.6MB

Download
memory/1964-1653-0x000000013F680000-0x000000013FB10000-memory.dmp

Filesize
4.6MB

Download
memory/2016-1600-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2016-1599-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/2040-284-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-312-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-280-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-300-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-298-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-296-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-294-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-310-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-286-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-302-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-292-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-288-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-278-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-290-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-1487-0x0000000002A70000-0x0000000002AC4000-memory.dmp

Filesize
336KB

Download
memory/2040-308-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-1654-0x000000013F680000-0x000000013FB10000-memory.dmp

Filesize
4.6MB

Download
memory/2040-314-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-1659-0x000000013F680000-0x000000013FB10000-memory.dmp

Filesize
4.6MB

Download
memory/2040-276-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-282-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-1449-0x000000001D580000-0x000000001DA5E000-memory.dmp

Filesize
4.9MB

Download
memory/2040-304-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-273-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-274-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2040-272-0x000000001D010000-0x000000001D57E000-memory.dmp

Filesize
5.4MB

Download
memory/2040-271-0x000000001CAA0000-0x000000001D00C000-memory.dmp

Filesize
5.4MB

Download
memory/2040-270-0x0000000000BD0000-0x0000000001170000-memory.dmp

Filesize
5.6MB

Download
memory/2040-1450-0x0000000000AF0000-0x0000000000B3C000-memory.dmp

Filesize
304KB

Download
memory/2040-306-0x000000001D010000-0x000000001D578000-memory.dmp

Filesize
5.4MB

Download
memory/2336-1644-0x000000013F0C0000-0x000000013F550000-memory.dmp

Filesize
4.6MB

Download
memory/2336-1643-0x000000013F0C0000-0x000000013F550000-memory.dmp

Filesize
4.6MB

Download
memory/2336-1577-0x000000013F0C0000-0x000000013F550000-memory.dmp

Filesize
4.6MB

Download
memory/2336-1586-0x000000013F0C0000-0x000000013F550000-memory.dmp

Filesize
4.6MB

Download
memory/2508-17-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-1524-0x0000000006780000-0x0000000006FEC000-memory.dmp

Filesize
8.4MB

Download
memory/2508-2486-0x00000000061C0000-0x000000000646C000-memory.dmp

Filesize
2.7MB

Download
memory/2508-191-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-73-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-58-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-2288-0x00000000061C0000-0x000000000646C000-memory.dmp

Filesize
2.7MB

Download
memory/2508-1484-0x0000000006780000-0x0000000006FEC000-memory.dmp

Filesize
8.4MB

Download
memory/2508-2286-0x00000000061C0000-0x000000000646C000-memory.dmp

Filesize
2.7MB

Download
memory/2508-253-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-1926-0x0000000006780000-0x0000000006E16000-memory.dmp

Filesize
6.6MB

Download
memory/2508-1928-0x0000000006780000-0x0000000006E16000-memory.dmp

Filesize
6.6MB

Download
memory/2508-56-0x00000000012D1000-0x0000000001339000-memory.dmp

Filesize
416KB

Download
memory/2508-55-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-1483-0x0000000006780000-0x0000000006FEC000-memory.dmp

Filesize
8.4MB

Download
memory/2508-2340-0x0000000006780000-0x0000000006E16000-memory.dmp

Filesize
6.6MB

Download
memory/2508-2348-0x0000000006780000-0x0000000006E16000-memory.dmp

Filesize
6.6MB

Download
memory/2508-19-0x00000000012D1000-0x0000000001339000-memory.dmp

Filesize
416KB

Download
memory/2508-20-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-22-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-249-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2508-23-0x00000000012D0000-0x0000000001610000-memory.dmp

Filesize
3.2MB

Download
memory/2656-1882-0x0000000000400000-0x0000000000C6C000-memory.dmp

Filesize
8.4MB

Download
memory/2656-1531-0x0000000000400000-0x0000000000C6C000-memory.dmp

Filesize
8.4MB

Download
memory/2656-1485-0x0000000000400000-0x0000000000C6C000-memory.dmp

Filesize
8.4MB

Download
memory/2796-42-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2796-57-0x0000000000D10000-0x0000000000DC5000-memory.dmp

Filesize
724KB

Download
memory/2796-50-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2796-53-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2796-47-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2796-45-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2796-44-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2796-43-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2796-46-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2796-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2996-196-0x0000000000400000-0x00000000007BD000-memory.dmp

Filesize
3.7MB

Download
memory/2996-251-0x0000000000230000-0x00000000002A9000-memory.dmp

Filesize
484KB

Download
memory/2996-252-0x0000000000230000-0x00000000002A9000-memory.dmp

Filesize
484KB

Download
memory/3448-2291-0x00000000003B0000-0x000000000065C000-memory.dmp

Filesize
2.7MB

Download
memory/3448-2290-0x00000000003B0000-0x000000000065C000-memory.dmp

Filesize
2.7MB

Download
memory/3448-2287-0x00000000003B0000-0x000000000065C000-memory.dmp

Filesize
2.7MB

Download
memory/3448-2487-0x00000000003B0000-0x000000000065C000-memory.dmp

Filesize
2.7MB

Download
memory/3448-2495-0x00000000003B0000-0x000000000065C000-memory.dmp

Filesize
2.7MB

Download
memory/4316-2682-0x000000013F240000-0x000000013F6D0000-memory.dmp

Filesize
4.6MB

Download
memory/4316-2697-0x000000013F240000-0x000000013F6D0000-memory.dmp

Filesize
4.6MB

Download