Overview

overview

10

Static

static

3

b4ab50c0c3...ce.exe

windows7-x64

10

b4ab50c0c3...ce.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-12-2024 12:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4ab50c0c3a89046764d4b805c9c4cf5cbe6ae07aa2eddb5e445c11479a912ce.exe

  • Size

    3.1MB

  • MD5

    197f7a10814e446ee3d649f2509b1608

  • SHA1

    a459ec5320318e01318105d8e87e707ea480a4c7

  • SHA256

    b4ab50c0c3a89046764d4b805c9c4cf5cbe6ae07aa2eddb5e445c11479a912ce

  • SHA512

    b595f5b8de7ecf96cb18f9f1de10bbb4988bb9b6412e1837b49469b78f7f15bbae661b8092b1d46fa6d2bdfeaa5f0e8e0f493c70dbe7d94c66cba325d83e6c85

  • SSDEEP

    49152:yZ1m9In5PVRjbnKSoNK1yoJFk/yUXeo7HH4MBQC+kQFw:yZ0In9V1nKR4yiFkqUX0C+9w

Score
10/10
amadeylummastealc9c9aa5stokcredential_accessdiscoveryevasionpersistenceransomwarespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

Extracted

Family

lumma

C2

https://drive-connect.cyou/api

https://tacitglibbr.biz/api

https://immureprech.biz/api

https://deafeninggeh.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Renames multiple (8137) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 56 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4ab50c0c3a89046764d4b805c9c4cf5cbe6ae07aa2eddb5e445c11479a912ce.exe
    "C:\Users\Admin\AppData\Local\Temp\b4ab50c0c3a89046764d4b805c9c4cf5cbe6ae07aa2eddb5e445c11479a912ce.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderClient.exe
        "C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderClient.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderClient.exe
          "C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderClient.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1928
      • C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe
        "C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2172
      • C:\Users\Admin\AppData\Local\Temp\1014844001\bluemail.exe
        "C:\Users\Admin\AppData\Local\Temp\1014844001\bluemail.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1456
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 644
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:5192
      • C:\Users\Admin\AppData\Local\Temp\1015079001\Bxq1jd2.exe
        "C:\Users\Admin\AppData\Local\Temp\1015079001\Bxq1jd2.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015079001\Bxq1jd2.exe" & rd /s /q "C:\ProgramData\T26XT2VAAAAA" & exit
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5756
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:4864
      • C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe
        "C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4084
        • C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe
          "C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3100
      • C:\Users\Admin\AppData\Local\Temp\1015176001\yt0wVyV.exe
        "C:\Users\Admin\AppData\Local\Temp\1015176001\yt0wVyV.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:2480
      • C:\Users\Admin\AppData\Local\Temp\1015177001\63f6851e4d.exe
        "C:\Users\Admin\AppData\Local\Temp\1015177001\63f6851e4d.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5688
        • C:\Windows\system32\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4968
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:2020
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p24291711423417250691697322505 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:5940
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_7.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:5700
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_6.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2948
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_5.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3264
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_4.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:5620
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_3.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:5892
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:5416
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2588
            • C:\Windows\system32\attrib.exe
              attrib +H "in.exe"
              5⤵
              • Views/modifies file attributes
              PID:3288
            • C:\Users\Admin\AppData\Local\Temp\main\in.exe
              "in.exe"
              5⤵
              • Executes dropped EXE
              PID:288
              • C:\Windows\system32\attrib.exe
                attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:5560
              • C:\Windows\system32\attrib.exe
                attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:2876
              • C:\Windows\system32\schtasks.exe
                schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                6⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3244
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell ping 127.0.0.1; del in.exe
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:5604
                • C:\Windows\system32\PING.EXE
                  "C:\Windows\system32\PING.EXE" 127.0.0.1
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:6000
        • C:\Users\Admin\AppData\Local\Temp\1015178001\c3fbc61667.exe
          "C:\Users\Admin\AppData\Local\Temp\1015178001\c3fbc61667.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:5528
          • C:\Users\Admin\AppData\Local\Temp\1015178001\c3fbc61667.exe
            "C:\Users\Admin\AppData\Local\Temp\1015178001\c3fbc61667.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3416
        • C:\Users\Admin\AppData\Local\Temp\1015179001\f69cc52010.exe
          "C:\Users\Admin\AppData\Local\Temp\1015179001\f69cc52010.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies system certificate store
          PID:5660
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015179001\f69cc52010.exe" & rd /s /q "C:\ProgramData\Q1NGDT0R9H4E" & exit
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2696
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 10
              5⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:3680
        • C:\Users\Admin\AppData\Local\Temp\1015180001\f3W2KH9.exe
          "C:\Users\Admin\AppData\Local\Temp\1015180001\f3W2KH9.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:4008
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4008 -s 620
            4⤵
            • Loads dropped DLL
            PID:2684
        • C:\Users\Admin\AppData\Local\Temp\1015181001\f224c8666a.exe
          "C:\Users\Admin\AppData\Local\Temp\1015181001\f224c8666a.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5536
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2748
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2956
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3160
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2848
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2612
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
              PID:5700
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:3280
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3280.0.434622235\170248950" -parentBuildID 20221007134813 -prefsHandle 1248 -prefMapHandle 1240 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92e1dbf8-c4ea-4301-826d-bcf7d0253499} 3280 "\\.\pipe\gecko-crash-server-pipe.3280" 1344 11af5058 gpu
                  6⤵
                    PID:5800
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3280.1.949795733\103171552" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {956ad260-3e4f-481b-9aa9-560e12f0dc74} 3280 "\\.\pipe\gecko-crash-server-pipe.3280" 1524 101fb258 socket
                    6⤵
                      PID:712
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3280.2.1472618534\216128215" -childID 1 -isForBrowser -prefsHandle 1952 -prefMapHandle 1968 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1f58e5f-9096-48a9-902b-99b1cab1be64} 3280 "\\.\pipe\gecko-crash-server-pipe.3280" 2036 1a366058 tab
                      6⤵
                        PID:4132
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3280.3.454270031\1069035722" -childID 2 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4099bb41-8044-4e9e-90c4-8188c47b7b54} 3280 "\\.\pipe\gecko-crash-server-pipe.3280" 2940 e5ea58 tab
                        6⤵
                          PID:5808
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3280.4.1993763051\374682955" -childID 3 -isForBrowser -prefsHandle 3728 -prefMapHandle 3424 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b52961f2-3c1f-43eb-b422-f4ca9d5cc6ca} 3280 "\\.\pipe\gecko-crash-server-pipe.3280" 3740 1eeab258 tab
                          6⤵
                            PID:5520
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3280.5.1999771502\1681475170" -childID 4 -isForBrowser -prefsHandle 3840 -prefMapHandle 3844 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57600d11-2622-412c-a8a3-35b3ce3e6e7e} 3280 "\\.\pipe\gecko-crash-server-pipe.3280" 3828 201a7258 tab
                            6⤵
                              PID:5252
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3280.6.1762901906\1582070130" -childID 5 -isForBrowser -prefsHandle 4016 -prefMapHandle 4020 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f07391a5-a2b8-4b38-9b26-683f5a4c351c} 3280 "\\.\pipe\gecko-crash-server-pipe.3280" 4004 201a7e58 tab
                              6⤵
                                PID:4376
                        • C:\Users\Admin\AppData\Local\Temp\1015182001\211fdbf7bb.exe
                          "C:\Users\Admin\AppData\Local\Temp\1015182001\211fdbf7bb.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          PID:5616
                        • C:\Users\Admin\AppData\Local\Temp\1015183001\4d44f0a5aa.exe
                          "C:\Users\Admin\AppData\Local\Temp\1015183001\4d44f0a5aa.exe"
                          3⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          PID:4836
                        • C:\Users\Admin\AppData\Local\Temp\1015184001\fe2dc9f703.exe
                          "C:\Users\Admin\AppData\Local\Temp\1015184001\fe2dc9f703.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2892
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:980
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {6A759A1E-104A-4AEE-93EE-D257E45E64FC} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
                      1⤵
                      • Loads dropped DLL
                      PID:4916
                      • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:5956
                        • C:\Windows\explorer.exe
                          explorer.exe
                          3⤵
                            PID:2020
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                            3⤵
                            • Drops file in System32 directory
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:3348
                            • C:\Windows\system32\PING.EXE
                              "C:\Windows\system32\PING.EXE" 127.1.10.1
                              4⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:5648

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      4
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Credential Access

                      Unsecured Credentials

                      2
                      T1552

                      Credentials In Files

                      2
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      7
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Recovery\README.TXT
                        Filesize

                        533B

                        MD5

                        81d185495b4e6430a87dfd37789bb872

                        SHA1

                        b5da653f81a548c74205c7ae3d19f30af1a14271

                        SHA256

                        838d654b9cb0360d8b3bb767db8fc1954fc41ba0a56fc34688aad9b50f5ddb40

                        SHA512

                        1106c9c2245cbd44effb42e4e1365eb796d3b2390b011fb97205550bf183b097c489194aa001f97f949e9d1ed1c970eea6cbb0477da47511e5bc18e88bf2dfa5

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        Filesize

                        1KB

                        MD5

                        67e486b2f148a3fca863728242b6273e

                        SHA1

                        452a84c183d7ea5b7c015b597e94af8eef66d44a

                        SHA256

                        facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                        SHA512

                        d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                        Filesize

                        436B

                        MD5

                        971c514f84bba0785f80aa1c23edfd79

                        SHA1

                        732acea710a87530c6b08ecdf32a110d254a54c8

                        SHA256

                        f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                        SHA512

                        43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                        Filesize

                        1KB

                        MD5

                        a266bb7dcc38a562631361bbf61dd11b

                        SHA1

                        3b1efd3a66ea28b16697394703a72ca340a05bd5

                        SHA256

                        df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                        SHA512

                        0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        Filesize

                        174B

                        MD5

                        618b38847dfbfb9a649c14548de5c0d8

                        SHA1

                        7312b71fd91698a13a370aee44cc6f05c57bb996

                        SHA256

                        4867319e647778be872d089c4f4a1faee516f805460ce76b50394606afe0f62d

                        SHA512

                        a4073bca9e837e2709f736b3299e8f96bbb0e2ec4ad45727b83f0ccd49e2572a567745e4784d7fbf8bfeea5481eb365563722538e4700355b9106db235cf8284

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                        Filesize

                        342B

                        MD5

                        56a8caff8057f88f43dac33230c6ded0

                        SHA1

                        f2072aba4817a8e49b42eecf99c8e470ee587dec

                        SHA256

                        651469717cec09040d5b962a693f122bfa6bf0d7c796c87f3a67d8d0a20a7378

                        SHA512

                        af681156e8db3bdca34e8cd7fb7624a09fab6ea582402e220ca81beb4da51f91c9164ef1bb127f0787f1a549c63c00795e5b8c3f8af85884c7bd3eddaad739ac

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                        Filesize

                        170B

                        MD5

                        08747c9e6f5eb5cfec3efb464a9ab4c1

                        SHA1

                        d6da95061e0d1d4a1611636ba5cb6e5424d9ec68

                        SHA256

                        735344adbe5f63d61f1beb135c04d3e2611bcf85794e3a7d95b739320fecdf02

                        SHA512

                        5c19c13fcee9a9d306492b30a190f77bf4574650ad71adb25779401686be4c2781029d8e7266abeab115e8e7d8a18ebb7c3314608fe3a699cce160be7615d9c6

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                        Filesize

                        242B

                        MD5

                        1bb2187e564013e72441d4bd2b52905a

                        SHA1

                        e7ac4cf024ca1a3a5466abe0df82030cd36d4b4e

                        SHA256

                        720ebccdedd3e0022e9359c7f776f49e006d0843cad273e936c84db06d168086

                        SHA512

                        c314b15719bf7884f8d721a6ed53a86654869c72cd0aac3933a9d06719f9239fe16f7e16800ed3c901b001a5f06b921edb1f67137dc3c1c347feacfa5f7902dd

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp
                        Filesize

                        27KB

                        MD5

                        f549e7206f41f5166ce00691dc8ea543

                        SHA1

                        48c2e313306a2be007ee3822254097fb0b2bfbb0

                        SHA256

                        5a6eae66bdddfee6a07a792990779690ca2b645c34a8ade8b423c5ce0ff7e997

                        SHA512

                        6292cad82f129d982a4262854e3a8fce725ba397731ef9ead7f82ca151a32a52f1690727fadd7137e75ce639840887523e8785ee15c22070c4b3cb81183a623c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1014564001\9JTVo50.exe
                        Filesize

                        612B

                        MD5

                        e3eb0a1df437f3f97a64aca5952c8ea0

                        SHA1

                        7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

                        SHA256

                        38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

                        SHA512

                        43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe
                        Filesize

                        1.1MB

                        MD5

                        42a8588cc82773cd223c42f8fe4be91a

                        SHA1

                        e2ed3cda00140ecd445f5f742729d34f2c452c8c

                        SHA256

                        d4521c34f489f4a6065dea15634df9bb700c84741f476bde1084d9cdfb373a7b

                        SHA512

                        681e4b155ce1015723469bd819618b292844aa00f7dab447d9557e244792efcef5614f753283efe9dd76ea77b838af78a3e69008c380482a4412b1cea75c535d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1014844001\bluemail.exe
                        Filesize

                        1.2MB

                        MD5

                        22a9baec9032c267d9f760853a3fd162

                        SHA1

                        6fdde24f545e1b99250ccb7a49456ef689b7e749

                        SHA256

                        8966e3c68cc4ad6cddf5479732785de05ad187d939a8ea3ac76ecf6169c1d599

                        SHA512

                        2df72347ce613f7cdc47fb1bf95b1c169e20bfa3d99df8b88aa90aab0a9d7e2269a1dc4f7456ef3e6a76d58b2548bf396c14f443d7b640a12eeaf3bc1ac99fcc

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015079001\Bxq1jd2.exe
                        Filesize

                        313KB

                        MD5

                        876a365bda09b9ef39605e375d677f0a

                        SHA1

                        2c12b38ed2d84722cf5dcea8bd45cfa7d7b55ba4

                        SHA256

                        ed252fe89ba1243bad21f373c952b16940a0094149b0be50e5c3da9c20a23234

                        SHA512

                        2a2df513d61e9b0eeedf099bb6a04962caa5eb31149efc24421bc30236886fc4a60fb7bcabed46069f0a13789ca34d4f21bc02f3c53bd8cf428be399ae63cb7d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe
                        Filesize

                        2.1MB

                        MD5

                        e48d0435a98834793ce9de1bb80fcf9a

                        SHA1

                        f783ad89853913987852c17e950f9697afbc4ede

                        SHA256

                        bb6973b370222c70d95255622b354a328809a1116d31c69122b35508e1601831

                        SHA512

                        7e3018a7f2741cf8adc3491eea00a2c67b25831f51904a956dc63fc8eac2bac876d4015f5aa0ab554bf45c5a2f93adca0d0810aad758e61d072c3e0b038553a2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015176001\yt0wVyV.exe
                        Filesize

                        302KB

                        MD5

                        a9502d407c7a3e0c43ad669c27638793

                        SHA1

                        bf0b7815c6dac82643a5bf7bd397a6aa58a9e803

                        SHA256

                        5f3cd8392c045a321ccf0ede6f38a4016a236f257d0a6ab897bf7f3e21868135

                        SHA512

                        0dbe8772ded05ba2c67ea7a7e9bc291b76d8b73dbab86a35fca5b1138be41c2ee7a54333fcd7bf58823ab3b5f1f6250b98b829ca0c367cafb2176350f5454d25

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015177001\63f6851e4d.exe
                        Filesize

                        4.2MB

                        MD5

                        3a425626cbd40345f5b8dddd6b2b9efa

                        SHA1

                        7b50e108e293e54c15dce816552356f424eea97a

                        SHA256

                        ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                        SHA512

                        a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015178001\c3fbc61667.exe
                        Filesize

                        710KB

                        MD5

                        28e568616a7b792cac1726deb77d9039

                        SHA1

                        39890a418fb391b823ed5084533e2e24dff021e1

                        SHA256

                        9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                        SHA512

                        85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015179001\f69cc52010.exe
                        Filesize

                        384KB

                        MD5

                        dfd5f78a711fa92337010ecc028470b4

                        SHA1

                        1a389091178f2be8ce486cd860de16263f8e902e

                        SHA256

                        da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

                        SHA512

                        a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015180001\f3W2KH9.exe
                        Filesize

                        3.4MB

                        MD5

                        c7c0d32aaf36dfb7b97fc873009d8d84

                        SHA1

                        f294cf8a175f851e0b1ebb8ee08807a98a390887

                        SHA256

                        f4e87c239d2edcf9bd364c1ba2b2abd78c2bc5f646c3c3ce2512655dfe9100fe

                        SHA512

                        cb4b6841cf09f00b826e417327a8a2736c201e466839aea0f0131e8678d057d23ceca1a8f2a7fd17f3e5b3ee90a8ec6bc3727d2b490e6791f2b749c182b7fb15

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015181001\f224c8666a.exe
                        Filesize

                        947KB

                        MD5

                        2647de44736cddce93e420de31e6a92c

                        SHA1

                        17820881a890b3cb89869d71d50ae90cd1f1082b

                        SHA256

                        a05138272c918e87f7f841919f12fa398079b3147d4d3c8b0d83b9ea87579a05

                        SHA512

                        a1577a8a18dc10a117bd52aee64800cfd79500e545dbc6c99ab5b068b1a1617e725a05401203d4647e26933d5a7027b19cea07301a4b8f724de09ea98fe4e5c2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015182001\211fdbf7bb.exe
                        Filesize

                        1.7MB

                        MD5

                        c31fe40f860b41c8cc1762c03c73b877

                        SHA1

                        50b66cdace74107cf7c81f3e44fca9950ef056e6

                        SHA256

                        4689172ce4cf5350001abf8a32dff840a4e677647c0368b4901f07ef199aeba8

                        SHA512

                        f34ed9d4d9103819adb33af73c8fe1ee0bc8a643a2a21747c71be0085d2b0b7d2f9964f76cd672ecb97a051e4852973692cfb772f7561c5a7f529f6b476a9f18

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015183001\4d44f0a5aa.exe
                        Filesize

                        2.6MB

                        MD5

                        bf65e919d02e2e79e22415d9fc896aba

                        SHA1

                        270953381ac1cb8f6ffb1f0f86f79fe6ae1197bf

                        SHA256

                        a1e79e829e95951dd7b70044091eb9b458eba9b5edbecded211fc61d717fcce5

                        SHA512

                        65817e3bbea8b2548a0e3fcdff97a06270e1f97f25352dffc5cc07d7a8b6842eb7356c0e9e0f4ff8083d9179fe76e490e157e388b47dfbb78d50e47151be0c82

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1015184001\fe2dc9f703.exe
                        Filesize

                        2.5MB

                        MD5

                        2a78ce9f3872f5e591d643459cabe476

                        SHA1

                        9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                        SHA256

                        21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                        SHA512

                        03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Cab93E6.tmp
                        Filesize

                        70KB

                        MD5

                        49aebf8cbd62d92ac215b2923fb1b9f5

                        SHA1

                        1723be06719828dda65ad804298d0431f6aff976

                        SHA256

                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                        SHA512

                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\TarBB93.tmp
                        Filesize

                        181KB

                        MD5

                        4ea6026cf93ec6338144661bf1202cd1

                        SHA1

                        a1dec9044f750ad887935a01430bf49322fbdcb7

                        SHA256

                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                        SHA512

                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_MEI22962\python310.dll
                        Filesize

                        4.3MB

                        MD5

                        c80b5cb43e5fe7948c3562c1fff1254e

                        SHA1

                        f73cb1fb9445c96ecd56b984a1822e502e71ab9d

                        SHA256

                        058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

                        SHA512

                        faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        Filesize

                        3.1MB

                        MD5

                        197f7a10814e446ee3d649f2509b1608

                        SHA1

                        a459ec5320318e01318105d8e87e707ea480a4c7

                        SHA256

                        b4ab50c0c3a89046764d4b805c9c4cf5cbe6ae07aa2eddb5e445c11479a912ce

                        SHA512

                        b595f5b8de7ecf96cb18f9f1de10bbb4988bb9b6412e1837b49469b78f7f15bbae661b8092b1d46fa6d2bdfeaa5f0e8e0f493c70dbe7d94c66cba325d83e6c85

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                        Filesize

                        1.6MB

                        MD5

                        72491c7b87a7c2dd350b727444f13bb4

                        SHA1

                        1e9338d56db7ded386878eab7bb44b8934ab1bc7

                        SHA256

                        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                        SHA512

                        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        Filesize

                        458KB

                        MD5

                        619f7135621b50fd1900ff24aade1524

                        SHA1

                        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                        SHA256

                        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                        SHA512

                        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
                        Filesize

                        1.7MB

                        MD5

                        5eb39ba3698c99891a6b6eb036cfb653

                        SHA1

                        d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

                        SHA256

                        e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

                        SHA512

                        6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
                        Filesize

                        1.7MB

                        MD5

                        7187cc2643affab4ca29d92251c96dee

                        SHA1

                        ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                        SHA256

                        c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                        SHA512

                        27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
                        Filesize

                        1.7MB

                        MD5

                        b7d1e04629bec112923446fda5391731

                        SHA1

                        814055286f963ddaa5bf3019821cb8a565b56cb8

                        SHA256

                        4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                        SHA512

                        79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                        Filesize

                        1.7MB

                        MD5

                        0dc4014facf82aa027904c1be1d403c1

                        SHA1

                        5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                        SHA256

                        a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                        SHA512

                        cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                        Filesize

                        3.3MB

                        MD5

                        cea368fc334a9aec1ecff4b15612e5b0

                        SHA1

                        493d23f72731bb570d904014ffdacbba2334ce26

                        SHA256

                        07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                        SHA512

                        bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                        Filesize

                        3.3MB

                        MD5

                        045b0a3d5be6f10ddf19ae6d92dfdd70

                        SHA1

                        0387715b6681d7097d372cd0005b664f76c933c7

                        SHA256

                        94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                        SHA512

                        58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                        Filesize

                        440B

                        MD5

                        3626532127e3066df98e34c3d56a1869

                        SHA1

                        5fa7102f02615afde4efd4ed091744e842c63f78

                        SHA256

                        2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                        SHA512

                        dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        2KB

                        MD5

                        362c0ab3a98c4d259f525abec6668ff7

                        SHA1

                        041395e93a455e0f3466e82ba7d7f0f06678658f

                        SHA256

                        795bb0bebc0eddd6cacdf4aa778440807883c525801c331618d9951d9c80e79e

                        SHA512

                        aef9360d9002ee885d98492fd335d74c048b68dccf5de3b01bd4803bdb6d32faa1de45cf2127d17dff0cf206ffda80415b7680e9d103052a8ab196cbd834d651

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\e564717e-cfbc-4f32-97ee-529a0563d17f
                        Filesize

                        13KB

                        MD5

                        b431b02a1b139a993c2c5f741699570f

                        SHA1

                        11293436c7b0d165a71cb828dd961b87ed2ce6e4

                        SHA256

                        8652d3cdd86bd4ccb1373b5caca097b644d4af643644cdb4a9301605c862a8ff

                        SHA512

                        f027bd71ca35cdbf3f464252b936537ab8a16eadd5a615c7f0bc5b0dff893595f2543c34e3bde6f693599308a059eb9738ae1fb955889463952b890f971f6da3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\fb0494a7-ef93-44bd-b93a-ef3c62a7310b
                        Filesize

                        745B

                        MD5

                        1822caa0d2fc70583cb96eb4cdcbbfc5

                        SHA1

                        d685d32eb9314a77b38a7b0a1be5365e461ac396

                        SHA256

                        c0449186fae8c17609132279684eb8348180316598479a97990bab8da7afdcf0

                        SHA512

                        0f169bb37039dc691b85c19208ea576eea7bfa92a8ababca72b6e4c8b21e7951caa28cac26b60eda6f5ece64e5b360e4810cd1622a65fad89f37050e5dd698da

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js
                        Filesize

                        6KB

                        MD5

                        64510b90273fbf750e1e6a3bc32952fa

                        SHA1

                        ce46f30e38b5ca72307a18bbbbca809bcaf63110

                        SHA256

                        3f8cfa500a19a38263fe18eb5e4d0926735c05481b57f4f6356169e451ac875d

                        SHA512

                        467fb93a598c66277aa9aa8b7f0c567ba30b8810529fafb09579a0112b9f600c7605db8ac47433273d10114e8afc9a12d4d6efae9308da02700225b3af656c7c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        ac556a54b7bea59504d9dd6ea2d4a3aa

                        SHA1

                        9c5540f1fe036afbd3c615aff7bf24ad9461df55

                        SHA256

                        58eed88e59020c975fd77de0d431d0f2eb637588d7a288697f18ccf28a64a573

                        SHA512

                        6afe5b731785708fbc47714a0e85028949ca3fbfaf3383b809d38d8bde13490e84f6596010a0288e00690bd44af1989e59733854ba63844ad45d0f29ec422dc1

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        945c8e6efae76dd0b4a3d56e20cfb88d

                        SHA1

                        26143aca99ef2cddfc4e5a50a51d1b651366ea21

                        SHA256

                        08850747ed7afb46c365739888c4731b177496ad3687fb824495ac3f505b659c

                        SHA512

                        818cbe3f0ea0b57be275e6c2bf893bf4654692055118aef78ef1c7b3ae8b40e293ec64561dd22d568e83941486486840b6a289c62eedd36804743a04de413c57

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4
                        Filesize

                        4KB

                        MD5

                        3d95e420bda5497f6bf4aca729f97484

                        SHA1

                        8c1ab0dd370633eba6f005b25e0853f8b46b99e6

                        SHA256

                        f3989e16691086211d9496094665e879ca46aa9a8000607d5bc90990608631c5

                        SHA512

                        e1f64ca3b9cecf2509237d467ef27329c11fa437ff2c9c80b3509c2cb36f81e9a5709838516708e84e803689573d7061816d5b0967d239cc0968ca83d1442fe4

                        Download Submit

                      • memory/288-18946-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/288-18949-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1456-1892-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-754-0x0000000000D30000-0x0000000000E5C000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/1456-3146-0x0000000000AE0000-0x0000000000B2C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/1456-1931-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1934-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1941-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1943-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1945-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1952-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1909-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1949-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1947-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1939-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1937-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1935-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1929-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1927-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1925-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1923-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1921-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1919-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-3141-0x00000000047B0000-0x000000000483A000-memory.dmp

                        Filesize

                        552KB

                        Download

                      • memory/1456-1917-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1897-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1901-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1911-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1913-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1915-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1907-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1905-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1903-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1899-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1894-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1749-0x0000000004C30000-0x0000000004D48000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-18984-0x0000000004D50000-0x0000000004DA4000-memory.dmp

                        Filesize

                        336KB

                        Download

                      • memory/1456-1842-0x0000000004F10000-0x0000000005028000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1456-1887-0x0000000004F10000-0x0000000005023000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/2080-14-0x0000000006A30000-0x0000000006D46000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2080-1-0x0000000077E80000-0x0000000077E82000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2080-2-0x00000000010C1000-0x0000000001129000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/2080-0-0x00000000010C0000-0x00000000013D6000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2080-3-0x00000000010C0000-0x00000000013D6000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2080-5-0x00000000010C0000-0x00000000013D6000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2080-16-0x00000000010C0000-0x00000000013D6000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2080-18-0x00000000010C1000-0x0000000001129000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/2660-20618-0x0000000006340000-0x00000000065E8000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/2660-22-0x0000000000E80000-0x0000000001196000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2660-20591-0x0000000006340000-0x00000000065E8000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/2660-20575-0x0000000006F00000-0x00000000075AA000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/2660-17-0x0000000000E80000-0x0000000001196000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2660-1779-0x0000000000E80000-0x0000000001196000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2660-47-0x0000000000E80000-0x0000000001196000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2660-23-0x0000000000E80000-0x0000000001196000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2660-48-0x0000000000E80000-0x0000000001196000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2660-20392-0x0000000006F00000-0x00000000075AA000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/2660-19-0x0000000000E80000-0x0000000001196000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2660-20589-0x0000000006340000-0x00000000065E8000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/2660-20-0x0000000000E80000-0x0000000001196000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3348-20666-0x000000001B5A0000-0x000000001B882000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/3348-20667-0x0000000002890000-0x0000000002898000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/4008-20367-0x000000001BF50000-0x000000001C220000-memory.dmp

                        Filesize

                        2.8MB

                        Download

                      • memory/4008-19143-0x0000000000810000-0x0000000000B82000-memory.dmp

                        Filesize

                        3.4MB

                        Download

                      • memory/4008-19167-0x000000001BBF0000-0x000000001BF50000-memory.dmp

                        Filesize

                        3.4MB

                        Download

                      • memory/4008-19166-0x000000001B890000-0x000000001BBF0000-memory.dmp

                        Filesize

                        3.4MB

                        Download

                      • memory/4084-20541-0x0000000005660000-0x00000000057AA000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/4084-20542-0x0000000000600000-0x0000000000622000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/4084-10955-0x0000000000B60000-0x0000000000D76000-memory.dmp

                        Filesize

                        2.1MB

                        Download

                      • memory/4836-20590-0x0000000000830000-0x0000000000AD8000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4836-20627-0x0000000000830000-0x0000000000AD8000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4836-20592-0x0000000000830000-0x0000000000AD8000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4836-20593-0x0000000000830000-0x0000000000AD8000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4836-20619-0x0000000000830000-0x0000000000AD8000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4916-20648-0x000000013FD70000-0x0000000140200000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4916-20650-0x000000013FD70000-0x0000000140200000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4916-20675-0x000000013FD70000-0x0000000140200000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4968-18947-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4968-18944-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4968-19109-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4968-19236-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/5604-18968-0x0000000002870000-0x0000000002878000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/5604-18967-0x000000001B580000-0x000000001B862000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/5616-20403-0x0000000000A00000-0x00000000010AA000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/5616-20393-0x0000000000A00000-0x00000000010AA000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/5956-20649-0x000000013FD70000-0x0000000140200000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/5956-20661-0x000000013FD70000-0x0000000140200000-memory.dmp

                        Filesize

                        4.6MB

                        Download