Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 22:04
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240729-en
General
-
Target
file.exe
-
Size
2.9MB
-
MD5
f45da90410f7d099ab3bd1589a039a79
-
SHA1
a7effa8c1fc9b88eea3498ed50011d7a14a7e617
-
SHA256
4fb84272045fc39952401061f10a2ba439d2f2a7c6e30f2448b757caf731df19
-
SHA512
577ae3d2c9f46c57ba71a9437fdf47deac865605b31f0a0a2a2caef90a4346bfa12c0894fe9c3a8dc7a602516bde33d58d483a8c5547452397f15a824c07a864
-
SSDEEP
49152:LcjBVZDZYhTklsZHUwGemMSwvMGKuFk2PGHqv:aBVZD+NklXwG5Mf73eTHqv
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://shineugler.biz/api
https://tacitglibbr.biz/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://shineugler.biz/api
https://tacitglibbr.biz/api
Signatures
-
Amadey family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 9C0HZT123N1YEFLFJV3A.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 9C0HZT123N1YEFLFJV3A.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" c27c3960cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" c27c3960cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" c27c3960cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" c27c3960cf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 9C0HZT123N1YEFLFJV3A.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 9C0HZT123N1YEFLFJV3A.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 9C0HZT123N1YEFLFJV3A.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 9C0HZT123N1YEFLFJV3A.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" c27c3960cf.exe -
Stealc family
-
DCRat payload 2 IoCs
resource yara_rule behavioral1/memory/5708-67400-0x0000000000080000-0x0000000000100000-memory.dmp family_dcrat_v2 behavioral1/memory/6008-105055-0x0000000000400000-0x0000000000480000-memory.dmp family_dcrat_v2 -
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF aeb50e1a85.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d4ff2c29de.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ecc9b61e59.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9C0HZT123N1YEFLFJV3A.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Z9URBIRX5F45CVP96HOZ1WDVBDR.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ aeb50e1a85.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f0b78dd496.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c27c3960cf.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion aeb50e1a85.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d4ff2c29de.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f0b78dd496.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f0b78dd496.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9C0HZT123N1YEFLFJV3A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c27c3960cf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c27c3960cf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion aeb50e1a85.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9C0HZT123N1YEFLFJV3A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Z9URBIRX5F45CVP96HOZ1WDVBDR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d4ff2c29de.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ecc9b61e59.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ecc9b61e59.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Z9URBIRX5F45CVP96HOZ1WDVBDR.exe -
Executes dropped EXE 30 IoCs
pid Process 2920 skotes.exe 2676 IQ7ux2z.exe 4756 sUSFJjY.exe 4892 IQ7ux2z.exe 4996 aeb50e1a85.exe 2480 89bc2f79f3.exe 3604 d4ff2c29de.exe 1816 ecc9b61e59.exe 2852 f0b78dd496.exe 3248 9C0HZT123N1YEFLFJV3A.exe 3616 4071d7d8e0.exe 3748 Z9URBIRX5F45CVP96HOZ1WDVBDR.exe 4688 c27c3960cf.exe 3084 975ecceb8d.exe 1160 f5ae09423b.exe 3856 7z.exe 3824 7z.exe 3732 7z.exe 4180 7z.exe 3944 7z.exe 3992 7z.exe 4036 7z.exe 1600 7z.exe 4188 in.exe 2932 Intel_PTT_EK_Recertification.exe 2544 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5976 firefox.exe 6008 firefox.exe 1916 Intel_PTT_EK_Recertification.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine aeb50e1a85.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine Z9URBIRX5F45CVP96HOZ1WDVBDR.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine d4ff2c29de.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine ecc9b61e59.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine f0b78dd496.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine 9C0HZT123N1YEFLFJV3A.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine c27c3960cf.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine skotes.exe -
Loads dropped DLL 45 IoCs
pid Process 1520 file.exe 1520 file.exe 2920 skotes.exe 2920 skotes.exe 2676 IQ7ux2z.exe 2920 skotes.exe 2920 skotes.exe 2920 skotes.exe 2920 skotes.exe 2920 skotes.exe 2920 skotes.exe 2920 skotes.exe 1816 ecc9b61e59.exe 1816 ecc9b61e59.exe 2920 skotes.exe 1816 ecc9b61e59.exe 2920 skotes.exe 2920 skotes.exe 2920 skotes.exe 2920 skotes.exe 2920 skotes.exe 880 cmd.exe 3856 7z.exe 880 cmd.exe 3824 7z.exe 880 cmd.exe 3732 7z.exe 880 cmd.exe 4180 7z.exe 880 cmd.exe 3944 7z.exe 880 cmd.exe 3992 7z.exe 880 cmd.exe 4036 7z.exe 880 cmd.exe 1600 7z.exe 880 cmd.exe 880 cmd.exe 2036 taskeng.exe 2036 taskeng.exe 2084 cmd.exe 5868 cmd.exe 5976 firefox.exe 2036 taskeng.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 9C0HZT123N1YEFLFJV3A.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 9C0HZT123N1YEFLFJV3A.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" c27c3960cf.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecc9b61e59.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015786001\\ecc9b61e59.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\f0b78dd496.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015787001\\f0b78dd496.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\4071d7d8e0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015788001\\4071d7d8e0.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\c27c3960cf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015789001\\c27c3960cf.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000500000001a41d-29311.dat autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 1520 file.exe 2920 skotes.exe 4996 aeb50e1a85.exe 3604 d4ff2c29de.exe 1816 ecc9b61e59.exe 2852 f0b78dd496.exe 3248 9C0HZT123N1YEFLFJV3A.exe 3748 Z9URBIRX5F45CVP96HOZ1WDVBDR.exe 4688 c27c3960cf.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2676 set thread context of 4892 2676 IQ7ux2z.exe 34 PID 2932 set thread context of 1632 2932 Intel_PTT_EK_Recertification.exe 95 PID 2544 set thread context of 5708 2544 JrCklm0E5O0P77D.exe 104 PID 5976 set thread context of 6008 5976 firefox.exe 110 PID 1916 set thread context of 3872 1916 Intel_PTT_EK_Recertification.exe 112 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows NT\TableTextService\de-DE\firefox.exe JrCklm0E5O0P77D.exe File created C:\Program Files (x86)\Windows NT\TableTextService\de-DE\0fc223bdacedc3 JrCklm0E5O0P77D.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe File created C:\Windows\rescache\rc0002\firefox.exe JrCklm0E5O0P77D.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 33 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQ7ux2z.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 4071d7d8e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Z9URBIRX5F45CVP96HOZ1WDVBDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 975ecceb8d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89bc2f79f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 4071d7d8e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JrCklm0E5O0P77D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4071d7d8e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JrCklm0E5O0P77D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aeb50e1a85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c27c3960cf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0b78dd496.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C0HZT123N1YEFLFJV3A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQ7ux2z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4ff2c29de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecc9b61e59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4696 powershell.exe 2148 PING.EXE 4220 powershell.exe 4536 PING.EXE 3616 powershell.exe 3564 PING.EXE 4440 PING.EXE 5900 PING.EXE -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 89bc2f79f3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 89bc2f79f3.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2960 timeout.exe -
Kills process with taskkill 5 IoCs
pid Process 3816 taskkill.exe 4212 taskkill.exe 4300 taskkill.exe 4388 taskkill.exe 4468 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings firefox.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 89bc2f79f3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 89bc2f79f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 89bc2f79f3.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 4536 PING.EXE 3564 PING.EXE 4440 PING.EXE 5900 PING.EXE 2148 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4236 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1520 file.exe 2920 skotes.exe 4996 aeb50e1a85.exe 4996 aeb50e1a85.exe 4996 aeb50e1a85.exe 4996 aeb50e1a85.exe 4996 aeb50e1a85.exe 4996 aeb50e1a85.exe 3604 d4ff2c29de.exe 2480 89bc2f79f3.exe 3604 d4ff2c29de.exe 3604 d4ff2c29de.exe 3604 d4ff2c29de.exe 3604 d4ff2c29de.exe 1816 ecc9b61e59.exe 1816 ecc9b61e59.exe 1816 ecc9b61e59.exe 1816 ecc9b61e59.exe 1816 ecc9b61e59.exe 2852 f0b78dd496.exe 3248 9C0HZT123N1YEFLFJV3A.exe 3748 Z9URBIRX5F45CVP96HOZ1WDVBDR.exe 3248 9C0HZT123N1YEFLFJV3A.exe 3248 9C0HZT123N1YEFLFJV3A.exe 3616 4071d7d8e0.exe 4688 c27c3960cf.exe 3616 4071d7d8e0.exe 4688 c27c3960cf.exe 4688 c27c3960cf.exe 4220 powershell.exe 2932 Intel_PTT_EK_Recertification.exe 3616 powershell.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe 5708 JrCklm0E5O0P77D.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 2676 IQ7ux2z.exe Token: SeDebugPrivilege 4756 sUSFJjY.exe Token: SeDebugPrivilege 4892 IQ7ux2z.exe Token: SeDebugPrivilege 3816 taskkill.exe Token: SeDebugPrivilege 3248 9C0HZT123N1YEFLFJV3A.exe Token: SeDebugPrivilege 4212 taskkill.exe Token: SeDebugPrivilege 4300 taskkill.exe Token: SeDebugPrivilege 4388 taskkill.exe Token: SeDebugPrivilege 4468 taskkill.exe Token: SeDebugPrivilege 4552 firefox.exe Token: SeDebugPrivilege 4552 firefox.exe Token: SeDebugPrivilege 4688 c27c3960cf.exe Token: SeRestorePrivilege 3856 7z.exe Token: 35 3856 7z.exe Token: SeSecurityPrivilege 3856 7z.exe Token: SeSecurityPrivilege 3856 7z.exe Token: SeRestorePrivilege 3824 7z.exe Token: 35 3824 7z.exe Token: SeSecurityPrivilege 3824 7z.exe Token: SeSecurityPrivilege 3824 7z.exe Token: SeRestorePrivilege 3732 7z.exe Token: 35 3732 7z.exe Token: SeSecurityPrivilege 3732 7z.exe Token: SeSecurityPrivilege 3732 7z.exe Token: SeRestorePrivilege 4180 7z.exe Token: 35 4180 7z.exe Token: SeSecurityPrivilege 4180 7z.exe Token: SeSecurityPrivilege 4180 7z.exe Token: SeRestorePrivilege 3944 7z.exe Token: 35 3944 7z.exe Token: SeSecurityPrivilege 3944 7z.exe Token: SeSecurityPrivilege 3944 7z.exe Token: SeRestorePrivilege 3992 7z.exe Token: 35 3992 7z.exe Token: SeSecurityPrivilege 3992 7z.exe Token: SeSecurityPrivilege 3992 7z.exe Token: SeRestorePrivilege 4036 7z.exe Token: 35 4036 7z.exe Token: SeSecurityPrivilege 4036 7z.exe Token: SeSecurityPrivilege 4036 7z.exe Token: SeRestorePrivilege 1600 7z.exe Token: 35 1600 7z.exe Token: SeSecurityPrivilege 1600 7z.exe Token: SeSecurityPrivilege 1600 7z.exe Token: SeDebugPrivilege 4220 powershell.exe Token: SeDebugPrivilege 3616 powershell.exe Token: SeLockMemoryPrivilege 1632 explorer.exe Token: SeDebugPrivilege 2544 JrCklm0E5O0P77D.exe Token: SeDebugPrivilege 5708 JrCklm0E5O0P77D.exe Token: SeDebugPrivilege 5976 firefox.exe Token: SeDebugPrivilege 6008 firefox.exe Token: SeLockMemoryPrivilege 3872 explorer.exe Token: SeDebugPrivilege 4696 powershell.exe -
Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 1520 file.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 4552 firefox.exe 4552 firefox.exe 4552 firefox.exe 4552 firefox.exe 3616 4071d7d8e0.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 3616 4071d7d8e0.exe 4552 firefox.exe 4552 firefox.exe 4552 firefox.exe 3616 4071d7d8e0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2920 1520 file.exe 30 PID 1520 wrote to memory of 2920 1520 file.exe 30 PID 1520 wrote to memory of 2920 1520 file.exe 30 PID 1520 wrote to memory of 2920 1520 file.exe 30 PID 2920 wrote to memory of 2676 2920 skotes.exe 32 PID 2920 wrote to memory of 2676 2920 skotes.exe 32 PID 2920 wrote to memory of 2676 2920 skotes.exe 32 PID 2920 wrote to memory of 2676 2920 skotes.exe 32 PID 2920 wrote to memory of 4756 2920 skotes.exe 33 PID 2920 wrote to memory of 4756 2920 skotes.exe 33 PID 2920 wrote to memory of 4756 2920 skotes.exe 33 PID 2920 wrote to memory of 4756 2920 skotes.exe 33 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2676 wrote to memory of 4892 2676 IQ7ux2z.exe 34 PID 2920 wrote to memory of 4996 2920 skotes.exe 35 PID 2920 wrote to memory of 4996 2920 skotes.exe 35 PID 2920 wrote to memory of 4996 2920 skotes.exe 35 PID 2920 wrote to memory of 4996 2920 skotes.exe 35 PID 2920 wrote to memory of 2480 2920 skotes.exe 36 PID 2920 wrote to memory of 2480 2920 skotes.exe 36 PID 2920 wrote to memory of 2480 2920 skotes.exe 36 PID 2920 wrote to memory of 2480 2920 skotes.exe 36 PID 2920 wrote to memory of 3604 2920 skotes.exe 38 PID 2920 wrote to memory of 3604 2920 skotes.exe 38 PID 2920 wrote to memory of 3604 2920 skotes.exe 38 PID 2920 wrote to memory of 3604 2920 skotes.exe 38 PID 2920 wrote to memory of 1816 2920 skotes.exe 40 PID 2920 wrote to memory of 1816 2920 skotes.exe 40 PID 2920 wrote to memory of 1816 2920 skotes.exe 40 PID 2920 wrote to memory of 1816 2920 skotes.exe 40 PID 2480 wrote to memory of 1128 2480 89bc2f79f3.exe 41 PID 2480 wrote to memory of 1128 2480 89bc2f79f3.exe 41 PID 2480 wrote to memory of 1128 2480 89bc2f79f3.exe 41 PID 2480 wrote to memory of 1128 2480 89bc2f79f3.exe 41 PID 1128 wrote to memory of 2960 1128 cmd.exe 43 PID 1128 wrote to memory of 2960 1128 cmd.exe 43 PID 1128 wrote to memory of 2960 1128 cmd.exe 43 PID 1128 wrote to memory of 2960 1128 cmd.exe 43 PID 2920 wrote to memory of 2852 2920 skotes.exe 44 PID 2920 wrote to memory of 2852 2920 skotes.exe 44 PID 2920 wrote to memory of 2852 2920 skotes.exe 44 PID 2920 wrote to memory of 2852 2920 skotes.exe 44 PID 1816 wrote to memory of 3248 1816 ecc9b61e59.exe 45 PID 1816 wrote to memory of 3248 1816 ecc9b61e59.exe 45 PID 1816 wrote to memory of 3248 1816 ecc9b61e59.exe 45 PID 1816 wrote to memory of 3248 1816 ecc9b61e59.exe 45 PID 2920 wrote to memory of 3616 2920 skotes.exe 46 PID 2920 wrote to memory of 3616 2920 skotes.exe 46 PID 2920 wrote to memory of 3616 2920 skotes.exe 46 PID 2920 wrote to memory of 3616 2920 skotes.exe 46 PID 1816 wrote to memory of 3748 1816 ecc9b61e59.exe 47 PID 1816 wrote to memory of 3748 1816 ecc9b61e59.exe 47 PID 1816 wrote to memory of 3748 1816 ecc9b61e59.exe 47 PID 1816 wrote to memory of 3748 1816 ecc9b61e59.exe 47 PID 3616 wrote to memory of 3816 3616 4071d7d8e0.exe 48 PID 3616 wrote to memory of 3816 3616 4071d7d8e0.exe 48 PID 3616 wrote to memory of 3816 3616 4071d7d8e0.exe 48 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 3756 attrib.exe 4204 attrib.exe 1820 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4892 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8NMdxTHKaozS.bat" "5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
- System Location Discovery: System Language Discovery
PID:4048
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost6⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4440
-
-
C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iT7YNmmQSt.bat"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5868 -
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
- System Location Discovery: System Language Discovery
PID:5892
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost9⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5900
-
-
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\firefox.exe"C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\firefox.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5976 -
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\firefox.exe"C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\firefox.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6008
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe"C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Users\Admin\AppData\Local\Temp\1015783001\aeb50e1a85.exe"C:\Users\Admin\AppData\Local\Temp\1015783001\aeb50e1a85.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
-
C:\Users\Admin\AppData\Local\Temp\1015784001\89bc2f79f3.exe"C:\Users\Admin\AppData\Local\Temp\1015784001\89bc2f79f3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015784001\89bc2f79f3.exe" & rd /s /q "C:\ProgramData\RQQ9RQIEU37Q" & exit4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2960
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015785001\d4ff2c29de.exe"C:\Users\Admin\AppData\Local\Temp\1015785001\d4ff2c29de.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\1015786001\ecc9b61e59.exe"C:\Users\Admin\AppData\Local\Temp\1015786001\ecc9b61e59.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\9C0HZT123N1YEFLFJV3A.exe"C:\Users\Admin\AppData\Local\Temp\9C0HZT123N1YEFLFJV3A.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\Z9URBIRX5F45CVP96HOZ1WDVBDR.exe"C:\Users\Admin\AppData\Local\Temp\Z9URBIRX5F45CVP96HOZ1WDVBDR.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3748
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015787001\f0b78dd496.exe"C:\Users\Admin\AppData\Local\Temp\1015787001\f0b78dd496.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\1015788001\4071d7d8e0.exe"C:\Users\Admin\AppData\Local\Temp\1015788001\4071d7d8e0.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵PID:4540
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4552 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.0.1012420676\840734193" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1192 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d09f67b2-f27c-4c57-a3d9-7386e6321926} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 1312 11ad6958 gpu6⤵PID:1564
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.1.1553442855\1170313248" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59d8befd-8944-4d73-801d-ec3ac81f415a} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 1524 11a03258 socket6⤵PID:4964
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.2.897129078\1446621691" -childID 1 -isForBrowser -prefsHandle 2088 -prefMapHandle 2084 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20a25718-3bd6-47d0-9ed4-688bb9f89948} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 2100 1a9b8858 tab6⤵PID:1088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.3.908885415\1874138794" -childID 2 -isForBrowser -prefsHandle 2948 -prefMapHandle 2944 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4a3d43e-0add-4e24-9100-e1030c17c225} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 2960 1bbaf258 tab6⤵PID:2948
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.4.315448619\269353944" -childID 3 -isForBrowser -prefsHandle 3652 -prefMapHandle 3664 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4161ccee-e73d-4530-b68b-0734501176a1} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3680 1eeab558 tab6⤵PID:5052
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.5.1564767969\1470258900" -childID 4 -isForBrowser -prefsHandle 3832 -prefMapHandle 3836 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a2aa70a-a294-43ef-9316-eb333d532c73} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3820 e2d858 tab6⤵PID:1728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.6.690159159\794030788" -childID 5 -isForBrowser -prefsHandle 3964 -prefMapHandle 3968 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0993c661-8b8e-4db7-927f-500477bd38b8} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3952 1c0ad258 tab6⤵PID:2072
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015789001\c27c3960cf.exe"C:\Users\Admin\AppData\Local\Temp\1015789001\c27c3960cf.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
C:\Users\Admin\AppData\Local\Temp\1015790001\975ecceb8d.exe"C:\Users\Admin\AppData\Local\Temp\1015790001\975ecceb8d.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
- Loads dropped DLL
PID:880 -
C:\Windows\system32\mode.commode 65,105⤵PID:3780
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"5⤵
- Views/modifies file attributes
PID:3756
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"5⤵
- Executes dropped EXE
PID:4188 -
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:4204
-
-
C:\Windows\system32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:1820
-
-
C:\Windows\system32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE6⤵
- Scheduled Task/Job: Scheduled Task
PID:4236
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4536
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015791001\f5ae09423b.exe"C:\Users\Admin\AppData\Local\Temp\1015791001\f5ae09423b.exe"3⤵
- Executes dropped EXE
PID:1160
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C5C06D1E-1D61-45BA-8AFF-EE22E6FA318D} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]1⤵
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2932 -
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- Drops file in System32 directory
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3564
-
-
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1916 -
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- Drops file in System32 directory
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4696 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2148
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
5Discovery
Browser Information Discovery
1Query Registry
7Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5985a071afd1a3065488a92540c3bee93
SHA1f5282fdbd3fbe681dd8485f37d6ba3d5ce59079f
SHA256464e8781560aecb3764b8afad710aed0b8087b362e180bc3b18c84be5ef38089
SHA512ff76a68533f86b2872c19722f8adb3fcba5f6bc802caa4dc6543447141b78d60db686d481a0e168afd58516d009fe551ee3113de6b3eb174eeee736cf304dd60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbf5edb3181972c811d11976686c1e52
SHA1914291bcb7461a6430ecb32c70b9e50887b45224
SHA2568605f321e53076b3a2ec2575d29234ff3877ffa383329eaa9bd0eb454b675ed5
SHA512a52362ce5a2b75fa96a83bfbbd1db4da00f7c801afe0cfaccab022577b5699c74e268f12dcb2ad39d876847a95c0092e1170bd5b5dcc16857b2fc43cb98e0a82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ece7eb3e7274557c6d53609207b002a
SHA1e4010b4f1de94c335ee6aa73e3caf0ef3206293d
SHA25605ac7591b669ec8e97c223306d0d16887236dfcf8a5b45569249493c1def5112
SHA51267e8d61d700247f3873930f39434f767547bf0cc01e221ed2c200fb7e415d27f7fd05c4b43a5c5ac244b93d4a63f249d1ff4dd5d2560514b0cd1a8982905d8eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cc07a5e1735be59089ec9d4a01eb49b
SHA15a3951b710800475755df4adc735f67fb8f0b56c
SHA256efe16e5e3710b966106d1ba73a47461c493f65437509940a165e2eb1af8f75bf
SHA512e095d36bebc24eaecaf0d6663cdb7ce5dd132d99c5bad79ecb3a73deabc185bdfeb009267afc069c2a0ae70b522767df3375fcbf4bcb21cbc4aacc57492a9599
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp
Filesize24KB
MD54fe52d8fc4149ce6bfa090adc2c1afd7
SHA1b026936b9d76ec04bc3a0e82496fb2c86ecf3b24
SHA2560bbb886c7197dbe61e003d07b53dbb24b75b57ffce0253f396d2c4a9c19caf44
SHA512b17c1861d8ae8be02b05f2877775b5056747352c6d51712a2a1e9889f194c5202c310c89ce5e0a216245ae95b2b54a86f5d20800eb1e7d6fedd7d65a6e6ed0aa
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
2.8MB
MD50dad190f420a0a09ed8c262ca18b1097
SHA1b97535bf2960278b19bda8cad9e885b8eefbdc85
SHA25629e1e95110c03e84720e213a2bb0dcdff95af85a8a894d71518e06c62131e64a
SHA5128ae92676fc5539899414f0a70cba1ed01685b30af9002c68114720d6a7213e4e9c2368e17717c4e3e02650781a022001e4a2e43f83afbd709e7f1ab81003b646
-
Filesize
87KB
MD565ca33d1c759d3d8eb1d015d26479271
SHA12b0992769c879e7e22f9e3a18f3d1fb15e0870aa
SHA25669bdb80ed6cbffe24e06d5bccea27aa1f6fbca4540e2bc191c85f7a2e91400ea
SHA512d18f975b4e1d387f88ef1e490ac6456ff19c8138bcde522ccf3302fe6d2199ccfc99ab894ad968af8c76ca412caf9d2b069f6444960c26a057cddb44449be2e9
-
Filesize
4.2MB
MD56a94a20c20e2a75fa16041e1175793e7
SHA140d8df3d0bdfef2eaccb7b14d62f78c9eff5c989
SHA256102d2c6aa1e5b2a0d91df5f7dcdf0c8a0393595578ecb714669ef85e1319104d
SHA51224250549fc70ffcbccb64eb5a1634005084bdfdccaeff892b6460ef10837d622bcbc817983c922516324b868c935f7d6277b8d919f2abeaf41b4156f948997c1
-
Filesize
384KB
MD5dfd5f78a711fa92337010ecc028470b4
SHA11a389091178f2be8ce486cd860de16263f8e902e
SHA256da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d
SHA512a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656
-
Filesize
1.7MB
MD56c1d0dabe1ec5e928f27b3223f25c26b
SHA1e25ab704a6e9b3e4c30a6c1f7043598a13856ad9
SHA25692228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d
SHA5123a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9
-
Filesize
1.8MB
MD51d13d83ba0b9e54307060da3ad2c16bf
SHA145fe957170c36b1704c25ff65d59dd8bbe6894cd
SHA256cce6c6f51a01ff3662b263cd464e41b163db9590453603e2c8b5dee39d5f94d0
SHA512803e1b9587fc7aab36c96d52fe901fa6dbe0523aa46da23afb0bd50f7ebcbe5bfd9793ac61cbdd4d228159786d240d5161ff80a5e445eaa00fc77cdf455eb526
-
Filesize
1.7MB
MD5228bc900c337f34da99576e917296e62
SHA10f6393c99373b170166bf3e563d3380914d8afe3
SHA2569b4a6a847a0e8ea430a26136519ab7bf301f6b6c3a162d8443300d5e6f50cb86
SHA5127c5a8bd94c9cca5267aafd0284573843e77d8cb9294131396a6b434af8d8e489ca33374d718fc45edb7e412c0f8d6832f8a936374a4f6612f2e9395377cd4382
-
Filesize
950KB
MD5a0b7a28c8ae27509d5fdfe9e6582705c
SHA13bcf1aa52032034e3a4968fd2633cabd3b2c2e08
SHA256696495731d4eb0f28bc4678f8ea8c20a9c1caf16a460405fea538893a792fd05
SHA512f197738e61660e4497bd1cc3f3c1b70ebfc403948208cb570b292d3fba78d0ca27487b4784f6680bf219678e861d5b489bc2858f5d99f349c65b6e568dc3c63f
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
710KB
MD528e568616a7b792cac1726deb77d9039
SHA139890a418fb391b823ed5084533e2e24dff021e1
SHA2569597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2
SHA51285048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5
-
Filesize
178B
MD5cbc4b3786e796bd08c068c1a28ee3189
SHA10c0ff0a0fb770e612b17eac7a075b845b05ed6f6
SHA25639d97ac84fd89433d120a774e88c62290c63122d1e85a6203bf1c22134b85588
SHA51278c32ad19102b1e5bb2090a9b396062377c906c66620a0ff030bff5d650485d1c95fc6113fd59e9e6297a53e90e36136d04f61d53ba25513be997e5aca3a5ed5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2.9MB
MD5f45da90410f7d099ab3bd1589a039a79
SHA1a7effa8c1fc9b88eea3498ed50011d7a14a7e617
SHA2564fb84272045fc39952401061f10a2ba439d2f2a7c6e30f2448b757caf731df19
SHA512577ae3d2c9f46c57ba71a9437fdf47deac865605b31f0a0a2a2caef90a4346bfa12c0894fe9c3a8dc7a602516bde33d58d483a8c5547452397f15a824c07a864
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
1.7MB
MD50dc4014facf82aa027904c1be1d403c1
SHA15e6d6c020bfc2e6f24f3d237946b0103fe9b1831
SHA256a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7
SHA512cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028
-
Filesize
3.3MB
MD5cea368fc334a9aec1ecff4b15612e5b0
SHA1493d23f72731bb570d904014ffdacbba2334ce26
SHA25607e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541
SHA512bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748
-
Filesize
3.3MB
MD5045b0a3d5be6f10ddf19ae6d92dfdd70
SHA10387715b6681d7097d372cd0005b664f76c933c7
SHA25694b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d
SHA51258255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b
-
Filesize
440B
MD53626532127e3066df98e34c3d56a1869
SHA15fa7102f02615afde4efd4ed091744e842c63f78
SHA2562a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca
SHA512dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\135YZCAW50A2PEGOSEKS.temp
Filesize7KB
MD5f4514a01bc81b515f3ad62e9efdabd1e
SHA1281476fce646e02f48d8a511c0a53190061b70d7
SHA256f9f7f2a71e3310876e17c1d67563b00c9c2a8bf09b902ec28adf8545e1fb7735
SHA512d190951d4804dc354bb2f893286e5a7109b98667b68cc4adc9dc14fcd24c109e7ff94fe94de7d453b98ee86ecc155902ae2db1584d6cb3f0ac31ff0a62103c39
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5ac913f7d0ec3b42c219c70280dc8f089
SHA11df8578ca63fbf0c57124b0d8e4ee2781754362f
SHA2565028676a1f3b9c4b2b0f97b9492cd0380ecd633a37ab854c5151d5d826ca860b
SHA512cd1ea9d86f0bf6c008d0ea1a72594b3c82cce0f4e212d356c4e2693f1898354619fd15f28009a3cf0e5b63716ac9516b591316a499b76e6ff378917ea6ae5d36
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\1fbdf600-fd85-46ad-be73-e4230258d53a
Filesize745B
MD5961159179455b8fe09fb51b1dde0cf78
SHA12a510a965e07fb42e40f2136f4641b7b29783559
SHA25655755cba50f59935fbd6690935d7e3dc7610868157b18adb3e9c2437c617f08b
SHA51204e2e3fd909b1a57c04ea5fbcf517e5c05ea778d135687078472ffe4056973a2a5a5e38407997e465ba6edfb4867a6d3389bd7af359dba03d2eac535dee1c7dd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\efc7ddbb-f5c4-4298-8339-7aafa5bf2fc7
Filesize10KB
MD53647a1371afa598df9593ac48a8fa54c
SHA1599e25b7d44f52268fa83b120d37978f40f74f8d
SHA256eebda44814dd1fb85dc15f1a92fd0048471ec6734fcfda0fb3979ffa832daa8b
SHA512a79f3e38e58e6de73afe826d4a96d0cb82cd1b6e699c2c0e3bef98ace8545ae77c1f078e9e5c5372f554fb4fc807c34ca211110cab1ba2e72a114fcc0caa494b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD565bc4db92034bd0444a2ce489e2fd541
SHA152d45cc2552ee3973da522639c80785c014022c8
SHA256ebdee91f0c9e0a93c8b9ea70ef680f770a5bc1c382919ddc11ecc934e9949f5c
SHA512209a277fa41237661052a3cd08d8625f89ce25cc2357d1e97bde8b91a600cd1a88efa8cc4d3a2b9a20a4624ab6b7c7e9758725d462af008f27d8db150e2e49b2
-
Filesize
6KB
MD5fe846d48d3920112b4400ca5cbdf5bf0
SHA1052333fe1c1537afb98b249756163caa6918bbad
SHA25643b731ae8bc1f78d50b6dbb3c05549216b0d809d78ea9ce1dbc1c8dd5a23b706
SHA512f7fdd661c949adfc63d6d444e2d91ddfc4a4b9c60c8349793fb0bb5e950111202814422a508512cd04c2a630b26447b50955dc402a52c24102899e0fb9262765
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD50b068c73ce23eee0e0f87b3edb7786d1
SHA165c6f1a10e8608f621cb9dc0c267059c02f6f298
SHA25680214fba2cabf120aab9fd9f020baf78ae455891e4a621091a4f8708b4eb1c37
SHA5121e75fbc19fbb3dc6d5ff557697561ed091040b10edf1cf1c345acc09129b64d99c85017f58e425089338a91ca0a27e6456f783a8dd48ebbf1e5bbc015d9bad38
-
Filesize
2.6MB
MD51e79d4fce2c654ed8d56747616ec0746
SHA173d8717f19ac08c494ef7a533dbdec599c9a644d
SHA25629425b85ecbb9a2009dfe1f482d1a29d65d991eec1f69f7386c782bbc54980d0
SHA512bc44178b2ae8f8d185f800bd05247080bbd9b7f4c7da587f0c9d2e205358d47e57cb5b4fc03b08f17115bf89fa33cbff5d137f8b82230d4d694f16016cec4ce5