Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2024 22:04

General

  • Target

    file.exe

  • Size

    2.9MB

  • MD5

    f45da90410f7d099ab3bd1589a039a79

  • SHA1

    a7effa8c1fc9b88eea3498ed50011d7a14a7e617

  • SHA256

    4fb84272045fc39952401061f10a2ba439d2f2a7c6e30f2448b757caf731df19

  • SHA512

    577ae3d2c9f46c57ba71a9437fdf47deac865605b31f0a0a2a2caef90a4346bfa12c0894fe9c3a8dc7a602516bde33d58d483a8c5547452397f15a824c07a864

  • SSDEEP

    49152:LcjBVZDZYhTklsZHUwGemMSwvMGKuFk2PGHqv:aBVZD+NklXwG5Mf73eTHqv

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://shineugler.biz/api

https://tacitglibbr.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://shineugler.biz/api

https://tacitglibbr.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • DCRat payload 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 30 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 45 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe
        "C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe
          "C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4892
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\8NMdxTHKaozS.bat" "
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2084
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4048
            • C:\Windows\SysWOW64\PING.EXE
              ping -n 5 localhost
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:4440
            • C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe
              "C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2544
              • C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe
                "C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5708
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iT7YNmmQSt.bat"
                  8⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5868
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:5892
                  • C:\Windows\SysWOW64\PING.EXE
                    ping -n 10 localhost
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:5900
                  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\firefox.exe
                    "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\firefox.exe"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5976
                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\firefox.exe
                      "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\firefox.exe"
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6008
      • C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe
        "C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
      • C:\Users\Admin\AppData\Local\Temp\1015783001\aeb50e1a85.exe
        "C:\Users\Admin\AppData\Local\Temp\1015783001\aeb50e1a85.exe"
        3⤵
        • Enumerates VirtualBox registry keys
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4996
      • C:\Users\Admin\AppData\Local\Temp\1015784001\89bc2f79f3.exe
        "C:\Users\Admin\AppData\Local\Temp\1015784001\89bc2f79f3.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2480
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015784001\89bc2f79f3.exe" & rd /s /q "C:\ProgramData\RQQ9RQIEU37Q" & exit
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1128
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:2960
      • C:\Users\Admin\AppData\Local\Temp\1015785001\d4ff2c29de.exe
        "C:\Users\Admin\AppData\Local\Temp\1015785001\d4ff2c29de.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3604
      • C:\Users\Admin\AppData\Local\Temp\1015786001\ecc9b61e59.exe
        "C:\Users\Admin\AppData\Local\Temp\1015786001\ecc9b61e59.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Users\Admin\AppData\Local\Temp\9C0HZT123N1YEFLFJV3A.exe
          "C:\Users\Admin\AppData\Local\Temp\9C0HZT123N1YEFLFJV3A.exe"
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Windows security modification
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3248
        • C:\Users\Admin\AppData\Local\Temp\Z9URBIRX5F45CVP96HOZ1WDVBDR.exe
          "C:\Users\Admin\AppData\Local\Temp\Z9URBIRX5F45CVP96HOZ1WDVBDR.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3748
      • C:\Users\Admin\AppData\Local\Temp\1015787001\f0b78dd496.exe
        "C:\Users\Admin\AppData\Local\Temp\1015787001\f0b78dd496.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2852
      • C:\Users\Admin\AppData\Local\Temp\1015788001\4071d7d8e0.exe
        "C:\Users\Admin\AppData\Local\Temp\1015788001\4071d7d8e0.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3816
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4212
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4388
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4468
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
            PID:4540
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4552
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.0.1012420676\840734193" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1192 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d09f67b2-f27c-4c57-a3d9-7386e6321926} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 1312 11ad6958 gpu
                6⤵
                  PID:1564
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.1.1553442855\1170313248" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59d8befd-8944-4d73-801d-ec3ac81f415a} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 1524 11a03258 socket
                  6⤵
                    PID:4964
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.2.897129078\1446621691" -childID 1 -isForBrowser -prefsHandle 2088 -prefMapHandle 2084 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20a25718-3bd6-47d0-9ed4-688bb9f89948} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 2100 1a9b8858 tab
                    6⤵
                      PID:1088
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.3.908885415\1874138794" -childID 2 -isForBrowser -prefsHandle 2948 -prefMapHandle 2944 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4a3d43e-0add-4e24-9100-e1030c17c225} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 2960 1bbaf258 tab
                      6⤵
                        PID:2948
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.4.315448619\269353944" -childID 3 -isForBrowser -prefsHandle 3652 -prefMapHandle 3664 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4161ccee-e73d-4530-b68b-0734501176a1} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3680 1eeab558 tab
                        6⤵
                          PID:5052
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.5.1564767969\1470258900" -childID 4 -isForBrowser -prefsHandle 3832 -prefMapHandle 3836 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a2aa70a-a294-43ef-9316-eb333d532c73} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3820 e2d858 tab
                          6⤵
                            PID:1728
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.6.690159159\794030788" -childID 5 -isForBrowser -prefsHandle 3964 -prefMapHandle 3968 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0993c661-8b8e-4db7-927f-500477bd38b8} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3952 1c0ad258 tab
                            6⤵
                              PID:2072
                      • C:\Users\Admin\AppData\Local\Temp\1015789001\c27c3960cf.exe
                        "C:\Users\Admin\AppData\Local\Temp\1015789001\c27c3960cf.exe"
                        3⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4688
                      • C:\Users\Admin\AppData\Local\Temp\1015790001\975ecceb8d.exe
                        "C:\Users\Admin\AppData\Local\Temp\1015790001\975ecceb8d.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3084
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                          4⤵
                          • Loads dropped DLL
                          PID:880
                          • C:\Windows\system32\mode.com
                            mode 65,10
                            5⤵
                              PID:3780
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3856
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_7.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3824
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_6.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3732
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_5.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4180
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_4.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3944
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_3.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3992
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_2.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4036
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_1.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1600
                            • C:\Windows\system32\attrib.exe
                              attrib +H "in.exe"
                              5⤵
                              • Views/modifies file attributes
                              PID:3756
                            • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                              "in.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:4188
                              • C:\Windows\system32\attrib.exe
                                attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                6⤵
                                • Views/modifies file attributes
                                PID:4204
                              • C:\Windows\system32\attrib.exe
                                attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                6⤵
                                • Views/modifies file attributes
                                PID:1820
                              • C:\Windows\system32\schtasks.exe
                                schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                6⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:4236
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell ping 127.0.0.1; del in.exe
                                6⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4220
                                • C:\Windows\system32\PING.EXE
                                  "C:\Windows\system32\PING.EXE" 127.0.0.1
                                  7⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:4536
                        • C:\Users\Admin\AppData\Local\Temp\1015791001\f5ae09423b.exe
                          "C:\Users\Admin\AppData\Local\Temp\1015791001\f5ae09423b.exe"
                          3⤵
                          • Executes dropped EXE
                          PID:1160
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {C5C06D1E-1D61-45BA-8AFF-EE22E6FA318D} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
                      1⤵
                      • Loads dropped DLL
                      PID:2036
                      • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2932
                        • C:\Windows\explorer.exe
                          explorer.exe
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1632
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                          3⤵
                          • Drops file in System32 directory
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3616
                          • C:\Windows\system32\PING.EXE
                            "C:\Windows\system32\PING.EXE" 127.1.10.1
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:3564
                      • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:1916
                        • C:\Windows\explorer.exe
                          explorer.exe
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3872
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                          3⤵
                          • Drops file in System32 directory
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4696
                          • C:\Windows\system32\PING.EXE
                            "C:\Windows\system32\PING.EXE" 127.1.10.1
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2148

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Program Files (x86)\Windows NT\TableTextService\de-DE\firefox.exe

                      Filesize

                      2.8MB

                      MD5

                      985a071afd1a3065488a92540c3bee93

                      SHA1

                      f5282fdbd3fbe681dd8485f37d6ba3d5ce59079f

                      SHA256

                      464e8781560aecb3764b8afad710aed0b8087b362e180bc3b18c84be5ef38089

                      SHA512

                      ff76a68533f86b2872c19722f8adb3fcba5f6bc802caa4dc6543447141b78d60db686d481a0e168afd58516d009fe551ee3113de6b3eb174eeee736cf304dd60

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      cbf5edb3181972c811d11976686c1e52

                      SHA1

                      914291bcb7461a6430ecb32c70b9e50887b45224

                      SHA256

                      8605f321e53076b3a2ec2575d29234ff3877ffa383329eaa9bd0eb454b675ed5

                      SHA512

                      a52362ce5a2b75fa96a83bfbbd1db4da00f7c801afe0cfaccab022577b5699c74e268f12dcb2ad39d876847a95c0092e1170bd5b5dcc16857b2fc43cb98e0a82

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      8ece7eb3e7274557c6d53609207b002a

                      SHA1

                      e4010b4f1de94c335ee6aa73e3caf0ef3206293d

                      SHA256

                      05ac7591b669ec8e97c223306d0d16887236dfcf8a5b45569249493c1def5112

                      SHA512

                      67e8d61d700247f3873930f39434f767547bf0cc01e221ed2c200fb7e415d27f7fd05c4b43a5c5ac244b93d4a63f249d1ff4dd5d2560514b0cd1a8982905d8eb

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      4cc07a5e1735be59089ec9d4a01eb49b

                      SHA1

                      5a3951b710800475755df4adc735f67fb8f0b56c

                      SHA256

                      efe16e5e3710b966106d1ba73a47461c493f65437509940a165e2eb1af8f75bf

                      SHA512

                      e095d36bebc24eaecaf0d6663cdb7ce5dd132d99c5bad79ecb3a73deabc185bdfeb009267afc069c2a0ae70b522767df3375fcbf4bcb21cbc4aacc57492a9599

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      24KB

                      MD5

                      4fe52d8fc4149ce6bfa090adc2c1afd7

                      SHA1

                      b026936b9d76ec04bc3a0e82496fb2c86ecf3b24

                      SHA256

                      0bbb886c7197dbe61e003d07b53dbb24b75b57ffce0253f396d2c4a9c19caf44

                      SHA512

                      b17c1861d8ae8be02b05f2877775b5056747352c6d51712a2a1e9889f194c5202c310c89ce5e0a216245ae95b2b54a86f5d20800eb1e7d6fedd7d65a6e6ed0aa

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                    • C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe

                      Filesize

                      2.8MB

                      MD5

                      0dad190f420a0a09ed8c262ca18b1097

                      SHA1

                      b97535bf2960278b19bda8cad9e885b8eefbdc85

                      SHA256

                      29e1e95110c03e84720e213a2bb0dcdff95af85a8a894d71518e06c62131e64a

                      SHA512

                      8ae92676fc5539899414f0a70cba1ed01685b30af9002c68114720d6a7213e4e9c2368e17717c4e3e02650781a022001e4a2e43f83afbd709e7f1ab81003b646

                    • C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe

                      Filesize

                      87KB

                      MD5

                      65ca33d1c759d3d8eb1d015d26479271

                      SHA1

                      2b0992769c879e7e22f9e3a18f3d1fb15e0870aa

                      SHA256

                      69bdb80ed6cbffe24e06d5bccea27aa1f6fbca4540e2bc191c85f7a2e91400ea

                      SHA512

                      d18f975b4e1d387f88ef1e490ac6456ff19c8138bcde522ccf3302fe6d2199ccfc99ab894ad968af8c76ca412caf9d2b069f6444960c26a057cddb44449be2e9

                    • C:\Users\Admin\AppData\Local\Temp\1015783001\aeb50e1a85.exe

                      Filesize

                      4.2MB

                      MD5

                      6a94a20c20e2a75fa16041e1175793e7

                      SHA1

                      40d8df3d0bdfef2eaccb7b14d62f78c9eff5c989

                      SHA256

                      102d2c6aa1e5b2a0d91df5f7dcdf0c8a0393595578ecb714669ef85e1319104d

                      SHA512

                      24250549fc70ffcbccb64eb5a1634005084bdfdccaeff892b6460ef10837d622bcbc817983c922516324b868c935f7d6277b8d919f2abeaf41b4156f948997c1

                    • C:\Users\Admin\AppData\Local\Temp\1015784001\89bc2f79f3.exe

                      Filesize

                      384KB

                      MD5

                      dfd5f78a711fa92337010ecc028470b4

                      SHA1

                      1a389091178f2be8ce486cd860de16263f8e902e

                      SHA256

                      da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

                      SHA512

                      a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

                    • C:\Users\Admin\AppData\Local\Temp\1015785001\d4ff2c29de.exe

                      Filesize

                      1.7MB

                      MD5

                      6c1d0dabe1ec5e928f27b3223f25c26b

                      SHA1

                      e25ab704a6e9b3e4c30a6c1f7043598a13856ad9

                      SHA256

                      92228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d

                      SHA512

                      3a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9

                    • C:\Users\Admin\AppData\Local\Temp\1015786001\ecc9b61e59.exe

                      Filesize

                      1.8MB

                      MD5

                      1d13d83ba0b9e54307060da3ad2c16bf

                      SHA1

                      45fe957170c36b1704c25ff65d59dd8bbe6894cd

                      SHA256

                      cce6c6f51a01ff3662b263cd464e41b163db9590453603e2c8b5dee39d5f94d0

                      SHA512

                      803e1b9587fc7aab36c96d52fe901fa6dbe0523aa46da23afb0bd50f7ebcbe5bfd9793ac61cbdd4d228159786d240d5161ff80a5e445eaa00fc77cdf455eb526

                    • C:\Users\Admin\AppData\Local\Temp\1015787001\f0b78dd496.exe

                      Filesize

                      1.7MB

                      MD5

                      228bc900c337f34da99576e917296e62

                      SHA1

                      0f6393c99373b170166bf3e563d3380914d8afe3

                      SHA256

                      9b4a6a847a0e8ea430a26136519ab7bf301f6b6c3a162d8443300d5e6f50cb86

                      SHA512

                      7c5a8bd94c9cca5267aafd0284573843e77d8cb9294131396a6b434af8d8e489ca33374d718fc45edb7e412c0f8d6832f8a936374a4f6612f2e9395377cd4382

                    • C:\Users\Admin\AppData\Local\Temp\1015788001\4071d7d8e0.exe

                      Filesize

                      950KB

                      MD5

                      a0b7a28c8ae27509d5fdfe9e6582705c

                      SHA1

                      3bcf1aa52032034e3a4968fd2633cabd3b2c2e08

                      SHA256

                      696495731d4eb0f28bc4678f8ea8c20a9c1caf16a460405fea538893a792fd05

                      SHA512

                      f197738e61660e4497bd1cc3f3c1b70ebfc403948208cb570b292d3fba78d0ca27487b4784f6680bf219678e861d5b489bc2858f5d99f349c65b6e568dc3c63f

                    • C:\Users\Admin\AppData\Local\Temp\1015790001\975ecceb8d.exe

                      Filesize

                      4.2MB

                      MD5

                      3a425626cbd40345f5b8dddd6b2b9efa

                      SHA1

                      7b50e108e293e54c15dce816552356f424eea97a

                      SHA256

                      ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                      SHA512

                      a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                    • C:\Users\Admin\AppData\Local\Temp\1015791001\f5ae09423b.exe

                      Filesize

                      710KB

                      MD5

                      28e568616a7b792cac1726deb77d9039

                      SHA1

                      39890a418fb391b823ed5084533e2e24dff021e1

                      SHA256

                      9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                      SHA512

                      85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                    • C:\Users\Admin\AppData\Local\Temp\8NMdxTHKaozS.bat

                      Filesize

                      178B

                      MD5

                      cbc4b3786e796bd08c068c1a28ee3189

                      SHA1

                      0c0ff0a0fb770e612b17eac7a075b845b05ed6f6

                      SHA256

                      39d97ac84fd89433d120a774e88c62290c63122d1e85a6203bf1c22134b85588

                      SHA512

                      78c32ad19102b1e5bb2090a9b396062377c906c66620a0ff030bff5d650485d1c95fc6113fd59e9e6297a53e90e36136d04f61d53ba25513be997e5aca3a5ed5

                    • C:\Users\Admin\AppData\Local\Temp\Cab1DC0.tmp

                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                    • C:\Users\Admin\AppData\Local\Temp\Tar1DE2.tmp

                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                      Filesize

                      2.9MB

                      MD5

                      f45da90410f7d099ab3bd1589a039a79

                      SHA1

                      a7effa8c1fc9b88eea3498ed50011d7a14a7e617

                      SHA256

                      4fb84272045fc39952401061f10a2ba439d2f2a7c6e30f2448b757caf731df19

                      SHA512

                      577ae3d2c9f46c57ba71a9437fdf47deac865605b31f0a0a2a2caef90a4346bfa12c0894fe9c3a8dc7a602516bde33d58d483a8c5547452397f15a824c07a864

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

                      Filesize

                      1.6MB

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe

                      Filesize

                      458KB

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

                      Filesize

                      1.7MB

                      MD5

                      0dc4014facf82aa027904c1be1d403c1

                      SHA1

                      5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                      SHA256

                      a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                      SHA512

                      cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip

                      Filesize

                      3.3MB

                      MD5

                      cea368fc334a9aec1ecff4b15612e5b0

                      SHA1

                      493d23f72731bb570d904014ffdacbba2334ce26

                      SHA256

                      07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                      SHA512

                      bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                    • C:\Users\Admin\AppData\Local\Temp\main\file.bin

                      Filesize

                      3.3MB

                      MD5

                      045b0a3d5be6f10ddf19ae6d92dfdd70

                      SHA1

                      0387715b6681d7097d372cd0005b664f76c933c7

                      SHA256

                      94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                      SHA512

                      58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                    • C:\Users\Admin\AppData\Local\Temp\main\main.bat

                      Filesize

                      440B

                      MD5

                      3626532127e3066df98e34c3d56a1869

                      SHA1

                      5fa7102f02615afde4efd4ed091744e842c63f78

                      SHA256

                      2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                      SHA512

                      dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\135YZCAW50A2PEGOSEKS.temp

                      Filesize

                      7KB

                      MD5

                      f4514a01bc81b515f3ad62e9efdabd1e

                      SHA1

                      281476fce646e02f48d8a511c0a53190061b70d7

                      SHA256

                      f9f7f2a71e3310876e17c1d67563b00c9c2a8bf09b902ec28adf8545e1fb7735

                      SHA512

                      d190951d4804dc354bb2f893286e5a7109b98667b68cc4adc9dc14fcd24c109e7ff94fe94de7d453b98ee86ecc155902ae2db1584d6cb3f0ac31ff0a62103c39

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin

                      Filesize

                      2KB

                      MD5

                      ac913f7d0ec3b42c219c70280dc8f089

                      SHA1

                      1df8578ca63fbf0c57124b0d8e4ee2781754362f

                      SHA256

                      5028676a1f3b9c4b2b0f97b9492cd0380ecd633a37ab854c5151d5d826ca860b

                      SHA512

                      cd1ea9d86f0bf6c008d0ea1a72594b3c82cce0f4e212d356c4e2693f1898354619fd15f28009a3cf0e5b63716ac9516b591316a499b76e6ff378917ea6ae5d36

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\1fbdf600-fd85-46ad-be73-e4230258d53a

                      Filesize

                      745B

                      MD5

                      961159179455b8fe09fb51b1dde0cf78

                      SHA1

                      2a510a965e07fb42e40f2136f4641b7b29783559

                      SHA256

                      55755cba50f59935fbd6690935d7e3dc7610868157b18adb3e9c2437c617f08b

                      SHA512

                      04e2e3fd909b1a57c04ea5fbcf517e5c05ea778d135687078472ffe4056973a2a5a5e38407997e465ba6edfb4867a6d3389bd7af359dba03d2eac535dee1c7dd

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\efc7ddbb-f5c4-4298-8339-7aafa5bf2fc7

                      Filesize

                      10KB

                      MD5

                      3647a1371afa598df9593ac48a8fa54c

                      SHA1

                      599e25b7d44f52268fa83b120d37978f40f74f8d

                      SHA256

                      eebda44814dd1fb85dc15f1a92fd0048471ec6734fcfda0fb3979ffa832daa8b

                      SHA512

                      a79f3e38e58e6de73afe826d4a96d0cb82cd1b6e699c2c0e3bef98ace8545ae77c1f078e9e5c5372f554fb4fc807c34ca211110cab1ba2e72a114fcc0caa494b

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js

                      Filesize

                      7KB

                      MD5

                      65bc4db92034bd0444a2ce489e2fd541

                      SHA1

                      52d45cc2552ee3973da522639c80785c014022c8

                      SHA256

                      ebdee91f0c9e0a93c8b9ea70ef680f770a5bc1c382919ddc11ecc934e9949f5c

                      SHA512

                      209a277fa41237661052a3cd08d8625f89ce25cc2357d1e97bde8b91a600cd1a88efa8cc4d3a2b9a20a4624ab6b7c7e9758725d462af008f27d8db150e2e49b2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js

                      Filesize

                      6KB

                      MD5

                      fe846d48d3920112b4400ca5cbdf5bf0

                      SHA1

                      052333fe1c1537afb98b249756163caa6918bbad

                      SHA256

                      43b731ae8bc1f78d50b6dbb3c05549216b0d809d78ea9ce1dbc1c8dd5a23b706

                      SHA512

                      f7fdd661c949adfc63d6d444e2d91ddfc4a4b9c60c8349793fb0bb5e950111202814422a508512cd04c2a630b26447b50955dc402a52c24102899e0fb9262765

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      4KB

                      MD5

                      0b068c73ce23eee0e0f87b3edb7786d1

                      SHA1

                      65c6f1a10e8608f621cb9dc0c267059c02f6f298

                      SHA256

                      80214fba2cabf120aab9fd9f020baf78ae455891e4a621091a4f8708b4eb1c37

                      SHA512

                      1e75fbc19fbb3dc6d5ff557697561ed091040b10edf1cf1c345acc09129b64d99c85017f58e425089338a91ca0a27e6456f783a8dd48ebbf1e5bbc015d9bad38

                    • \Users\Admin\AppData\Local\Temp\9C0HZT123N1YEFLFJV3A.exe

                      Filesize

                      2.6MB

                      MD5

                      1e79d4fce2c654ed8d56747616ec0746

                      SHA1

                      73d8717f19ac08c494ef7a533dbdec599c9a644d

                      SHA256

                      29425b85ecbb9a2009dfe1f482d1a29d65d991eec1f69f7386c782bbc54980d0

                      SHA512

                      bc44178b2ae8f8d185f800bd05247080bbd9b7f4c7da587f0c9d2e205358d47e57cb5b4fc03b08f17115bf89fa33cbff5d137f8b82230d4d694f16016cec4ce5

                    • memory/1520-23-0x0000000000390000-0x00000000006B3000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1520-17-0x0000000000390000-0x00000000006B3000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1520-1-0x00000000777A0000-0x00000000777A2000-memory.dmp

                      Filesize

                      8KB

                    • memory/1520-2-0x0000000000391000-0x00000000003BF000-memory.dmp

                      Filesize

                      184KB

                    • memory/1520-3-0x0000000000390000-0x00000000006B3000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1520-4-0x0000000000390000-0x00000000006B3000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1520-0-0x0000000000390000-0x00000000006B3000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1520-5-0x0000000000390000-0x00000000006B3000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1520-19-0x0000000006E90000-0x00000000071B3000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1520-18-0x0000000006E90000-0x00000000071B3000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1816-29301-0x0000000006260000-0x000000000650C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/1816-29271-0x0000000000170000-0x000000000060B000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/1816-29330-0x0000000006260000-0x00000000068E3000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/1816-29305-0x0000000000170000-0x000000000060B000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/1816-29494-0x0000000006260000-0x00000000068E3000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/1816-29304-0x0000000006260000-0x000000000650C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2544-29716-0x0000000000DD0000-0x00000000010A8000-memory.dmp

                      Filesize

                      2.8MB

                    • memory/2544-29717-0x0000000005360000-0x000000000557C000-memory.dmp

                      Filesize

                      2.1MB

                    • memory/2676-85-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-69-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-44-0x0000000000C60000-0x0000000000F3C000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/2676-45-0x0000000005270000-0x000000000542E000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-53-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-51-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-49-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-47-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-46-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-107-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-105-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-103-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-101-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-99-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-97-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-95-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-93-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-55-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-91-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-89-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-57-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-87-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-83-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-81-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-59-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-61-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-63-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-65-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-67-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-79-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-77-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-75-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-73-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2676-71-0x0000000005270000-0x0000000005428000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2852-29293-0x0000000000290000-0x0000000000913000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/2852-29291-0x0000000000290000-0x0000000000913000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/2920-29009-0x0000000006AF0000-0x0000000007728000-memory.dmp

                      Filesize

                      12.2MB

                    • memory/2920-43-0x0000000000810000-0x0000000000B33000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2920-29351-0x0000000006380000-0x000000000662C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2920-22-0x0000000000810000-0x0000000000B33000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2920-24-0x0000000000811000-0x000000000083F000-memory.dmp

                      Filesize

                      184KB

                    • memory/2920-29166-0x0000000006380000-0x000000000680B000-memory.dmp

                      Filesize

                      4.5MB

                    • memory/2920-28978-0x0000000000810000-0x0000000000B33000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2920-29352-0x0000000006380000-0x000000000662C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2920-28980-0x0000000000810000-0x0000000000B33000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2920-29332-0x0000000006AF0000-0x0000000007173000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/2920-29302-0x0000000006380000-0x000000000681B000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2920-29168-0x0000000006380000-0x000000000680B000-memory.dmp

                      Filesize

                      4.5MB

                    • memory/2920-25-0x0000000000810000-0x0000000000B33000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2920-29169-0x0000000006AF0000-0x0000000007728000-memory.dmp

                      Filesize

                      12.2MB

                    • memory/2920-29290-0x0000000006AF0000-0x0000000007173000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/2920-29276-0x0000000006380000-0x000000000680B000-memory.dmp

                      Filesize

                      4.5MB

                    • memory/2920-29594-0x0000000006380000-0x000000000662C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2920-29269-0x0000000006380000-0x000000000681B000-memory.dmp

                      Filesize

                      4.6MB

                    • memory/2920-28-0x0000000000810000-0x0000000000B33000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2920-28976-0x0000000000810000-0x0000000000B33000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2920-27-0x0000000000810000-0x0000000000B33000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/3248-29520-0x00000000012D0000-0x000000000157C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/3248-29306-0x00000000012D0000-0x000000000157C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/3248-29322-0x00000000012D0000-0x000000000157C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/3248-29321-0x00000000012D0000-0x000000000157C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/3248-29363-0x00000000012D0000-0x000000000157C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/3604-29275-0x00000000010E0000-0x000000000156B000-memory.dmp

                      Filesize

                      4.5MB

                    • memory/3604-29170-0x00000000010E0000-0x000000000156B000-memory.dmp

                      Filesize

                      4.5MB

                    • memory/3616-29664-0x000000001B740000-0x000000001BA22000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/3616-29665-0x0000000001E70000-0x0000000001E78000-memory.dmp

                      Filesize

                      32KB

                    • memory/3748-29331-0x0000000000170000-0x00000000007F3000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/3748-29334-0x0000000000170000-0x00000000007F3000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/4220-29614-0x00000000022C0000-0x00000000022C8000-memory.dmp

                      Filesize

                      32KB

                    • memory/4220-29613-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/4688-29355-0x0000000000890000-0x0000000000B3C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/4688-29356-0x0000000000890000-0x0000000000B3C000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/4696-105078-0x0000000001C20000-0x0000000001C28000-memory.dmp

                      Filesize

                      32KB

                    • memory/4696-105077-0x000000001B710000-0x000000001B9F2000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/4756-28979-0x0000000000150000-0x0000000000156000-memory.dmp

                      Filesize

                      24KB

                    • memory/4756-28977-0x0000000001180000-0x0000000001198000-memory.dmp

                      Filesize

                      96KB

                    • memory/4892-29627-0x0000000005CC0000-0x0000000005DA6000-memory.dmp

                      Filesize

                      920KB

                    • memory/4892-29011-0x0000000004CF0000-0x0000000004DB4000-memory.dmp

                      Filesize

                      784KB

                    • memory/4892-29008-0x0000000000400000-0x0000000000460000-memory.dmp

                      Filesize

                      384KB

                    • memory/4996-29264-0x0000000000FE0000-0x0000000001C18000-memory.dmp

                      Filesize

                      12.2MB

                    • memory/4996-29199-0x0000000000FE0000-0x0000000001C18000-memory.dmp

                      Filesize

                      12.2MB

                    • memory/4996-29012-0x0000000000FE0000-0x0000000001C18000-memory.dmp

                      Filesize

                      12.2MB

                    • memory/5708-67400-0x0000000000080000-0x0000000000100000-memory.dmp

                      Filesize

                      512KB

                    • memory/5976-67416-0x0000000001190000-0x0000000001468000-memory.dmp

                      Filesize

                      2.8MB

                    • memory/6008-105055-0x0000000000400000-0x0000000000480000-memory.dmp

                      Filesize

                      512KB