Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
16/12/2024, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe
Resource
win7-20241023-en
General
-
Target
276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe
-
Size
2.8MB
-
MD5
637ae46f64ec4068089966631b40cc63
-
SHA1
95d04f52347e6f7e07cc908072bfc18d73af6b43
-
SHA256
276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28
-
SHA512
111d0b5a6e4cd748890d951f9d2f8619fa2925b08cfe4976067404027c82730db5df1cf79fe3629ced8e67292f144f49f6f14d4968796b653b7d3f80faa5f94b
-
SSDEEP
49152:UJIcYo9sxmjkNIOnNsGy8F2X1+OhbCqfXdVxo6g1sN3q:6YoexaanNxy8F2X1+CCuXd7JmQ
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://tacitglibbr.biz/api
Extracted
lumma
https://tacitglibbr.biz/api
https://shineugler.biz/api
Signatures
-
Amadey family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 8656K23GM02ZDBOH6TG8KUEPX9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 8656K23GM02ZDBOH6TG8KUEPX9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 8656K23GM02ZDBOH6TG8KUEPX9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 8656K23GM02ZDBOH6TG8KUEPX9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 43c92e1cee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 43c92e1cee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 8656K23GM02ZDBOH6TG8KUEPX9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 8656K23GM02ZDBOH6TG8KUEPX9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 43c92e1cee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 43c92e1cee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 43c92e1cee.exe -
Stealc family
-
DCRat payload 2 IoCs
resource yara_rule behavioral1/memory/4540-67384-0x0000000000400000-0x0000000000480000-memory.dmp family_dcrat_v2 behavioral1/memory/3608-105042-0x0000000000080000-0x0000000000100000-memory.dmp family_dcrat_v2 -
Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 8525b483c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF e00b0fe887.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 73febd80ca.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8656K23GM02ZDBOH6TG8KUEPX9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e00b0fe887.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8525b483c6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a166403d61.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 43c92e1cee.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 158ef79638.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e00b0fe887.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8525b483c6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 43c92e1cee.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 73febd80ca.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a166403d61.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8656K23GM02ZDBOH6TG8KUEPX9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8525b483c6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 73febd80ca.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 158ef79638.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e00b0fe887.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 43c92e1cee.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 158ef79638.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a166403d61.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8656K23GM02ZDBOH6TG8KUEPX9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe -
Executes dropped EXE 30 IoCs
pid Process 976 skotes.exe 1852 IQ7ux2z.exe 4800 sUSFJjY.exe 4936 8525b483c6.exe 4968 IQ7ux2z.exe 580 1c46c1cd3d.exe 4524 73febd80ca.exe 2900 a166403d61.exe 2200 7260ec3afe.exe 2488 8656K23GM02ZDBOH6TG8KUEPX9.exe 3336 JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe 4484 43c92e1cee.exe 4936 158ef79638.exe 2380 110b7a1e35.exe 3532 7z.exe 3620 7z.exe 3800 7z.exe 3892 7z.exe 4008 7z.exe 3944 7z.exe 2592 7z.exe 4284 7z.exe 4060 in.exe 4264 Intel_PTT_EK_Recertification.exe 1932 e00b0fe887.exe 1728 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 3344 firefox.exe 3608 firefox.exe 3864 Intel_PTT_EK_Recertification.exe -
Identifies Wine through registry keys 2 TTPs 10 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 8525b483c6.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 158ef79638.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 73febd80ca.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine a166403d61.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 8656K23GM02ZDBOH6TG8KUEPX9.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 43c92e1cee.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine e00b0fe887.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe -
Loads dropped DLL 45 IoCs
pid Process 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 976 skotes.exe 976 skotes.exe 976 skotes.exe 1852 IQ7ux2z.exe 976 skotes.exe 976 skotes.exe 976 skotes.exe 976 skotes.exe 976 skotes.exe 4524 73febd80ca.exe 4524 73febd80ca.exe 4524 73febd80ca.exe 976 skotes.exe 976 skotes.exe 976 skotes.exe 976 skotes.exe 976 skotes.exe 3468 cmd.exe 3532 7z.exe 3468 cmd.exe 3620 7z.exe 3468 cmd.exe 3800 7z.exe 3468 cmd.exe 3892 7z.exe 3468 cmd.exe 4008 7z.exe 3468 cmd.exe 3944 7z.exe 3468 cmd.exe 2592 7z.exe 3468 cmd.exe 4284 7z.exe 3468 cmd.exe 3468 cmd.exe 3756 taskeng.exe 3756 taskeng.exe 976 skotes.exe 976 skotes.exe 3964 cmd.exe 2340 cmd.exe 3344 firefox.exe 3756 taskeng.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 8656K23GM02ZDBOH6TG8KUEPX9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 8656K23GM02ZDBOH6TG8KUEPX9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 43c92e1cee.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\73febd80ca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015870001\\73febd80ca.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\a166403d61.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015871001\\a166403d61.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\7260ec3afe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015872001\\7260ec3afe.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\43c92e1cee.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015873001\\43c92e1cee.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0007000000019284-29272.dat autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
pid Process 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 976 skotes.exe 4936 8525b483c6.exe 4524 73febd80ca.exe 2900 a166403d61.exe 2488 8656K23GM02ZDBOH6TG8KUEPX9.exe 3336 JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe 4484 43c92e1cee.exe 4936 158ef79638.exe 1932 e00b0fe887.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1852 set thread context of 4968 1852 IQ7ux2z.exe 36 PID 4264 set thread context of 4332 4264 Intel_PTT_EK_Recertification.exe 94 PID 1728 set thread context of 4540 1728 JrCklm0E5O0P77D.exe 104 PID 3344 set thread context of 3608 3344 firefox.exe 110 PID 3864 set thread context of 4268 3864 Intel_PTT_EK_Recertification.exe 112 -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\0fc223bdacedc3 JrCklm0E5O0P77D.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\firefox.exe JrCklm0E5O0P77D.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\0fc223bdacedc3 JrCklm0E5O0P77D.exe File created C:\Program Files (x86)\Microsoft Office\firefox.exe JrCklm0E5O0P77D.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\BitLockerDiscoveryVolumeContents\firefox.exe JrCklm0E5O0P77D.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\0fc223bdacedc3 JrCklm0E5O0P77D.exe File created C:\Windows\Prefetch\lsass.exe JrCklm0E5O0P77D.exe File created C:\Windows\Prefetch\6203df4a6bafc7 JrCklm0E5O0P77D.exe File created C:\Windows\Tasks\skotes.job 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe File created C:\Windows\assembly\temp\WmiPrvSE.exe JrCklm0E5O0P77D.exe File opened for modification C:\Windows\assembly\temp\WmiPrvSE.exe JrCklm0E5O0P77D.exe File created C:\Windows\assembly\temp\24dbde2999530e JrCklm0E5O0P77D.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 34 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQ7ux2z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8525b483c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c46c1cd3d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43c92e1cee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JrCklm0E5O0P77D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 7260ec3afe.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 7260ec3afe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JrCklm0E5O0P77D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQ7ux2z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73febd80ca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e00b0fe887.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7260ec3afe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 158ef79638.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 110b7a1e35.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a166403d61.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8656K23GM02ZDBOH6TG8KUEPX9.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1636 PING.EXE 4364 PING.EXE 3612 PING.EXE 4024 powershell.exe 2232 PING.EXE 1144 powershell.exe 4336 PING.EXE 4656 powershell.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1c46c1cd3d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1c46c1cd3d.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2760 timeout.exe -
Kills process with taskkill 5 IoCs
pid Process 3764 taskkill.exe 3848 taskkill.exe 3940 taskkill.exe 1740 taskkill.exe 3676 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings firefox.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 1c46c1cd3d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 1c46c1cd3d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 1c46c1cd3d.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 4336 PING.EXE 1636 PING.EXE 4364 PING.EXE 3612 PING.EXE 2232 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1252 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 976 skotes.exe 4936 8525b483c6.exe 4936 8525b483c6.exe 4936 8525b483c6.exe 4936 8525b483c6.exe 4936 8525b483c6.exe 4936 8525b483c6.exe 4524 73febd80ca.exe 580 1c46c1cd3d.exe 4524 73febd80ca.exe 4524 73febd80ca.exe 4524 73febd80ca.exe 4524 73febd80ca.exe 2900 a166403d61.exe 2488 8656K23GM02ZDBOH6TG8KUEPX9.exe 3336 JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe 2200 7260ec3afe.exe 2488 8656K23GM02ZDBOH6TG8KUEPX9.exe 2488 8656K23GM02ZDBOH6TG8KUEPX9.exe 4484 43c92e1cee.exe 2200 7260ec3afe.exe 4484 43c92e1cee.exe 4484 43c92e1cee.exe 4936 158ef79638.exe 4936 158ef79638.exe 4936 158ef79638.exe 4936 158ef79638.exe 4936 158ef79638.exe 4936 158ef79638.exe 4936 158ef79638.exe 1144 powershell.exe 4264 Intel_PTT_EK_Recertification.exe 4656 powershell.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 1932 e00b0fe887.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 4540 JrCklm0E5O0P77D.exe 3608 firefox.exe 3608 firefox.exe 3608 firefox.exe 3608 firefox.exe 3608 firefox.exe 3608 firefox.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 1852 IQ7ux2z.exe Token: SeDebugPrivilege 4800 sUSFJjY.exe Token: SeDebugPrivilege 4968 IQ7ux2z.exe Token: SeDebugPrivilege 1740 taskkill.exe Token: SeDebugPrivilege 3676 taskkill.exe Token: SeDebugPrivilege 3764 taskkill.exe Token: SeDebugPrivilege 3848 taskkill.exe Token: SeDebugPrivilege 2488 8656K23GM02ZDBOH6TG8KUEPX9.exe Token: SeDebugPrivilege 3940 taskkill.exe Token: SeDebugPrivilege 4028 firefox.exe Token: SeDebugPrivilege 4028 firefox.exe Token: SeDebugPrivilege 4484 43c92e1cee.exe Token: SeRestorePrivilege 3532 7z.exe Token: 35 3532 7z.exe Token: SeSecurityPrivilege 3532 7z.exe Token: SeSecurityPrivilege 3532 7z.exe Token: SeRestorePrivilege 3620 7z.exe Token: 35 3620 7z.exe Token: SeSecurityPrivilege 3620 7z.exe Token: SeSecurityPrivilege 3620 7z.exe Token: SeRestorePrivilege 3800 7z.exe Token: 35 3800 7z.exe Token: SeSecurityPrivilege 3800 7z.exe Token: SeSecurityPrivilege 3800 7z.exe Token: SeRestorePrivilege 3892 7z.exe Token: 35 3892 7z.exe Token: SeSecurityPrivilege 3892 7z.exe Token: SeSecurityPrivilege 3892 7z.exe Token: SeRestorePrivilege 4008 7z.exe Token: 35 4008 7z.exe Token: SeSecurityPrivilege 4008 7z.exe Token: SeSecurityPrivilege 4008 7z.exe Token: SeRestorePrivilege 3944 7z.exe Token: 35 3944 7z.exe Token: SeSecurityPrivilege 3944 7z.exe Token: SeSecurityPrivilege 3944 7z.exe Token: SeRestorePrivilege 2592 7z.exe Token: 35 2592 7z.exe Token: SeSecurityPrivilege 2592 7z.exe Token: SeSecurityPrivilege 2592 7z.exe Token: SeRestorePrivilege 4284 7z.exe Token: 35 4284 7z.exe Token: SeSecurityPrivilege 4284 7z.exe Token: SeSecurityPrivilege 4284 7z.exe Token: SeDebugPrivilege 1144 powershell.exe Token: SeDebugPrivilege 4656 powershell.exe Token: SeLockMemoryPrivilege 4332 explorer.exe Token: SeDebugPrivilege 1728 JrCklm0E5O0P77D.exe Token: SeDebugPrivilege 4540 JrCklm0E5O0P77D.exe Token: SeDebugPrivilege 3344 firefox.exe Token: SeDebugPrivilege 3608 firefox.exe Token: SeLockMemoryPrivilege 4268 explorer.exe Token: SeDebugPrivilege 4024 powershell.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 4028 firefox.exe 4028 firefox.exe 4028 firefox.exe 4028 firefox.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 2200 7260ec3afe.exe 4028 firefox.exe 4028 firefox.exe 4028 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 976 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 30 PID 1548 wrote to memory of 976 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 30 PID 1548 wrote to memory of 976 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 30 PID 1548 wrote to memory of 976 1548 276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe 30 PID 976 wrote to memory of 1852 976 skotes.exe 33 PID 976 wrote to memory of 1852 976 skotes.exe 33 PID 976 wrote to memory of 1852 976 skotes.exe 33 PID 976 wrote to memory of 1852 976 skotes.exe 33 PID 976 wrote to memory of 4800 976 skotes.exe 34 PID 976 wrote to memory of 4800 976 skotes.exe 34 PID 976 wrote to memory of 4800 976 skotes.exe 34 PID 976 wrote to memory of 4800 976 skotes.exe 34 PID 976 wrote to memory of 4936 976 skotes.exe 35 PID 976 wrote to memory of 4936 976 skotes.exe 35 PID 976 wrote to memory of 4936 976 skotes.exe 35 PID 976 wrote to memory of 4936 976 skotes.exe 35 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 1852 wrote to memory of 4968 1852 IQ7ux2z.exe 36 PID 976 wrote to memory of 580 976 skotes.exe 37 PID 976 wrote to memory of 580 976 skotes.exe 37 PID 976 wrote to memory of 580 976 skotes.exe 37 PID 976 wrote to memory of 580 976 skotes.exe 37 PID 976 wrote to memory of 4524 976 skotes.exe 39 PID 976 wrote to memory of 4524 976 skotes.exe 39 PID 976 wrote to memory of 4524 976 skotes.exe 39 PID 976 wrote to memory of 4524 976 skotes.exe 39 PID 976 wrote to memory of 2900 976 skotes.exe 41 PID 976 wrote to memory of 2900 976 skotes.exe 41 PID 976 wrote to memory of 2900 976 skotes.exe 41 PID 976 wrote to memory of 2900 976 skotes.exe 41 PID 580 wrote to memory of 1872 580 1c46c1cd3d.exe 42 PID 580 wrote to memory of 1872 580 1c46c1cd3d.exe 42 PID 580 wrote to memory of 1872 580 1c46c1cd3d.exe 42 PID 580 wrote to memory of 1872 580 1c46c1cd3d.exe 42 PID 1872 wrote to memory of 2760 1872 cmd.exe 44 PID 1872 wrote to memory of 2760 1872 cmd.exe 44 PID 1872 wrote to memory of 2760 1872 cmd.exe 44 PID 1872 wrote to memory of 2760 1872 cmd.exe 44 PID 976 wrote to memory of 2200 976 skotes.exe 45 PID 976 wrote to memory of 2200 976 skotes.exe 45 PID 976 wrote to memory of 2200 976 skotes.exe 45 PID 976 wrote to memory of 2200 976 skotes.exe 45 PID 4524 wrote to memory of 2488 4524 73febd80ca.exe 46 PID 4524 wrote to memory of 2488 4524 73febd80ca.exe 46 PID 4524 wrote to memory of 2488 4524 73febd80ca.exe 46 PID 4524 wrote to memory of 2488 4524 73febd80ca.exe 46 PID 2200 wrote to memory of 1740 2200 7260ec3afe.exe 47 PID 2200 wrote to memory of 1740 2200 7260ec3afe.exe 47 PID 2200 wrote to memory of 1740 2200 7260ec3afe.exe 47 PID 2200 wrote to memory of 1740 2200 7260ec3afe.exe 47 PID 4524 wrote to memory of 3336 4524 73febd80ca.exe 49 PID 4524 wrote to memory of 3336 4524 73febd80ca.exe 49 PID 4524 wrote to memory of 3336 4524 73febd80ca.exe 49 PID 4524 wrote to memory of 3336 4524 73febd80ca.exe 49 PID 2200 wrote to memory of 3676 2200 7260ec3afe.exe 50 PID 2200 wrote to memory of 3676 2200 7260ec3afe.exe 50 PID 2200 wrote to memory of 3676 2200 7260ec3afe.exe 50 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 4520 attrib.exe 4568 attrib.exe 4544 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe"C:\Users\Admin\AppData\Local\Temp\276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4968 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\98s5lOaLpvia.bat" "5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3964 -
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
- System Location Discovery: System Language Discovery
PID:4340
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost6⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4364
-
-
C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"C:\Users\Admin\AppData\Roaming\JrCklm0E5O0P77D.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ktqHGqqrXq.bat"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
- System Location Discovery: System Language Discovery
PID:1112
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost9⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3612
-
-
C:\Windows\BitLockerDiscoveryVolumeContents\firefox.exe"C:\Windows\BitLockerDiscoveryVolumeContents\firefox.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3344 -
C:\Windows\BitLockerDiscoveryVolumeContents\firefox.exe"C:\Windows\BitLockerDiscoveryVolumeContents\firefox.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe"C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Users\Admin\AppData\Local\Temp\1015868001\8525b483c6.exe"C:\Users\Admin\AppData\Local\Temp\1015868001\8525b483c6.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\1015869001\1c46c1cd3d.exe"C:\Users\Admin\AppData\Local\Temp\1015869001\1c46c1cd3d.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015869001\1c46c1cd3d.exe" & rd /s /q "C:\ProgramData\EUAIEC2689RI" & exit4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2760
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015870001\73febd80ca.exe"C:\Users\Admin\AppData\Local\Temp\1015870001\73febd80ca.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\8656K23GM02ZDBOH6TG8KUEPX9.exe"C:\Users\Admin\AppData\Local\Temp\8656K23GM02ZDBOH6TG8KUEPX9.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe"C:\Users\Admin\AppData\Local\Temp\JR0P244YHLU4VDK7SEQM2IR6QUA3IY.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015871001\a166403d61.exe"C:\Users\Admin\AppData\Local\Temp\1015871001\a166403d61.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\1015872001\7260ec3afe.exe"C:\Users\Admin\AppData\Local\Temp\1015872001\7260ec3afe.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵PID:4016
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4028 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4028.0.1776977244\1070486598" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1196 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28ea1f4f-1e95-4a93-93f4-823faa522118} 4028 "\\.\pipe\gecko-crash-server-pipe.4028" 1292 11cd8858 gpu6⤵PID:4404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4028.1.1136859268\343313020" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a68f7c29-2611-48df-8d35-a5c2f7702909} 4028 "\\.\pipe\gecko-crash-server-pipe.4028" 1512 d74858 socket6⤵PID:1348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4028.2.1954823146\989034097" -childID 1 -isForBrowser -prefsHandle 2216 -prefMapHandle 2212 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04c22818-30ef-4a37-b333-4529e30f77b5} 4028 "\\.\pipe\gecko-crash-server-pipe.4028" 2228 1a1e7b58 tab6⤵PID:5008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4028.3.1511833950\728734674" -childID 2 -isForBrowser -prefsHandle 2952 -prefMapHandle 2948 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8fd101a-816e-448c-8055-ebdf2d1b8aa8} 4028 "\\.\pipe\gecko-crash-server-pipe.4028" 2964 1d64c058 tab6⤵PID:3528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4028.4.635487665\95782104" -childID 3 -isForBrowser -prefsHandle 3720 -prefMapHandle 3332 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {648811b1-3b73-4ab0-91b3-1352cd51ff48} 4028 "\\.\pipe\gecko-crash-server-pipe.4028" 3728 1f2f7a58 tab6⤵PID:4440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4028.5.571196555\683209129" -childID 4 -isForBrowser -prefsHandle 3836 -prefMapHandle 3840 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6299469-fcaf-4438-9b83-a797d1728ed1} 4028 "\\.\pipe\gecko-crash-server-pipe.4028" 3824 1f2f7d58 tab6⤵PID:4480
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4028.6.1542940022\406656589" -childID 5 -isForBrowser -prefsHandle 3996 -prefMapHandle 4000 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {189d1aee-2cf4-4314-b8ee-d1f07acc4812} 4028 "\\.\pipe\gecko-crash-server-pipe.4028" 3984 1f2f8c58 tab6⤵PID:4488
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015873001\43c92e1cee.exe"C:\Users\Admin\AppData\Local\Temp\1015873001\43c92e1cee.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
C:\Users\Admin\AppData\Local\Temp\1015874001\158ef79638.exe"C:\Users\Admin\AppData\Local\Temp\1015874001\158ef79638.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\1015875001\110b7a1e35.exe"C:\Users\Admin\AppData\Local\Temp\1015875001\110b7a1e35.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
- Loads dropped DLL
PID:3468 -
C:\Windows\system32\mode.commode 65,105⤵PID:3508
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3532
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"5⤵
- Views/modifies file attributes
PID:4520
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"5⤵
- Executes dropped EXE
PID:4060 -
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:4544
-
-
C:\Windows\system32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
PID:4568
-
-
C:\Windows\system32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE6⤵
- Scheduled Task/Job: Scheduled Task
PID:1252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4336
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1015877001\e00b0fe887.exe"C:\Users\Admin\AppData\Local\Temp\1015877001\e00b0fe887.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5D1FE92E-3173-4919-9CB7-88B69DBAC8FD} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]1⤵
- Loads dropped DLL
PID:3756 -
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4264 -
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- Drops file in System32 directory
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1636
-
-
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3864 -
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- Drops file in System32 directory
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4024 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2232
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
5Discovery
Browser Information Discovery
1Query Registry
7Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503d792e71d446f006357ee91bedfdc3a
SHA151a9093ffcf8532a0627e3b75e37cfa3fe96483c
SHA2568794549ad3cba03fda38793e0f6905a70a1cc8bf9dac49daef3d1e552bc5f49d
SHA51248513c1d70dc1185dff566ea4dede5376e8621045eb88f7edf60667ec2916cd4cc0b883715b8dff6c55c94f2d366536238b2a81b52253b16c724ed8328f9e9ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d6dd46f25b448bb8491b50961b1615d
SHA1ab95909b863914f319d51b552dd4eb5183694086
SHA25698995d64984ec6b7b2c12b3b3be737102d5bd26a02cfce93ba59c87630dbb880
SHA512d59e3bb016dab3158cddb67d53073fae13b0febaf5b95b0c9b69380e250ceaa06beed761df7973b57b6fa3827dee2505849dedd48714713d29119645101e037e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585b1d75ecd93c07d89c98e1d277627af
SHA197c005704b652723e8834b89abeb19fbd7c97c96
SHA256e26251b6a16ba844722c14b0b0fa9310e4a520758a648a361d16faf26ae4f68c
SHA512042b70b5ea3e4d06d111851c11d98c952170d6212a901028815987f567be1a8afd3748df93e952378a902803304c25a5306bfa259d81b5ebfddda04e71e10403
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp
Filesize33KB
MD5d48dba5c90ab062e93219a8c8dbb18a6
SHA17798d7aef32b01b35589ef2e54d16b155a4ef35e
SHA256adf2a21333336dffcf53f9448086345d3c2b4242b9489121b3079492c5a40ac8
SHA51204dca14d823b36748cd98cc4321282c3b9d999055142736c7c01336e3a0039f31dd69d60be25e65f1472d7d660744734a03593ceeab01ffc2457c375546a86e5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
2.8MB
MD50dad190f420a0a09ed8c262ca18b1097
SHA1b97535bf2960278b19bda8cad9e885b8eefbdc85
SHA25629e1e95110c03e84720e213a2bb0dcdff95af85a8a894d71518e06c62131e64a
SHA5128ae92676fc5539899414f0a70cba1ed01685b30af9002c68114720d6a7213e4e9c2368e17717c4e3e02650781a022001e4a2e43f83afbd709e7f1ab81003b646
-
Filesize
87KB
MD53c104350cc2661c345673e91ed672c4c
SHA1d205e94d47949cf3bc3f5226978f6d370c3d3b94
SHA2561fb9f279263c252a09f12b69c7238c18d2325f7cf7250ebe24ad9149abe62cf4
SHA5129c02bde2d096e181f00e906f4e242905d0e54dd207f309764805c7444c9f43073106812ade97fca9fc2363f59ed071371276880ce85e9a307fcdb03d3250cf6a
-
Filesize
4.3MB
MD5c5f945671aec219fd0af66f72065a536
SHA17956212b4272158ebf29243e79067cc73066fee6
SHA2567fdc637cd02ad95b233c17569424fe28b53228f5d7dc853dc1449527ad2fd05d
SHA5121cf363e35bbdaa90af47ff79e59a3175559b81d6ec63b296534793b1b406b883dd0b89412b0115be4a42041d27c15e97e494b284e092397d1878b8dfb544144a
-
Filesize
384KB
MD5dfd5f78a711fa92337010ecc028470b4
SHA11a389091178f2be8ce486cd860de16263f8e902e
SHA256da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d
SHA512a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656
-
Filesize
1.8MB
MD5f9694cb15c258cf8125cf0c317c77479
SHA1ad7ab004164e247a32fb8eb4187103a1eaf73657
SHA25637aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b
SHA51241504ae13f21e126508b91cdacc3d993790b7ce6001a0d58353860ad4eccb76858f553f4dd49d1960fae09a777160493932c0bb9acebd3bad3aae6e0dc2e2351
-
Filesize
1.7MB
MD5f660a7ff99befe7ae52d2636a0e8db46
SHA141b7e90dbf2ce54bd4e3048d0dc1b7e9d59d81ee
SHA256526d8ce745c14bac28de547ee616d66bec13517e558da772982b41cb9d6dda62
SHA5124f13dc0b5c8003b3dc7a5f3faa02c4e103da106722d53494a74e419756d1ce8c35b308641e7690bb932002b0d16411caedb60e63138d33cbfe78520ca8bd0240
-
Filesize
946KB
MD56bf59db9dafe72201466700ea8cb334d
SHA1e3649b55eb5141245e634374aa4a6385dba214e6
SHA256acdc360a0c9680c407d43df48f143af92d99d5c034a152e78b5da5220dbeb249
SHA512f44354e412d85b7025c486d2582976f684a57216267c37dbc2fea2b6ba5e9808a098f663258569a5a998d849e97b15a15d617f834e9b768e01391daf0ff261bd
-
Filesize
1.7MB
MD56c1d0dabe1ec5e928f27b3223f25c26b
SHA1e25ab704a6e9b3e4c30a6c1f7043598a13856ad9
SHA25692228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d
SHA5123a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
4.2MB
MD53617bfad36063c68a129b7e2bd89ceef
SHA16621e1f1403b9fa874124c374021034a3c86421e
SHA256e5637e64459e1868bf6318ea3b48b76ecf3f5669992ba882a7ddab2567af8b24
SHA512fdf2d08361b48faccf5ee0e2f04104f07f4677a0299a80d49cf50aabd952a6bb23332f51b12102d87c01ee3291bf1bc3833035e42d613e4c35e657dc06044c21
-
Filesize
178B
MD5c9c321983309e0ca77a0cd6c11d0a694
SHA1f237762cbb546a448011c603973f12c5d1c7b566
SHA256d1b48a4d97caff8e5b181e0712a61d8f68e43dfabfe3d8f9c1f9f91c441df2a4
SHA512e4b7d59e756f0bfdf808ae3c4c8bc9ee456963b5a9fbeba9dd669d9d87bff0190974ce30f5bfd7030ec374ff23c6562ca34304f6840fba3684a560ca6851247d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
1.7MB
MD5b7d1e04629bec112923446fda5391731
SHA1814055286f963ddaa5bf3019821cb8a565b56cb8
SHA2564da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789
SHA51279fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db
-
Filesize
1.7MB
MD50dc4014facf82aa027904c1be1d403c1
SHA15e6d6c020bfc2e6f24f3d237946b0103fe9b1831
SHA256a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7
SHA512cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028
-
Filesize
3.3MB
MD5cea368fc334a9aec1ecff4b15612e5b0
SHA1493d23f72731bb570d904014ffdacbba2334ce26
SHA25607e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541
SHA512bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748
-
Filesize
3.3MB
MD5045b0a3d5be6f10ddf19ae6d92dfdd70
SHA10387715b6681d7097d372cd0005b664f76c933c7
SHA25694b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d
SHA51258255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b
-
Filesize
440B
MD53626532127e3066df98e34c3d56a1869
SHA15fa7102f02615afde4efd4ed091744e842c63f78
SHA2562a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca
SHA512dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SN78N6JV33JFPEVI1ZRN.temp
Filesize7KB
MD519ba25b5e83c707cb2369f9e1a0253dd
SHA168fd42b530ccdd08d22b29ca5d2671f4abc635a1
SHA2566ebba4d7c6f31da0f38459a82d9fab993126d101d2c9c63bfc306402b1a7bc16
SHA512fc7d91bf9b9d9e01056412b8ce182d44c8abc1155523f23677ed4f340e0a16488ca969de582600bc3cb64184b87267a0a28ed10b074ec2555c9e77f49bbfd703
-
Filesize
224KB
MD53bcb85f5e0b2191bb5d4fb55fbc12ecf
SHA12087a860e3161e3479e5bfd91c1e1364b2459ad9
SHA25695b111569c5cb1a550b0627dfdaaececafb78d25ed9502ee23a6282788efdc63
SHA5120580ce608129b9ea155e5b3f945d20a2699fa3ffd50723bb36c7db5a2f6a2a844fcccab04bcf91c33b47fad3f658c1499bb12bd16cdf8ad473d57f5b1f8657dc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD5607fd4e3bd8c14d3d8b06d7e09c964a0
SHA10de7d73946848134e3e1e14cb734fa6267ecda3e
SHA25656d0f8cfb96387604b4ef078fbaebf9569b4dfb0f0a917690031c24f253fdda6
SHA512085e2a27988951823e168e774d1212b568af099b77d9b76dce4d0b582e1658bdd839a37481cc58e0a6d1e8ba84ac356047ef3851c8fd43e2211efeb8225d1e65
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\69c7cd75-7f01-4e74-a2dd-6e126d985128
Filesize733B
MD5ab9f1324056c05ff9ac2e38038c1274c
SHA15d18fdd39e12e81ae4db4d3215019596409e628e
SHA256991e3622707658c91c75399bf3ecd2e402c3dc5f5c3c80dfb1193aa4f263a39b
SHA512f6f83bdbbc1e70c6d3ab76c0c5ab0ad425c7426d48bfebde124a6a6584b0d4b92afdcc1816b277f6f6e65d7a33311b4f3bfc278c624ad81e55bb6dc9401ca2ee
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5fee56f4062fcf874346cd8114604b0df
SHA13ea05dd0af7f58341a828c0aac6f50a8b58796dc
SHA256090f16058ccd0000295708dc6ac5709a1e20102b9ceeea5c4ff33caf2fcd013e
SHA512da734b0d0cf633c33f5ebee5e76906d32185f0e7dd0d57ef47799b36c02412a62a2586e03ce9fe2675a985c61e3070fc45b6241465c231819d35dab0594c9d3a
-
Filesize
7KB
MD53fe74b6efe06df112657bc31ebc9cef4
SHA1a424caebe2ba48f1ba8b025114b8788e841f9cda
SHA256ce5d7715d4bc0ef0792a6469cc4b705ba600250e2dc4f27f64480d24af557dc5
SHA5121b37f7d2914cf0d2b3acb77cf3f4e3c92ef9564bfe666e732d1ba342f1b01195aee1ff06fb7e16f11daa5ae60fb9571fd678a02d6af0ebe3bd06a5a704b1b5dc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD54b6ea807b1b84d253f3a94ef42b931c5
SHA1df5fb42b28fe06281bcaecd563427560766b8255
SHA256c5bac396c8e70091112ff44bfbc3908b09a0154d8e7dce700c90644adac08aa4
SHA512da3c35f691ef4376fdc291314aa4ed9800eee483f5ddb6bb7966eb5e9332464f8e2fb2bc7035d4b09ae423022001efe50d0ae86c5851033b7f2fa75fa2f9c386
-
Filesize
2.8MB
MD5985a071afd1a3065488a92540c3bee93
SHA1f5282fdbd3fbe681dd8485f37d6ba3d5ce59079f
SHA256464e8781560aecb3764b8afad710aed0b8087b362e180bc3b18c84be5ef38089
SHA512ff76a68533f86b2872c19722f8adb3fcba5f6bc802caa4dc6543447141b78d60db686d481a0e168afd58516d009fe551ee3113de6b3eb174eeee736cf304dd60
-
Filesize
2.6MB
MD5e5cfad81f5397d7eeed2e7251b7e6e7a
SHA184184161e1b542773e5c74909ce37bb1f8f2238e
SHA25646cb31f14f15b4f13d203fe4138401adccf3163cf405fe907e7ee86bbd1c2387
SHA512fad966d925810d75be01d20b2b2bbf45755a30d385754878764fec0f1d45100490ba8c4ea279429f91c627cfa8f6b0e2abc70abdb8b645dddf1abd4cf021656a
-
Filesize
2.8MB
MD5637ae46f64ec4068089966631b40cc63
SHA195d04f52347e6f7e07cc908072bfc18d73af6b43
SHA256276b9efb197b38b89ba66976b3f8af72d0e3abfb14dccc1b2af19ac1ee94ab28
SHA512111d0b5a6e4cd748890d951f9d2f8619fa2925b08cfe4976067404027c82730db5df1cf79fe3629ced8e67292f144f49f6f14d4968796b653b7d3f80faa5f94b
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628