Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 12:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    2.9MB

  • MD5

    842e251ca1e3a812356248ebe8154f16

  • SHA1

    efb511d328cf0a7690e62cbb89adeebc07dddb3c

  • SHA256

    14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a

  • SHA512

    2eaf72c87cda80fcc64463eda29ad62e21818bac52105af0b95c5504c935e7f480cba518575fad8f80d0748e11e41641063cb8b6e61da8584271e1068d7f3b74

  • SSDEEP

    49152:FfD0T39ZF8R21uPbS2fH/F9xcThPDf0x:FfD0TfFsquPbSQH/FncZI

Score
10/10
amadeycryptbotdcratlummastealcxmrig9c9aa5stokcredential_accessdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://shineugler.biz/api

https://tacitglibbr.biz/api

Extracted

Family

cryptbot

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://shineugler.biz/api

https://tacitglibbr.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
    evasion
  • XMRig Miner payload 10 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 33 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 10 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe
        "C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:2040
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Bridgecontainerserver\SlMo.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2928
            • C:\Bridgecontainerserver\BrokerhostNet.exe
              "C:\Bridgecontainerserver/BrokerhostNet.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5060
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\csrss.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5100
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4572
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LZthEGCsKS.bat"
                7⤵
                  PID:560
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    8⤵
                      PID:768
                    • C:\Windows\system32\PING.EXE
                      ping -n 10 localhost
                      8⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:4520
                    • C:\Users\Admin\AppData\Local\Temp\csrss.exe
                      "C:\Users\Admin\AppData\Local\Temp\csrss.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4028
          • C:\Users\Admin\AppData\Local\Temp\1016087001\c5ebece165.exe
            "C:\Users\Admin\AppData\Local\Temp\1016087001\c5ebece165.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4540
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2904
              • C:\Windows\system32\mode.com
                mode 65,10
                5⤵
                  PID:2540
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5000
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_7.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2116
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_6.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1732
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_5.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1340
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_4.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1968
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_3.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3792
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_2.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2676
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_1.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3880
                • C:\Windows\system32\attrib.exe
                  attrib +H "in.exe"
                  5⤵
                  • Views/modifies file attributes
                  PID:4908
                • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                  "in.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1440
                  • C:\Windows\SYSTEM32\attrib.exe
                    attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    6⤵
                    • Views/modifies file attributes
                    PID:3744
                  • C:\Windows\SYSTEM32\attrib.exe
                    attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    6⤵
                    • Views/modifies file attributes
                    PID:4564
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                    6⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:3204
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell ping 127.0.0.1; del in.exe
                    6⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3016
                    • C:\Windows\system32\PING.EXE
                      "C:\Windows\system32\PING.EXE" 127.0.0.1
                      7⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:4820
            • C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe
              "C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3112
              • C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe
                "C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe"
                4⤵
                • Executes dropped EXE
                PID:3124
              • C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe
                "C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe"
                4⤵
                • Executes dropped EXE
                PID:3132
              • C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe
                "C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe"
                4⤵
                • Executes dropped EXE
                PID:3136
              • C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe
                "C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3756
            • C:\Users\Admin\AppData\Local\Temp\1016089001\723960f0bf.exe
              "C:\Users\Admin\AppData\Local\Temp\1016089001\723960f0bf.exe"
              3⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4088
            • C:\Users\Admin\AppData\Local\Temp\1016090001\8b97e9ba95.exe
              "C:\Users\Admin\AppData\Local\Temp\1016090001\8b97e9ba95.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4524
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1016090001\8b97e9ba95.exe" & rd /s /q "C:\ProgramData\7G4WBI5PPH4E" & exit
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3912
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 10
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:4832
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 2008
                4⤵
                • Program crash
                PID:2364
            • C:\Users\Admin\AppData\Local\Temp\1016091001\d7aa8dc02d.exe
              "C:\Users\Admin\AppData\Local\Temp\1016091001\d7aa8dc02d.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:3192
            • C:\Users\Admin\AppData\Local\Temp\1016092001\753cff98f1.exe
              "C:\Users\Admin\AppData\Local\Temp\1016092001\753cff98f1.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:1692
            • C:\Users\Admin\AppData\Local\Temp\1016093001\c2d81904f5.exe
              "C:\Users\Admin\AppData\Local\Temp\1016093001\c2d81904f5.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:232
              • C:\Users\Admin\AppData\Local\Temp\GMUOQPYATA1FY6KH3TU8FZ.exe
                "C:\Users\Admin\AppData\Local\Temp\GMUOQPYATA1FY6KH3TU8FZ.exe"
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:6788
            • C:\Users\Admin\AppData\Local\Temp\1016094001\2136e45959.exe
              "C:\Users\Admin\AppData\Local\Temp\1016094001\2136e45959.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:2540
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                4⤵
                • Uses browser remote debugging
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:4972
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa6e3cc40,0x7ffaa6e3cc4c,0x7ffaa6e3cc58
                  5⤵
                    PID:3024
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2040,i,7210683191893065055,10569580269149285010,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2036 /prefetch:2
                    5⤵
                      PID:1832
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1816,i,7210683191893065055,10569580269149285010,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2224 /prefetch:3
                      5⤵
                        PID:4964
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1864,i,7210683191893065055,10569580269149285010,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2292 /prefetch:8
                        5⤵
                          PID:632
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,7210683191893065055,10569580269149285010,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
                          5⤵
                          • Uses browser remote debugging
                          PID:768
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,7210683191893065055,10569580269149285010,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3372 /prefetch:1
                          5⤵
                          • Uses browser remote debugging
                          PID:3560
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4580,i,7210683191893065055,10569580269149285010,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4628 /prefetch:1
                          5⤵
                          • Uses browser remote debugging
                          PID:3512
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4904,i,7210683191893065055,10569580269149285010,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:8
                          5⤵
                            PID:5428
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                          4⤵
                          • Uses browser remote debugging
                          • Enumerates system info in registry
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          PID:5136
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa38e46f8,0x7ffaa38e4708,0x7ffaa38e4718
                            5⤵
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:4064
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
                            5⤵
                              PID:3600
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 /prefetch:3
                              5⤵
                                PID:5112
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
                                5⤵
                                  PID:4740
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                                  5⤵
                                  • Uses browser remote debugging
                                  PID:4372
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                                  5⤵
                                  • Uses browser remote debugging
                                  PID:2468
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
                                  5⤵
                                  • Uses browser remote debugging
                                  PID:6596
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
                                  5⤵
                                  • Uses browser remote debugging
                                  PID:6604
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
                                  5⤵
                                    PID:7100
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11982057797782931573,9028452097534204061,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
                                    5⤵
                                      PID:6348
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\FIECFBAAAF.exe"
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6548
                                    • C:\Users\Admin\Documents\FIECFBAAAF.exe
                                      "C:\Users\Admin\Documents\FIECFBAAAF.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      PID:4808
                                • C:\Users\Admin\AppData\Local\Temp\1016095001\6c60b4f59d.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1016095001\6c60b4f59d.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:5136
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM firefox.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5300
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM chrome.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5440
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM msedge.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5612
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM opera.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5784
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM brave.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5864
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                    4⤵
                                      PID:5924
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                        5⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5940
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26baa393-0b44-45ee-966b-03f55efb1a3d} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" gpu
                                          6⤵
                                            PID:6140
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99cc65d8-612a-4d84-aa86-a6f343e8295b} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" socket
                                            6⤵
                                              PID:4380
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1464 -childID 1 -isForBrowser -prefsHandle 1452 -prefMapHandle 2820 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86b4993d-b8b0-4ef1-8c15-7d167b4ea730} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab
                                              6⤵
                                                PID:4888
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4100 -childID 2 -isForBrowser -prefsHandle 4084 -prefMapHandle 4080 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf7af7ae-cd41-450a-acf2-a83613177bfe} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab
                                                6⤵
                                                  PID:1912
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4768 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4788 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50f05147-749a-430a-9972-19a9cb560525} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" utility
                                                  6⤵
                                                  • Checks processor information in registry
                                                  PID:720
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5092 -childID 3 -isForBrowser -prefsHandle 5052 -prefMapHandle 5056 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0240b1de-caa1-4bc2-b95e-8f48cc141a71} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab
                                                  6⤵
                                                    PID:5648
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5104 -childID 4 -isForBrowser -prefsHandle 5184 -prefMapHandle 5188 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fda4183d-5d6f-4a69-a66a-fc81ed35f156} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab
                                                    6⤵
                                                      PID:5684
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 5 -isForBrowser -prefsHandle 5504 -prefMapHandle 5500 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14b4a85a-38bf-4745-afc4-b66c73420271} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab
                                                      6⤵
                                                        PID:5720
                                                • C:\Users\Admin\AppData\Local\Temp\1016096001\3c03128558.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1016096001\3c03128558.exe"
                                                  3⤵
                                                  • Modifies Windows Defender Real-time Protection settings
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Windows security modification
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5784
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4524 -ip 4524
                                              1⤵
                                                PID:1696
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\csrss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1108
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4812
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3480
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "BrokerhostNetB" /sc MINUTE /mo 13 /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2100
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "BrokerhostNet" /sc ONLOGON /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3040
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "BrokerhostNetB" /sc MINUTE /mo 9 /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2116
                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                1⤵
                                                  PID:960
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                  1⤵
                                                    PID:5532
                                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:5572
                                                  • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                    C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:5200
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      2⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4188
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                                      2⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5248
                                                      • C:\Windows\system32\PING.EXE
                                                        "C:\Windows\system32\PING.EXE" 127.1.10.1
                                                        3⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Runs ping.exe
                                                        PID:5376
                                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:6592
                                                  • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                    C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:392
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      2⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5848
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                                      2⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:6784
                                                      • C:\Windows\system32\PING.EXE
                                                        "C:\Windows\system32\PING.EXE" 127.1.10.1
                                                        3⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        • Runs ping.exe
                                                        PID:6944

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Command and Scripting Interpreter

                                                  1
                                                  T1059

                                                  PowerShell

                                                  1
                                                  T1059.001

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  1
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Modify Authentication Process

                                                  1
                                                  T1556

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  1
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Defense Evasion

                                                  Hide Artifacts

                                                  1
                                                  T1564

                                                  Hidden Files and Directories

                                                  1
                                                  T1564.001

                                                  Impair Defenses

                                                  2
                                                  T1562

                                                  Disable or Modify Tools

                                                  2
                                                  T1562.001

                                                  Modify Authentication Process

                                                  1
                                                  T1556

                                                  Modify Registry

                                                  3
                                                  T1112

                                                  Virtualization/Sandbox Evasion

                                                  3
                                                  T1497

                                                  Credential Access

                                                  Credentials from Password Stores

                                                  1
                                                  T1555

                                                  Credentials from Web Browsers

                                                  1
                                                  T1555.003

                                                  Modify Authentication Process

                                                  1
                                                  T1556

                                                  Steal Web Session Cookie

                                                  1
                                                  T1539

                                                  Unsecured Credentials

                                                  5
                                                  T1552

                                                  Credentials In Files

                                                  5
                                                  T1552.001

                                                  Discovery

                                                  Browser Information Discovery

                                                  1
                                                  T1217

                                                  Query Registry

                                                  9
                                                  T1012

                                                  Remote System Discovery

                                                  1
                                                  T1018

                                                  System Information Discovery

                                                  5
                                                  T1082

                                                  System Location Discovery

                                                  1
                                                  T1614

                                                  System Language Discovery

                                                  1
                                                  T1614.001

                                                  System Network Configuration Discovery

                                                  1
                                                  T1016

                                                  Internet Connection Discovery

                                                  1
                                                  T1016.001

                                                  Virtualization/Sandbox Evasion

                                                  3
                                                  T1497

                                                  Lateral Movement

                                                  Collection

                                                  Data from Local System

                                                  4
                                                  T1005

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Bridgecontainerserver\BrokerhostNet.exe
                                                    Filesize

                                                    1.9MB

                                                    MD5

                                                    0f91548ca49c64d6a8cd3846854f484c

                                                    SHA1

                                                    033c309b683020221ae189c4236a70c0d3ddd568

                                                    SHA256

                                                    a7883947a5f3c0d74f3eac6c2a6da45555298d769f5e3137e10a3ece14e83dfd

                                                    SHA512

                                                    e207b5545ceed034ec22f13e1a36f13656721b2c9cab97f6ec7ba8195f32ddc1673e1334902b2d4fc0ce393baf7f806bedf4a03a26a8ffe79ad17a87cf9a90a2

                                                    Download Submit

                                                  • C:\Bridgecontainerserver\SlMo.bat
                                                    Filesize

                                                    89B

                                                    MD5

                                                    20c75fef4553c17d36635750cfb57049

                                                    SHA1

                                                    8489a5998acaa63326bc1a665c38eb71c5d1f426

                                                    SHA256

                                                    0dcef4794868f563d515bbeee69e35dde750411ee9dcaafdef597806c89cabd0

                                                    SHA512

                                                    2819f6585bd3ee7e9f1703c259b97b21dbacde276186a489acfea0c36f377f751845b50ed00a70e029e95f588193cf69f77aeaf2785e67888378b9f2e95ee92a

                                                    Download Submit

                                                  • C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe
                                                    Filesize

                                                    204B

                                                    MD5

                                                    e52eec5fe59f0e73555c7d43c0035f62

                                                    SHA1

                                                    e6fcc87b7d260c2fcfff89e28e7d45357357520e

                                                    SHA256

                                                    b5712ce1aa870e16ed1464f1ecd627aed7020bb48c61252471cf9ec0b2d38d7f

                                                    SHA512

                                                    325c467e6519fb72238c62abbb7b89d32016a71416d41f148a38e41853928fc9cc84ed6b096784af9b1ad23c3363316d6b4f3464959127dfee1794cc926d40a7

                                                    Download Submit

                                                  • C:\ProgramData\HCFIIIJJKJKFHIDGDBAK
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    0c777e63a6887fb3ca23e45d2d9e2ee9

                                                    SHA1

                                                    5bd59a77fd51dfaa1aa1914abd4f0038e444928d

                                                    SHA256

                                                    86591deda2f6cee67a9c41341945d1b394b11d0a1ddce4fbe4ab2a9d523dd4ea

                                                    SHA512

                                                    c455febb6cb8b4f90186f9d9c5adbf8b586df616345bf6d95dbdfa865a5a3ed7bf57e01e66317c211d7eca4ce71a3a725183a6c716f841e99337814b7e9c00a1

                                                    Download Submit

                                                  • C:\ProgramData\mozglue.dll
                                                    Filesize

                                                    593KB

                                                    MD5

                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                    SHA1

                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                    SHA256

                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                    SHA512

                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                    Filesize

                                                    2B

                                                    MD5

                                                    d751713988987e9331980363e24189ce

                                                    SHA1

                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                    SHA256

                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                    SHA512

                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    fa6b57da4ef6a96e5df9afcbd452e5e0

                                                    SHA1

                                                    d56d203c5847fa787c39e020de72817347d40915

                                                    SHA256

                                                    46b4e20eaac9c9fedc60af05db073b8d0903fc03d5438ad82aa1d521dcdbea59

                                                    SHA512

                                                    c3fb237e362fc26a7f38e99cce04095e0bcbc8e088a411b93f9fe5b7ec52133355177dbf9179c4e01e66a5addf8c2b07956079e2f83d9d486bd745a97175c386

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                    Filesize

                                                    150B

                                                    MD5

                                                    bc4fa685d57da577317d21a0de8fd098

                                                    SHA1

                                                    fd71c05b2730fef9ec4ace1aad872fa916b348f8

                                                    SHA256

                                                    6478c6c3b20770fa4b23e32bdc715841a2bbed1274aa858791985fa3483e77ea

                                                    SHA512

                                                    fd067d42b5b61375f66e98ae77162f2da0579821febe9b9c1de1b76fdeb9f32d47f502b676b066a4bb525e9e2eb6ba82a03ec9980535e1edbb121dc8df00d1e4

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                    Filesize

                                                    284B

                                                    MD5

                                                    3b5e5e5a39783d1227e6953c73b4f05e

                                                    SHA1

                                                    f2e662825b0b8fca038287447c0810044c81fd5f

                                                    SHA256

                                                    04179672f4313b4ace8d5b6bd367fad97a25640b3e563fb1adb80aef163bd687

                                                    SHA512

                                                    adf35bc5c2d5580da2388dbe9998293ca7be893f3c6251d10b7117f3683a90eef5f5e0c0d246060f1695337dc9d9d48774880bb0a0346b83fb10365b1c649176

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\99ad3ecf-5fb3-4291-bb7d-8a7210b9f8d2.dmp
                                                    Filesize

                                                    826KB

                                                    MD5

                                                    96bd3b419473941c133b0ef90588c0b1

                                                    SHA1

                                                    3e9cb5a56f934e567c99902e9ad90550145cbcee

                                                    SHA256

                                                    3840f21579cd2bff63f4b862a4a133284597fa7ce279a604a5a444df2aba8caa

                                                    SHA512

                                                    859b20f4693e9ff40facda8aa59e131eecf0eb6520698112aa6ca0217b89ae418031f2ab096f541a12ef2a3f613f502405cbbf2e8521111b5530f1f18fa28ab7

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d1e61c51-345f-46f9-908e-f523ba26fb74.dmp
                                                    Filesize

                                                    826KB

                                                    MD5

                                                    ca5801b3da5a140273f83868c6f45b61

                                                    SHA1

                                                    43a3f914c5bf97eecb97cc45bc67795cb48479e7

                                                    SHA256

                                                    00c32cbfab4529a84af8f5bb1d722539315bc64bab8c2bea0760ef4db0927770

                                                    SHA512

                                                    798e871bc3b2b57466ca2219f7ce1468bee80205c0d5ab256506562d5370606cc44365d1b49e299e525c1629f28e2ae1175b63b5cb1d78ff5832644f83c19b66

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    152B

                                                    MD5

                                                    7de1bbdc1f9cf1a58ae1de4951ce8cb9

                                                    SHA1

                                                    010da169e15457c25bd80ef02d76a940c1210301

                                                    SHA256

                                                    6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                                                    SHA512

                                                    e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    152B

                                                    MD5

                                                    85ba073d7015b6ce7da19235a275f6da

                                                    SHA1

                                                    a23c8c2125e45a0788bac14423ae1f3eab92cf00

                                                    SHA256

                                                    5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                                                    SHA512

                                                    eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    152B

                                                    MD5

                                                    b310cdf0bb56b6e3fbe354e7762d816a

                                                    SHA1

                                                    dc1222527a6fb744497c3cb30dcb6e4b1e37ae08

                                                    SHA256

                                                    b808ad82b36a1c2d6fee55e4fa7539a8529239b30e982da0cc4655ac03e2c137

                                                    SHA512

                                                    e0165bc30505dab1cce2ed715eaeb748d2c768338aa02be3be5f4ed4ad88804804c831a851cd6d2163e8e6bd1da98fa3e9043adbed62588b678c0f714b17f806

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    152B

                                                    MD5

                                                    a5c635c91b5e8f1b1527a95eed9e0b8c

                                                    SHA1

                                                    aab605f942c4ab8b120fefb456bbcd19b24e8ff1

                                                    SHA256

                                                    0e4bad569d483615d8167b7c61f40bb6ccfb5595bbf2baed06e6f5864b4fbd20

                                                    SHA512

                                                    67e177b9d47e18b17fdb30637603a276845595c2bf5fbef0f26b7000e54bea13ee25ece80df2ee9f83f4b20acbf62c386d53bdb86fddbc2af97a768d5885fe10

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    Filesize

                                                    5KB

                                                    MD5

                                                    689a6833dd024a05be85c10eb3825b06

                                                    SHA1

                                                    fc7a46c0fc80e68956f7038554be2703d83f5092

                                                    SHA256

                                                    3e3c71519a2c9710cbe608973d7e70cd280f64e4f3c9129cffd343c1241b868d

                                                    SHA512

                                                    3bbef8aa38f199c693d4be143df178af2549c8f13a48a9d0c5585d962452dac1a57cfe7827a4ff925258767cf17777bc32c9d2759d8a7f2175c769a7cf96b898

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    4950bb37b35849b09a86bc7c01c8952a

                                                    SHA1

                                                    f9650f41d105d3affa7b19d58ab336a92aab4793

                                                    SHA256

                                                    5d139a221345fe53f28d2a772c8e4c8e988925b6fc228c81baa98f824a44c67c

                                                    SHA512

                                                    5b39b845d6d53acd9a20fa1e3e081f7a4c5bbea4641ed53e6d1df8fb245a57e7a659cbdbdfe41ce642b6b2a7ff98b3dd3c9a5bcea7d226cead546d097f361a40

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    944B

                                                    MD5

                                                    8cb7353002021d77f9f3ca08769aa810

                                                    SHA1

                                                    da288bbb314bc8b20601841eaecf9aaa7b7e9b27

                                                    SHA256

                                                    57554a1485418f69447ea372171b8700906005e487e007bbf47089960133965b

                                                    SHA512

                                                    dfa30b0131d5e56a8140b48104fc7e52329207926145020b834561cc860f762288d3d4166916cbb59ceb379856affdd1d13e5f5c3b4e4dfbf8b1edaa0fa027a9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json.tmp
                                                    Filesize

                                                    19KB

                                                    MD5

                                                    e1d82aa3db571fc0a1bbcb2bb308ac72

                                                    SHA1

                                                    557cd915170e475387df196db8ec7753acdc2345

                                                    SHA256

                                                    f1f877cac6e8dc835e128d7d2d8afef282f01f86110049cdabdc0238f4fff03b

                                                    SHA512

                                                    ac64f08d7253795e36aad19c160b80771de7a0667fd69a3a1cd573626002f1b6a988d6d71e7c03f6ef9664bae63b94bd46715d9c2e20cf3b9b11505eed751ef9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                                    Filesize

                                                    13KB

                                                    MD5

                                                    94669a8f499159d9d9aec4b83d1b7e95

                                                    SHA1

                                                    8ac9fde349fc2df730cd6e26e52ab8bb2aae015b

                                                    SHA256

                                                    1340b0548d4d4362c390b4ce7b0baf7de42862d6e9b2af5b4166bd914fae95fe

                                                    SHA512

                                                    95205e54901fa0f3dd3ae9638cc702a389071b32a164d566f146365282c87445be1d698a3b74718c8c2d342947d17409a11534ff89921a0c13dc5e302701a786

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    96c542dec016d9ec1ecc4dddfcbaac66

                                                    SHA1

                                                    6199f7648bb744efa58acf7b96fee85d938389e4

                                                    SHA256

                                                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                    SHA512

                                                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe
                                                    Filesize

                                                    2.2MB

                                                    MD5

                                                    b5a1474fcb8f7b9809d52546bd304af3

                                                    SHA1

                                                    8604fe586fa0d03adaa6608169a62c65c837de7d

                                                    SHA256

                                                    dc83dbd12c5a432a6c168982e55d6c7be89dd0bc4b915e3e93e3a97c8af0ab0d

                                                    SHA512

                                                    39931300c863c521957dd5d842c0c6e0d66d2b43663136375e21feb26181bd1c9d4494025e0e7a00b80b51405d1e67bfe825787e60c1b99998463b4e3a49a7ee

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016087001\c5ebece165.exe
                                                    Filesize

                                                    4.2MB

                                                    MD5

                                                    3a425626cbd40345f5b8dddd6b2b9efa

                                                    SHA1

                                                    7b50e108e293e54c15dce816552356f424eea97a

                                                    SHA256

                                                    ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                                    SHA512

                                                    a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016088001\d4b6dfc4ad.exe
                                                    Filesize

                                                    710KB

                                                    MD5

                                                    28e568616a7b792cac1726deb77d9039

                                                    SHA1

                                                    39890a418fb391b823ed5084533e2e24dff021e1

                                                    SHA256

                                                    9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                                                    SHA512

                                                    85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016089001\723960f0bf.exe
                                                    Filesize

                                                    4.3MB

                                                    MD5

                                                    052a4ed490c350bac29e342970146793

                                                    SHA1

                                                    b1ca7951818cce6a457206a76f2ac5d4f398c91a

                                                    SHA256

                                                    d0fb76445b064c723ad7eabb0e21c9f3a7265813b9c7f5ba14f6e9185359fb74

                                                    SHA512

                                                    4725951d0bb2b483472c4880c63e54d10e5512bcf2b82152e6129332861c7ba3e597b92765ad3bf350338a660b329a95f3a7ab47fd1b9acfe924c25c182e209b

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016090001\8b97e9ba95.exe
                                                    Filesize

                                                    384KB

                                                    MD5

                                                    dfd5f78a711fa92337010ecc028470b4

                                                    SHA1

                                                    1a389091178f2be8ce486cd860de16263f8e902e

                                                    SHA256

                                                    da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

                                                    SHA512

                                                    a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016091001\d7aa8dc02d.exe
                                                    Filesize

                                                    4.2MB

                                                    MD5

                                                    2453b4be7a014499138f1029edcbf013

                                                    SHA1

                                                    13087911bc9b06066f076d842b1ce8ac4688ac0c

                                                    SHA256

                                                    9cec95210688605c2d91081c1d9fbd75ca55b8f028f658d402aa1d288293983d

                                                    SHA512

                                                    838ef33c48f833759ce6f552728db4bdb567864612005535e0ebe81f2e71b85f74891b0c340ab5b1980bd0b63d1eac916784687cb3af5a4fffd88c3789094224

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016092001\753cff98f1.exe
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    6c1d0dabe1ec5e928f27b3223f25c26b

                                                    SHA1

                                                    e25ab704a6e9b3e4c30a6c1f7043598a13856ad9

                                                    SHA256

                                                    92228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d

                                                    SHA512

                                                    3a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016093001\c2d81904f5.exe
                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    259eb5422d10fd32691e5d0b5585bc0e

                                                    SHA1

                                                    b33a091415aa6e55ad88a901664b56b538100fc1

                                                    SHA256

                                                    5010145ced6d55e94ff13d6758e18aa89e387737f3a91c38d0839cd134a54cc5

                                                    SHA512

                                                    498614069c409bee2d78f10a4bb489f27f3651dc8a657116c729aa2daa8c480de4e6e1454864dac7f13f407ec6dbb4759d5f6279cccff84006b52de5ab4e8dea

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016094001\2136e45959.exe
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    e328245a28e6a2cdb14bde4d150a342e

                                                    SHA1

                                                    c768975f4fe3deed8d1cc677c8ada7395a394865

                                                    SHA256

                                                    03b0ee461554c9ecfcc906404caf95247f39959ad36fff125722870f27efa0b5

                                                    SHA512

                                                    4d6ad474e969cb85b29bc6319f6e84151d3267cc2ed28b22fb1b11d7e28597c98a1b2405eace53ca42cb1c5f77723fca3bf03bdaff243861593d00bf57e84ac0

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016095001\6c60b4f59d.exe
                                                    Filesize

                                                    947KB

                                                    MD5

                                                    f0367d03a91e16273b989532829233a6

                                                    SHA1

                                                    5e3d39961ee6c60c363ffb816a04c2c9ed3d9d56

                                                    SHA256

                                                    ed43a22ed526bd0af54d4d28694c7279bb459a3f54f51c557a256869569f71ba

                                                    SHA512

                                                    7dd0fdfde32b543cb3b72757562e9a68fbb5adde2c9a38960c575c15675bcc55249e21c17dba0ebc947e0a0782833272154af2908c06d24923293a89a0a8e021

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1016096001\3c03128558.exe
                                                    Filesize

                                                    2.7MB

                                                    MD5

                                                    ead473718663d9f85a4d487f8343bf82

                                                    SHA1

                                                    aa74f6c6b613bd5c7ed244f37dfa5cede287b8ef

                                                    SHA256

                                                    d15e8974d60859d550b2a5c20ea3644b4ed82a38644ec509d469bfb86ea95b9c

                                                    SHA512

                                                    4fd45893b47a48256af55c1d8fc1966138e97205888b723049b88060b4463a7b49b5694d254c54af525b84266b000db07e9905b0f30c98726e98f439b793cf4a

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\KKX49ZEQvJ
                                                    Filesize

                                                    116KB

                                                    MD5

                                                    f70aa3fa04f0536280f872ad17973c3d

                                                    SHA1

                                                    50a7b889329a92de1b272d0ecf5fce87395d3123

                                                    SHA256

                                                    8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                    SHA512

                                                    30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\LZthEGCsKS.bat
                                                    Filesize

                                                    171B

                                                    MD5

                                                    7489cf9937751b1e1c8b466ee5a559c2

                                                    SHA1

                                                    8509029094b52df2cddc7171f0118efb854ca5d5

                                                    SHA256

                                                    f342335f5fd22f5ea1c1d4115c540ddb5e6f9fe6537076401be24fb2a104e281

                                                    SHA512

                                                    748ef4d3ff37eccb89db4ce776f4401062934d8ff7b739cbc118c098436dea9f31e2bd56cb6a6d940a2dc19b6bc0be6801f01e09b7f7da7654696fbe2c354c4d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\WbAwQbr3hp
                                                    Filesize

                                                    114KB

                                                    MD5

                                                    2dc3133caeb5792be5e5c6c2fa812e34

                                                    SHA1

                                                    0ed75d85c6a2848396d5dd30e89987f0a8b5cedb

                                                    SHA256

                                                    4b3998fd2844bc1674b691c74d67e56062e62bf4738de9fe7fb26b8d3def9cd7

                                                    SHA512

                                                    2ca157c2f01127115d0358607c167c2f073b83d185bdd44ac221b3792c531d784515a76344585ec1557de81430a7d2e69b286155986e46b1e720dfac96098612

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uh1qqv5r.lsd.ps1
                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                    Filesize

                                                    2.9MB

                                                    MD5

                                                    842e251ca1e3a812356248ebe8154f16

                                                    SHA1

                                                    efb511d328cf0a7690e62cbb89adeebc07dddb3c

                                                    SHA256

                                                    14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a

                                                    SHA512

                                                    2eaf72c87cda80fcc64463eda29ad62e21818bac52105af0b95c5504c935e7f480cba518575fad8f80d0748e11e41641063cb8b6e61da8584271e1068d7f3b74

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\e3Bj3f4JLn
                                                    Filesize

                                                    40KB

                                                    MD5

                                                    a182561a527f929489bf4b8f74f65cd7

                                                    SHA1

                                                    8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                    SHA256

                                                    42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                    SHA512

                                                    9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                                                    Filesize

                                                    1.6MB

                                                    MD5

                                                    72491c7b87a7c2dd350b727444f13bb4

                                                    SHA1

                                                    1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                    SHA256

                                                    34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                    SHA512

                                                    583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                    Filesize

                                                    458KB

                                                    MD5

                                                    619f7135621b50fd1900ff24aade1524

                                                    SHA1

                                                    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                    SHA256

                                                    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                    SHA512

                                                    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
                                                    Filesize

                                                    2.2MB

                                                    MD5

                                                    579a63bebccbacab8f14132f9fc31b89

                                                    SHA1

                                                    fca8a51077d352741a9c1ff8a493064ef5052f27

                                                    SHA256

                                                    0ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0

                                                    SHA512

                                                    4a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    5659eba6a774f9d5322f249ad989114a

                                                    SHA1

                                                    4bfb12aa98a1dc2206baa0ac611877b815810e4c

                                                    SHA256

                                                    e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4

                                                    SHA512

                                                    f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    5404286ec7853897b3ba00adf824d6c1

                                                    SHA1

                                                    39e543e08b34311b82f6e909e1e67e2f4afec551

                                                    SHA256

                                                    ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266

                                                    SHA512

                                                    c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    5eb39ba3698c99891a6b6eb036cfb653

                                                    SHA1

                                                    d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

                                                    SHA256

                                                    e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

                                                    SHA512

                                                    6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    7187cc2643affab4ca29d92251c96dee

                                                    SHA1

                                                    ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                                                    SHA256

                                                    c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                                                    SHA512

                                                    27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    b7d1e04629bec112923446fda5391731

                                                    SHA1

                                                    814055286f963ddaa5bf3019821cb8a565b56cb8

                                                    SHA256

                                                    4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                                                    SHA512

                                                    79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    0dc4014facf82aa027904c1be1d403c1

                                                    SHA1

                                                    5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                                                    SHA256

                                                    a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                                                    SHA512

                                                    cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                                                    Filesize

                                                    3.3MB

                                                    MD5

                                                    cea368fc334a9aec1ecff4b15612e5b0

                                                    SHA1

                                                    493d23f72731bb570d904014ffdacbba2334ce26

                                                    SHA256

                                                    07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                                                    SHA512

                                                    bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                                                    Filesize

                                                    3.3MB

                                                    MD5

                                                    045b0a3d5be6f10ddf19ae6d92dfdd70

                                                    SHA1

                                                    0387715b6681d7097d372cd0005b664f76c933c7

                                                    SHA256

                                                    94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                                                    SHA512

                                                    58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                                                    Filesize

                                                    440B

                                                    MD5

                                                    3626532127e3066df98e34c3d56a1869

                                                    SHA1

                                                    5fa7102f02615afde4efd4ed091744e842c63f78

                                                    SHA256

                                                    2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                                                    SHA512

                                                    dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                    Filesize

                                                    479KB

                                                    MD5

                                                    09372174e83dbbf696ee732fd2e875bb

                                                    SHA1

                                                    ba360186ba650a769f9303f48b7200fb5eaccee1

                                                    SHA256

                                                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                    SHA512

                                                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                    Filesize

                                                    13.8MB

                                                    MD5

                                                    0a8747a2ac9ac08ae9508f36c6d75692

                                                    SHA1

                                                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                    SHA256

                                                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                    SHA512

                                                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    83d75087c9bf6e4f07c36e550731ccde

                                                    SHA1

                                                    d5ff596961cce5f03f842cfd8f27dde6f124e3ae

                                                    SHA256

                                                    46db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f

                                                    SHA512

                                                    044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                                                    Filesize

                                                    6KB

                                                    MD5

                                                    1ea1638cd81beae7b4c69f905c82ae4a

                                                    SHA1

                                                    4639d92e8d222f1a576fc5ed176724d9d6cee1eb

                                                    SHA256

                                                    260edb5c69ddcce2bd7f3227a792911cbac9ab18b0cb466448e8ba132ea3f671

                                                    SHA512

                                                    1d58692375272ad1b3c40c01a944a112f2ac49379cebf99d842296b5a23f38aeec51b71d697026a10d47633fae94c52b0c41c80771fa5e43de819a564aec9a99

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                                                    Filesize

                                                    8KB

                                                    MD5

                                                    7651b298bfe835e71ff39a5569959aae

                                                    SHA1

                                                    46fa315c9236494992b554c2b6c96361a8e0e75b

                                                    SHA256

                                                    abbb5f91a53f41860768e34361b5dd529cdbe5fba2e3b630308039df1ec277f4

                                                    SHA512

                                                    b99de355ff939a09f7b9e7b45336c376f8f3162c5e5ab02c7ca888c882ad6c4d4e04e62dc50411d46710b963b5c7e05b1dd1812bdbc580d550761bd8be2d56ed

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    5KB

                                                    MD5

                                                    b7343ecf0c10c0865ba2b1be2bd2d390

                                                    SHA1

                                                    33bab06787c0ae3b591a0035122e77a02adfd6fc

                                                    SHA256

                                                    1e15845923c20c0a1fda5d00a74ba14769fb1b4a444a179728825a5b126cbe3f

                                                    SHA512

                                                    65fe3324e7d1d989582cd8a12e39f28b836a97b7b39c6c4a574caec109f4d187840be5afd7adb208ed11ab2240f0e3414a9544ba25c92952aa3c2e0eae4838b5

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    6eacba0f3627b821116a19c4d7000c79

                                                    SHA1

                                                    7a6e8f1b5188c1096e20336e0937a1ec19da18f6

                                                    SHA256

                                                    f465216ed262eb5a0c95b24b7acad50cc1c2f231443dde2c795de234fe025c54

                                                    SHA512

                                                    63c4e69b196c29ccd7043fab11a9961193664cb9e7fb2272a9f5aaf03a4795801bf2a0f36bfc277a9fb4c665625331afe3083791f45c9019808a60949992d3ee

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\4214ce3a-45ae-4acc-b586-094e2638bb0e
                                                    Filesize

                                                    26KB

                                                    MD5

                                                    f6e5791c694e7850dd4d525b1bd1e11d

                                                    SHA1

                                                    ec527b46d5f2fa975313aa2f34207a1be9b7c847

                                                    SHA256

                                                    ecc5b47494c54664f061f1a2ea7b6a1b198df85cbbea60c81d62069cee0e6b58

                                                    SHA512

                                                    4adb786362ddcccda681c6f7b588b256247adef1e95b98138bf46c843abef1aa0e787a665b596db74025e2c69c0a334dd5e384cb798b297cbfd9d94c743b7b66

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\5f54c2be-0a93-4516-b1c6-12182b005801
                                                    Filesize

                                                    982B

                                                    MD5

                                                    beba4096c30bfdadd83c0d9c0df1a968

                                                    SHA1

                                                    10b0a69f683d1719ad4c36e40549684d55bee644

                                                    SHA256

                                                    53510768346efd680f76cae05f199bb8620f7e0e28200f09f40033b4b6361e93

                                                    SHA512

                                                    b32b017e0c0949a0ca88d0923e420901157615af1b74ed9132240aa2b5e69a0e7733972ca9d4fba8aee4da5cefd05ede7620f34431615bc6b02ad7894bd8a040

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\e0813cc9-2c08-4cbe-831e-c5c5464872c3
                                                    Filesize

                                                    671B

                                                    MD5

                                                    7b96ff9e85c6ed1878a618897ed1cf36

                                                    SHA1

                                                    750bea1a5d9c62d4f7b0524504b103345cc5b668

                                                    SHA256

                                                    4ad489a079f79c35bf911420c2799ac31c83f577f888941e3b18a2f3dc3b4a04

                                                    SHA512

                                                    a579f02523760bbeaab81028c8efc2274b8cb70dbc90fd862ab1e614f41441202be47bd32cb74520f65a4b9bc7b8dff98200f4a0a4f453552089d0fc94e45005

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    842039753bf41fa5e11b3a1383061a87

                                                    SHA1

                                                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                    SHA256

                                                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                    SHA512

                                                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                    Filesize

                                                    116B

                                                    MD5

                                                    2a461e9eb87fd1955cea740a3444ee7a

                                                    SHA1

                                                    b10755914c713f5a4677494dbe8a686ed458c3c5

                                                    SHA256

                                                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                    SHA512

                                                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                    Filesize

                                                    372B

                                                    MD5

                                                    bf957ad58b55f64219ab3f793e374316

                                                    SHA1

                                                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                    SHA256

                                                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                    SHA512

                                                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                    Filesize

                                                    17.8MB

                                                    MD5

                                                    daf7ef3acccab478aaa7d6dc1c60f865

                                                    SHA1

                                                    f8246162b97ce4a945feced27b6ea114366ff2ad

                                                    SHA256

                                                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                    SHA512

                                                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    e0a92ca09372ddc0b0a07909da4dda59

                                                    SHA1

                                                    02d901e76960255eabf52ae354839a9039e6cacc

                                                    SHA256

                                                    99d8de65841e05817d488dab0a63062df4d88a15e4e8af4b2939423ad067e46d

                                                    SHA512

                                                    4448eae4961358b16cd00f85fb8992bb3c368b1adddb890d09ab2491f0c34a3e2ff6a67f297ce1de911cd70d4bafeb4de984023b345f339064e505329d9b0767

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    3fd12746735d354534cf743896aee54d

                                                    SHA1

                                                    07f5cdcf09fe68a2282685563ebfc731657f12ff

                                                    SHA256

                                                    4200fe015f622ba8d3875eadf76e19ca38bf5f45e9254df45c0130147e25f597

                                                    SHA512

                                                    70a5a3c310f8d787922ada549418f4b7d1f03add08e99df55a0cc30a0f071ccb2c60d3f9e1ede6c79f8a3eb643884627d1204f6124b6bfd24dd1b9a05814f0dd

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    a09d7d93a66be78eb30ef61948567fd0

                                                    SHA1

                                                    e4d00d2a78e9bd57dfc4d099629dba81c524ee8a

                                                    SHA256

                                                    f89e8493d29030c4623126f4e875bab23808c6077df12f606ce9291268aa0a0c

                                                    SHA512

                                                    389a37e48da7ee59e7a5e301d641ba8ce869afcb4815753afa4dbc3a6bab46454194c7daff7a31710d39a33f5531684a9a7a6ee44ab279a303f87f5f6210a789

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                    Filesize

                                                    2.5MB

                                                    MD5

                                                    9f3d08db6bfdb14ede00ec78f3e36d47

                                                    SHA1

                                                    e516ca95da7c3028e815836df13a1143e8c9e842

                                                    SHA256

                                                    2ab39450cd2b28864abb1072d8d876a0769683839a6ecf260624eb1caadf29df

                                                    SHA512

                                                    d6ea5e1c03d2a2becabee67af1a05dfabaeca7f942b390b124016030718bd96bb4c003e927f837925463e43ebf55ddb16da1a886b78117ed2616e0bf4b7ba90d

                                                    Download Submit

                                                  • memory/232-392-0x0000000000B50000-0x0000000000FF3000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/232-391-0x0000000000B50000-0x0000000000FF3000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/232-844-0x0000000000B50000-0x0000000000FF3000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/232-850-0x0000000000B50000-0x0000000000FF3000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/232-312-0x0000000000B50000-0x0000000000FF3000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/392-4142-0x00007FF629970000-0x00007FF629E00000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/1440-148-0x00007FF6BF920000-0x00007FF6BFDB0000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/1440-150-0x00007FF6BF920000-0x00007FF6BFDB0000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/1692-295-0x0000000000AB0000-0x0000000000F3B000-memory.dmp

                                                    Filesize

                                                    4.5MB

                                                    Download

                                                  • memory/1692-690-0x0000000000AB0000-0x0000000000F3B000-memory.dmp

                                                    Filesize

                                                    4.5MB

                                                    Download

                                                  • memory/1692-337-0x0000000000AB0000-0x0000000000F3B000-memory.dmp

                                                    Filesize

                                                    4.5MB

                                                    Download

                                                  • memory/1692-354-0x0000000000AB0000-0x0000000000F3B000-memory.dmp

                                                    Filesize

                                                    4.5MB

                                                    Download

                                                  • memory/2540-745-0x0000000000400000-0x0000000000AA0000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/2540-636-0x0000000000400000-0x0000000000AA0000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/2540-338-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                    Filesize

                                                    972KB

                                                    Download

                                                  • memory/2540-335-0x0000000000400000-0x0000000000AA0000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/2540-992-0x0000000000400000-0x0000000000AA0000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/2540-891-0x0000000000400000-0x0000000000AA0000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/2756-46-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-310-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-21-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-45-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-839-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-964-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-390-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-213-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-4125-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-19-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-4114-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-20-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-15-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-4121-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-170-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2756-1675-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/3016-3-0x0000000000520000-0x000000000083B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/3016-4-0x0000000000520000-0x000000000083B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/3016-18-0x0000000000520000-0x000000000083B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/3016-161-0x000001F048FC0000-0x000001F048FE2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/3016-0-0x0000000000520000-0x000000000083B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/3016-2-0x0000000000521000-0x000000000054F000-memory.dmp

                                                    Filesize

                                                    184KB

                                                    Download

                                                  • memory/3016-1-0x00000000772D4000-0x00000000772D6000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/3192-244-0x0000000000220000-0x0000000000E89000-memory.dmp

                                                    Filesize

                                                    12.4MB

                                                    Download

                                                  • memory/3192-246-0x0000000000220000-0x0000000000E89000-memory.dmp

                                                    Filesize

                                                    12.4MB

                                                    Download

                                                  • memory/3756-165-0x0000000000400000-0x0000000000457000-memory.dmp

                                                    Filesize

                                                    348KB

                                                    Download

                                                  • memory/3756-167-0x0000000000400000-0x0000000000457000-memory.dmp

                                                    Filesize

                                                    348KB

                                                    Download

                                                  • memory/4028-635-0x000000001BFD0000-0x000000001C000000-memory.dmp

                                                    Filesize

                                                    192KB

                                                    Download

                                                  • memory/4088-250-0x00000000006D0000-0x000000000130B000-memory.dmp

                                                    Filesize

                                                    12.2MB

                                                    Download

                                                  • memory/4088-251-0x00000000006D0000-0x000000000130B000-memory.dmp

                                                    Filesize

                                                    12.2MB

                                                    Download

                                                  • memory/4088-277-0x00000000006D0000-0x000000000130B000-memory.dmp

                                                    Filesize

                                                    12.2MB

                                                    Download

                                                  • memory/4088-186-0x00000000006D0000-0x000000000130B000-memory.dmp

                                                    Filesize

                                                    12.2MB

                                                    Download

                                                  • memory/4188-423-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-722-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-416-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-415-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-411-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-410-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-407-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-406-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-744-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-719-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4188-721-0x0000000000700000-0x0000000000720000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4188-432-0x0000000140000000-0x0000000140770000-memory.dmp

                                                    Filesize

                                                    7.4MB

                                                    Download

                                                  • memory/4524-214-0x0000000000400000-0x000000000064B000-memory.dmp

                                                    Filesize

                                                    2.3MB

                                                    Download

                                                  • memory/4808-991-0x0000000000C60000-0x0000000000F7B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/4808-980-0x0000000000C60000-0x0000000000F7B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/5060-233-0x0000000003160000-0x000000000316C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/5060-231-0x0000000003150000-0x000000000315E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/5060-221-0x000000001BB80000-0x000000001BB98000-memory.dmp

                                                    Filesize

                                                    96KB

                                                    Download

                                                  • memory/5060-219-0x000000001C050000-0x000000001C0A0000-memory.dmp

                                                    Filesize

                                                    320KB

                                                    Download

                                                  • memory/5060-218-0x000000001BB60000-0x000000001BB7C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/5060-216-0x0000000003140000-0x000000000314E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/5060-254-0x000000001C4A0000-0x000000001C649000-memory.dmp

                                                    Filesize

                                                    1.7MB

                                                    Download

                                                  • memory/5060-212-0x0000000000E40000-0x0000000001026000-memory.dmp

                                                    Filesize

                                                    1.9MB

                                                    Download

                                                  • memory/5200-405-0x00007FF629970000-0x00007FF629E00000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/5200-748-0x00007FF629970000-0x00007FF629E00000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/5572-394-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/5572-396-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/5784-930-0x00000000008D0000-0x0000000000B92000-memory.dmp

                                                    Filesize

                                                    2.8MB

                                                    Download

                                                  • memory/5784-859-0x00000000008D0000-0x0000000000B92000-memory.dmp

                                                    Filesize

                                                    2.8MB

                                                    Download

                                                  • memory/5784-733-0x00000000008D0000-0x0000000000B92000-memory.dmp

                                                    Filesize

                                                    2.8MB

                                                    Download

                                                  • memory/5784-735-0x00000000008D0000-0x0000000000B92000-memory.dmp

                                                    Filesize

                                                    2.8MB

                                                    Download

                                                  • memory/5784-697-0x00000000008D0000-0x0000000000B92000-memory.dmp

                                                    Filesize

                                                    2.8MB

                                                    Download

                                                  • memory/6592-4126-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/6592-4128-0x0000000000220000-0x000000000053B000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/6788-1085-0x00000000003F0000-0x0000000000A90000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/6788-974-0x00000000003F0000-0x0000000000A90000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/6788-975-0x00000000003F0000-0x0000000000A90000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/6788-851-0x00000000003F0000-0x0000000000A90000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download