amadey | 7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
Size

2.8MB
MD5

d25093727ab627d2341cd201fe50aced
SHA1

6b07b24d1f8ef46df171bba3224bd8dee8cdf4eb
SHA256

7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe
SHA512

88370155272ffa5c05254d08b1e20e84454abdab54cb456bcd6db3ad621f2dd315a92c2f861d3b923bdd4ba769952d92f587afa30b2d6d736fa6b319d7ede714
SSDEEP

49152:+L54nO2j2+W+/3/9ycpKfY/X6iP/Rm3bVib3jWLtXFIW:+L54nOM2+WqFM4qiAi3j+1F

Score

10^/10

amadey lumma stealc 9c9aa5 stok credential_access discovery evasion spyware stealer trojan upx

Malware Config

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2604 created 1144	2604	600450e26f.exe	20

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	b825620d3d.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b825620d3d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	600450e26f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0ff5ea4cbe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	IDBFHJDAAF.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2348	chrome.exe
1600	chrome.exe
1108	chrome.exe
2588	chrome.exe
2648	chrome.exe
1856	chrome.exe
2528	chrome.exe
1364	chrome.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IDBFHJDAAF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b825620d3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	600450e26f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	600450e26f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0ff5ea4cbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IDBFHJDAAF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b825620d3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0ff5ea4cbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe

Executes dropped EXE 22 IoCs

pid	Process
2644	IDBFHJDAAF.exe
3044	skotes.exe
1264	8oMoEDZ.exe
1888	8oMoEDZ.exe
1972	AwT7h8g.exe
2928	06295ffb1b.exe
2352	06295ffb1b.exe
1620	b825620d3d.exe
2604	600450e26f.exe
1524	3f22d88980.exe
2176	7z.exe
2800	7z.exe
1624	7z.exe
2912	7z.exe
1152	7z.exe
1700	7z.exe
2892	7z.exe
1852	7z.exe
2880	in.exe
1900	0ff5ea4cbe.exe
1592	Intel_PTT_EK_Recertification.exe
1648	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	600450e26f.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	0ff5ea4cbe.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	IDBFHJDAAF.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	b825620d3d.exe

Loads dropped DLL 44 IoCs

pid	Process
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
1192	cmd.exe
1192	cmd.exe
2644	IDBFHJDAAF.exe
2644	IDBFHJDAAF.exe
3044	skotes.exe
3044	skotes.exe
1264	8oMoEDZ.exe
3044	skotes.exe
1972	AwT7h8g.exe
3044	skotes.exe
3044	skotes.exe
2928	06295ffb1b.exe
3044	skotes.exe
3044	skotes.exe
3044	skotes.exe
3044	skotes.exe
2612	cmd.exe
2176	7z.exe
2612	cmd.exe
2800	7z.exe
2612	cmd.exe
1624	7z.exe
2612	cmd.exe
2912	7z.exe
2612	cmd.exe
1152	7z.exe
2612	cmd.exe
1700	7z.exe
2612	cmd.exe
2892	7z.exe
2612	cmd.exe
1852	7z.exe
2612	cmd.exe
2612	cmd.exe
3044	skotes.exe
3044	skotes.exe
2224	taskeng.exe
2224	taskeng.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2224	taskeng.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
2644	IDBFHJDAAF.exe
3044	skotes.exe
1620	b825620d3d.exe
2604	600450e26f.exe
1900	0ff5ea4cbe.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1264 set thread context of 1888	1264	8oMoEDZ.exe	63
PID 2928 set thread context of 2352	2928	06295ffb1b.exe	68
PID 1592 set thread context of 2836	1592	Intel_PTT_EK_Recertification.exe	98
PID 1648 set thread context of 2036	1648	Intel_PTT_EK_Recertification.exe	105

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2880-707-0x000000013F340000-0x000000013F7D0000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	IDBFHJDAAF.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	1620	WerFault.exe	69

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AwT7h8g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06295ffb1b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f22d88980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDBFHJDAAF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8oMoEDZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8oMoEDZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06295ffb1b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b825620d3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	600450e26f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2072	powershell.exe
1188	PING.EXE
2240	powershell.exe
1796	PING.EXE
1700	powershell.exe
2520	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1188	PING.EXE
1796	PING.EXE
2520	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
2588	chrome.exe
2588	chrome.exe
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
1364	chrome.exe
1364	chrome.exe
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
2644	IDBFHJDAAF.exe
3044	skotes.exe
1888	8oMoEDZ.exe
1888	8oMoEDZ.exe
1888	8oMoEDZ.exe
1888	8oMoEDZ.exe
2352	06295ffb1b.exe
2352	06295ffb1b.exe
2352	06295ffb1b.exe
2352	06295ffb1b.exe
1620	b825620d3d.exe
1620	b825620d3d.exe
1620	b825620d3d.exe
1620	b825620d3d.exe
1620	b825620d3d.exe
1620	b825620d3d.exe
2604	600450e26f.exe
2604	600450e26f.exe
2604	600450e26f.exe
2604	600450e26f.exe
2604	600450e26f.exe
2496	dialer.exe
2496	dialer.exe
2496	dialer.exe
2496	dialer.exe
2072	powershell.exe
1900	0ff5ea4cbe.exe
1592	Intel_PTT_EK_Recertification.exe
2240	powershell.exe
1648	Intel_PTT_EK_Recertification.exe
1700	powershell.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	2588	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeShutdownPrivilege	1364	chrome.exe
Token: SeRestorePrivilege	2176	7z.exe
Token: 35	2176	7z.exe
Token: SeSecurityPrivilege	2176	7z.exe
Token: SeSecurityPrivilege	2176	7z.exe
Token: SeRestorePrivilege	2800	7z.exe
Token: 35	2800	7z.exe
Token: SeSecurityPrivilege	2800	7z.exe
Token: SeSecurityPrivilege	2800	7z.exe
Token: SeRestorePrivilege	1624	7z.exe
Token: 35	1624	7z.exe
Token: SeSecurityPrivilege	1624	7z.exe
Token: SeSecurityPrivilege	1624	7z.exe
Token: SeRestorePrivilege	2912	7z.exe
Token: 35	2912	7z.exe
Token: SeSecurityPrivilege	2912	7z.exe
Token: SeSecurityPrivilege	2912	7z.exe
Token: SeRestorePrivilege	1152	7z.exe
Token: 35	1152	7z.exe
Token: SeSecurityPrivilege	1152	7z.exe
Token: SeSecurityPrivilege	1152	7z.exe
Token: SeRestorePrivilege	1700	7z.exe
Token: 35	1700	7z.exe
Token: SeSecurityPrivilege	1700	7z.exe
Token: SeSecurityPrivilege	1700	7z.exe
Token: SeRestorePrivilege	2892	7z.exe
Token: 35	2892	7z.exe
Token: SeSecurityPrivilege	2892	7z.exe
Token: SeSecurityPrivilege	2892	7z.exe
Token: SeRestorePrivilege	1852	7z.exe
Token: 35	1852	7z.exe
Token: SeSecurityPrivilege	1852	7z.exe
Token: SeSecurityPrivilege	1852	7z.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeLockMemoryPrivilege	2836	explorer.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeLockMemoryPrivilege	2036	explorer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2588	chrome.exe
1364	chrome.exe
2644	IDBFHJDAAF.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2588	2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe	32
PID 2128 wrote to memory of 2588	2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe	32
PID 2128 wrote to memory of 2588	2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe	32
PID 2128 wrote to memory of 2588	2128	7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe	32
PID 2588 wrote to memory of 2688	2588	chrome.exe	33
PID 2588 wrote to memory of 2688	2588	chrome.exe	33
PID 2588 wrote to memory of 2688	2588	chrome.exe	33
PID 2588 wrote to memory of 2840	2588	chrome.exe	34
PID 2588 wrote to memory of 2840	2588	chrome.exe	34
PID 2588 wrote to memory of 2840	2588	chrome.exe	34
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 2440	2588	chrome.exe	36
PID 2588 wrote to memory of 1452	2588	chrome.exe	37
PID 2588 wrote to memory of 1452	2588	chrome.exe	37
PID 2588 wrote to memory of 1452	2588	chrome.exe	37
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38
PID 2588 wrote to memory of 2928	2588	chrome.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2792	attrib.exe
1860	attrib.exe
2600	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1144
- C:\Users\Admin\AppData\Local\Temp\7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe
  "C:\Users\Admin\AppData\Local\Temp\7c6db97652d5ad2abf6cb771b616013a2c307988779024c735ffc27f17736afe.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7219758,0x7fef7219768,0x7fef7219778
      4⤵
      PID:2688
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:2840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1232,i,8195051632350447176,12267432558760600235,131072 /prefetch:2
      4⤵
      PID:2440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1232,i,8195051632350447176,12267432558760600235,131072 /prefetch:8
      4⤵
      PID:1452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1664 --field-trial-handle=1232,i,8195051632350447176,12267432558760600235,131072 /prefetch:8
      4⤵
      PID:2928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2228 --field-trial-handle=1232,i,8195051632350447176,12267432558760600235,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2544 --field-trial-handle=1232,i,8195051632350447176,12267432558760600235,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2656 --field-trial-handle=1232,i,8195051632350447176,12267432558760600235,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=1232,i,8195051632350447176,12267432558760600235,131072 /prefetch:2
      4⤵
      PID:1468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67c9758,0x7fef67c9768,0x7fef67c9778
      4⤵
      PID:2684
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:1496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1232,i,560091186710179929,15033755399002836023,131072 /prefetch:2
      4⤵
      PID:1708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1232,i,560091186710179929,15033755399002836023,131072 /prefetch:8
      4⤵
      PID:1992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1232,i,560091186710179929,15033755399002836023,131072 /prefetch:8
      4⤵
      PID:1672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2368 --field-trial-handle=1232,i,560091186710179929,15033755399002836023,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2516 --field-trial-handle=1232,i,560091186710179929,15033755399002836023,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2752 --field-trial-handle=1232,i,560091186710179929,15033755399002836023,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1232,i,560091186710179929,15033755399002836023,131072 /prefetch:2
      4⤵
      PID:1636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 --field-trial-handle=1232,i,560091186710179929,15033755399002836023,131072 /prefetch:8
      4⤵
      PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\IDBFHJDAAF.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1192
  - - C:\Users\Admin\Documents\IDBFHJDAAF.exe
      "C:\Users\Admin\Documents\IDBFHJDAAF.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\1016608001\8oMoEDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016608001\8oMoEDZ.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\1016608001\8oMoEDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016608001\8oMoEDZ.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\1016610001\AwT7h8g.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016610001\AwT7h8g.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\1016643001\06295ffb1b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016643001\06295ffb1b.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\1016643001\06295ffb1b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016643001\06295ffb1b.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\1016644001\b825620d3d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016644001\b825620d3d.exe"
        6⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 656
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\1016645001\600450e26f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016645001\600450e26f.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\1016646001\3f22d88980.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016646001\3f22d88980.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1524
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        7⤵
        Loads dropped DLL
        
        PID:2612
        
        C:\Windows\system32\mode.com
        
        mode 65,10
        8⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
        
        C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        8⤵
        Views/modifies file attributes
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        8⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        9⤵
        Views/modifies file attributes
        
        PID:2600
        
        C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        9⤵
        Views/modifies file attributes
        
        PID:1860
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\1016647001\0ff5ea4cbe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016647001\0ff5ea4cbe.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1900
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2496

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1604

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1692

C:\Windows\system32\taskeng.exe
taskeng.exe {B2EF3B28-B550-4961-B90C-2B0F360B87C2} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:2224
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1796
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0bf50856-aa0c-4b1f-a231-ef4aff198dfe.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
502556fad727f7c447fc28135de3cf2c

SHA1
70af52f16505c2fcccbba3475583fd14050facf2

SHA256
9c92f4a7f1a6cb1b3aaf51837ce0186056c8ca475b90a6dd3a534e94910a88d6

SHA512
95a8526b8251e0d12829c84e71238f00137d71fc1438097c3a5bcf8050db663aeb91cb96d88df2b173c652565a3fddc798ad1251a60de83f142a68c7d0e3cb2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
d8676741b7656b15c5701850e65fc0bc

SHA1
8c86e54472e891076038df7bb93db1cf81c44b0a

SHA256
073e55986e699d87e2ac7a1cb0f7379762d9cab7d17542b87d54bbbb31aad22d

SHA512
61ae97476bd4b2846da5595a071172aa19403eae6df80f3312d71282cb497862593f755d75a7a1e0561033560d10fcdb6fdab823e34739b78dc58fca404f8e06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

Filesize
192B

MD5
2116edccd5abe6c75fed8f3e08af21e5

SHA1
77a7ab19c34e7f75b727a83dc5ac976b9a7a469d

SHA256
f81c6982c8de587a5039627999f6ea6995df53c657eb0c7a9f023e5af3b6572e

SHA512
be7eaa32dbc064afd1c6b712bd962e9212b9ab27c0c2e3fae8777bd63e6704da8043f37a103bd0e07da94f3c1e5e33cd802a6f929f087e039dbffe55cf5a46e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Login Data For Account

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

Filesize
204B

MD5
4cc7a00a083b6a1c8976d3aca6dab5aa

SHA1
b61248a765fb948404e240de8b103ec82d103af8

SHA256
10e5e71d547fba51fe31735234e2c510749ed7185c3ef96c99005bf5d1f139de

SHA512
576f82e1f44fae3a1a5898d01afba74e8f9a7e1afb32dca23e9564b7b91c810860563258b08145bb1b1bec7febd551fc9ce5e88ee0781fd4b0fcf3185ebecb08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

Filesize
192B

MD5
2053bc2be932c5dc8f9e93c56ea57168

SHA1
d96a095492068983e74a07bf3b33316ce0019130

SHA256
a06cfae0fe848b933442539e7fc266a82a8e6ed0d4825320ee8ba56132f05be3

SHA512
9e5bf6fb71f1c0b02c16ca99e856e1a6a1b853343f08846d5d0fc760dbab3056d9c283111274cb021725d3244bcc8e9fd57b3f75b8afc2af6185754dafb2c8c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

Filesize
128KB

MD5
2e07bbf56e201b80b49d793916158931

SHA1
77d568b2f7fb6c1b1e1a7da5dd31597b2db7ea14

SHA256
c891147da9863ab6e9ba68fdf05b44e5d14dcce5168808d73f1c989e4e039276

SHA512
805bffb0eeb5dbbb73a5c26c2f82f0a58c34c7c74794102bfbdbe70c3d71dfbd43cba46c5f0b1cc06edb6a136ae26d2a83b5228d336147911c0c6b6dea01ad9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
eee76d98aaff5fd15a7b2a143899bc9e

SHA1
54438d42f401d30b065ec0009c77b6ce7f53c362

SHA256
f9d4ab8d7b3efa3ffb080af0cf85054a403bf6366e447ea20c2ad36ce0a8cb6c

SHA512
7dc3bab7f61b5357e1381c6d5d83cdd3d58dc2a5c01dad57ebdf014efbb8ee71701bddcd1dda60afbedd885fd235f570ba6f43780ae6fe3f3c1f7c34e0a3a208

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
fd55e1633e4203d650d83bf196dc1ff8

SHA1
ea0bb93ee042788a9cbf699f939269f60f5d59db

SHA256
545d35124930ecd93926706b3f23aa34a6d90ec63b76e60052ff7578ca42a8c9

SHA512
9ca743a4051d467af3f72ac1eb697aad70c2dafacc656ef31dfd00b0119bbe2584903690be7f725a8048a17fe4b7294da191f263258b1c14d07ad4aff19e698d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

Filesize
193B

MD5
4e20427afcdda02b154a487c367e13d0

SHA1
aeca6f8c04689ecb1f348d0c30ce743c55879d83

SHA256
93b9dd6089cd60463a04041dd2cf13b5582a5b3e21744ef4ec616f58867efa12

SHA512
4639d4f6adfa2e297b141789d4de95f388fa41e4c7c0c446fac0510fdfed13103dbba860873b0fd67a50c9cd02a01fc0d04ce94c8b26934ec4db66aefa636d9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Local Storage\leveldb\LOG

Filesize
197B

MD5
9c1573ec7287754b70f50787ad43a0f8

SHA1
ff6d6beb37f378fbab2991b381bcd6ef3c7a5a89

SHA256
a9c3375dfedd5609ba608d95f571f86e6ee2c005ef6996b6a54caed29055f17c

SHA512
d7230127ee7299748d560fa9b0d87299ce3cbb41f234ae427e350df1e96f860cdf45bfb2fe8aca997d6460da40c4805093061a93f0cd02a0e612cf8d332b0ad4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

Filesize
205B

MD5
ae830d9a69e4d85b851ef5d3b7c402dd

SHA1
1ce7ee83f55d5fd9ad1982503befbadc14a70720

SHA256
266c7f8b401be0b52e128411fa48e0738a2bb9b8f2a8b2657e716e48760e5f71

SHA512
71d734a71522d548037df5014465ad1f550468a8476964f337812897a5688284467474615807726bdc387bf7ac9964df0805f354b84729f2ff44cd6b2e3a4a3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

Filesize
193B

MD5
4d527d4a6ba17ac9a517d1a72dbb4ac6

SHA1
7b2173595fed284c52738dd22a4215fbeefdf1fa

SHA256
0605820c65c55f05f20b91117b84a58ae12aa8e4a8959daef8f9b5ff913da5ce

SHA512
9954508a0f8204558a80495740fde5a43887a379bad51ff3f2d32c32f0ca87ff38293f7bd9b03bf5fa46811d0e554896220fbf6a8def71527a1bcfad141e5803

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
a28c72e967d615b0d1a3b3b7799c61f6

SHA1
ba4f0c2a36376bcde1611eaccc88def2ce9c60fc

SHA256
769d19e8e4d84bf62887148f9036bc6c7257befecf766f8cd788ecadf893c805

SHA512
97104f7bc3c8aeb142d3be6a45ca15ef9180b12c324ffd21f393f937e3d21fdf9a93512d3b9670dd6eea7d5fc58f817a41bd0ead4606e4e945086d37001cd0c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Web Data

Filesize
92KB

MD5
a606b0552e40710340983d8bfd601e3f

SHA1
3c1dd97d20b122044432f54f2ac34518a68f25d5

SHA256
8f5a5e416af2e8a7196046b781f86666eda592b6ac7ea226a9866453e0890c4e

SHA512
64af7e81e6630ab4e9fd1182b616d3dd3cb3bc921134f6ef7ff00d0ffd2e6a2c8fdd325b5f11ee198bc43ca0c3c8ea87442299b0cefec9b198da058a372f44b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016608001\8oMoEDZ.exe

Filesize
747KB

MD5
8a9cb17c0224a01bd34b46495983c50a

SHA1
00296ea6a56f6e10a0f1450a20c5fb329b8856c1

SHA256
3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

SHA512
1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016610001\AwT7h8g.exe

Filesize
625KB

MD5
bc6009246c4e40f200cad9bdaaf25f50

SHA1
70ee7cc10e5ae2f4bfffa93a8fc816c6142e1fcd

SHA256
83d5abb72f82fb51e926474e2b1bc1b88abf082d2cf8ef640abc92d93dfb1170

SHA512
65ae81b9bf33b169df5975b577ea931a152e4faadf0572e0edebe7cbf4774a64799e0495820932792c9829c38771178cd4b5ea2e279a071852920259eedc021e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016643001\06295ffb1b.exe

Filesize
758KB

MD5
afd936e441bf5cbdb858e96833cc6ed3

SHA1
3491edd8c7caf9ae169e21fb58bccd29d95aefef

SHA256
c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

SHA512
928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016644001\b825620d3d.exe

Filesize
4.3MB

MD5
8431c39a52e19976f2319440890d4ab2

SHA1
e85e91e3f5bb10cb68ba04026588467a3d3b6a4b

SHA256
58fb6bbb218c09e09fce173627b07f0c64f0bf94707d8a15f789a890c368909c

SHA512
c0e80b8cac83eb86a29f12b357471d6cb962d12d7b20529ff439d84300b9a9ea3519967567bba4ee1b0da7db524ff1015338bea506b556e5b43738a6d646886b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016645001\600450e26f.exe

Filesize
1.9MB

MD5
8317f4066452222fae09837c5df94ed2

SHA1
af3dae4376723dea094f0caba585af5df3b24269

SHA256
b363421afbee72e899d54508026f0c766bd04333ec087c8c96614c9bc735be56

SHA512
8a26b6c4ec847733786efb5157358d3353e917b046be39d44ae9635ba31e98e7b0fc454aaf9d7b07b6648c5364218a749b4652ac941b813475f01bac6a3f2f8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016646001\3f22d88980.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016647001\0ff5ea4cbe.exe

Filesize
4.2MB

MD5
0b0b89846c005a9c7087e8272294ea86

SHA1
cdd2b18e741ea6936bf32c642b11f3e676f58a1a

SHA256
e34a61e1e9a3ba9dee9dcffc185f13d26427bb0168e1ec4c4fe1e61b3b5d9f1d

SHA512
e62cff68f9f768242a5a87eed2193db4c77e22753354abde81417b841da34a1e0e637efe6cdb4d4ed852fe547d90d7d0ed01d72d6a1d5c02ceb6ef3a7b4ee676

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
b406ea5a7e49fac393c76ae7902269db

SHA1
b37dbbbe5b1aa93515c2347c328b372ef0149cbb

SHA256
7439a1cdf0d05d91d25d3be874ee54557494af5f6b2fc3373654c87266828504

SHA512
b495218372ffe3369a13def84318913638a96dba8295b77d23c821acb8ef4eca3c08beb45d0dd1a450ad339039b1f1589783fa58f3d495854d7081908e52c4e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UBD7JRAZ294F40Y45UXV.temp

Filesize
7KB

MD5
7a82a0fba1e11c71e929e3d36d545648

SHA1
9a4e952cd10f44a5c7a5ec7c9a0e853c18484f62

SHA256
5615c3f512e9ee99e79c3c6de5b80238e182141ca68b879cf6f09eaa03d72c50

SHA512
fece9c5ed5ccf0f6c68923207f43b4ae63b2fa68e9d0c4dbc910229cade999ac3eb11baac27ed480337ed33b0bcb5991cab8df0b5fc93aea17f56997156e7f4c

Download Submit
memory/1192-515-0x0000000001F90000-0x00000000022B0000-memory.dmp

Filesize
3.1MB

Download
memory/1192-559-0x0000000001F90000-0x00000000022B0000-memory.dmp

Filesize
3.1MB

Download
memory/1620-648-0x0000000000DB0000-0x00000000019E3000-memory.dmp

Filesize
12.2MB

Download
memory/1620-646-0x0000000000DB0000-0x00000000019E3000-memory.dmp

Filesize
12.2MB

Download
memory/1620-764-0x0000000000DB0000-0x00000000019E3000-memory.dmp

Filesize
12.2MB

Download
memory/1620-615-0x0000000000DB0000-0x00000000019E3000-memory.dmp

Filesize
12.2MB

Download
memory/1700-783-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/1700-784-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/1888-552-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1888-557-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1888-554-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1888-546-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1888-550-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1888-548-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1888-558-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1888-556-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1972-571-0x0000000000C10000-0x0000000000CB2000-memory.dmp

Filesize
648KB

Download
memory/2072-714-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2072-713-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2128-1-0x0000000077490000-0x0000000077492000-memory.dmp

Filesize
8KB

Download
memory/2128-433-0x00000000001C0000-0x00000000006BD000-memory.dmp

Filesize
5.0MB

Download
memory/2128-512-0x00000000001C0000-0x00000000006BD000-memory.dmp

Filesize
5.0MB

Download
memory/2128-0-0x00000000001C0000-0x00000000006BD000-memory.dmp

Filesize
5.0MB

Download
memory/2128-3-0x00000000001C0000-0x00000000006BD000-memory.dmp

Filesize
5.0MB

Download
memory/2128-30-0x00000000001C0000-0x00000000006BD000-memory.dmp

Filesize
5.0MB

Download
memory/2128-6-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2128-518-0x00000000001C0000-0x00000000006BD000-memory.dmp

Filesize
5.0MB

Download
memory/2128-2-0x00000000001C1000-0x00000000001D8000-memory.dmp

Filesize
92KB

Download
memory/2128-5-0x00000000001C0000-0x00000000006BD000-memory.dmp

Filesize
5.0MB

Download
memory/2128-4-0x00000000001C0000-0x00000000006BD000-memory.dmp

Filesize
5.0MB

Download
memory/2240-745-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2240-746-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2352-602-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2352-598-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2352-601-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2352-596-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2352-592-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2352-590-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2352-600-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2352-594-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2496-643-0x00000000772A0000-0x0000000077449000-memory.dmp

Filesize
1.7MB

Download
memory/2496-645-0x0000000076A60000-0x0000000076AA7000-memory.dmp

Filesize
284KB

Download
memory/2496-638-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/2496-642-0x0000000000900000-0x0000000000D00000-memory.dmp

Filesize
4.0MB

Download
memory/2604-634-0x0000000004AF0000-0x0000000004EF0000-memory.dmp

Filesize
4.0MB

Download
memory/2604-637-0x0000000076A60000-0x0000000076AA7000-memory.dmp

Filesize
284KB

Download
memory/2604-635-0x00000000772A0000-0x0000000077449000-memory.dmp

Filesize
1.7MB

Download
memory/2604-633-0x0000000004AF0000-0x0000000004EF0000-memory.dmp

Filesize
4.0MB

Download
memory/2604-641-0x0000000001050000-0x0000000001510000-memory.dmp

Filesize
4.8MB

Download
memory/2604-631-0x0000000001050000-0x0000000001510000-memory.dmp

Filesize
4.8MB

Download
memory/2612-706-0x000000013F340000-0x000000013F7D0000-memory.dmp

Filesize
4.6MB

Download
memory/2612-748-0x000000013F340000-0x000000013F7D0000-memory.dmp

Filesize
4.6MB

Download
memory/2612-708-0x000000013F340000-0x000000013F7D0000-memory.dmp

Filesize
4.6MB

Download
memory/2644-528-0x0000000006870000-0x0000000006B90000-memory.dmp

Filesize
3.1MB

Download
memory/2644-532-0x0000000001270000-0x0000000001590000-memory.dmp

Filesize
3.1MB

Download
memory/2644-516-0x0000000001270000-0x0000000001590000-memory.dmp

Filesize
3.1MB

Download
memory/2644-530-0x0000000006870000-0x0000000006B90000-memory.dmp

Filesize
3.1MB

Download
memory/2880-707-0x000000013F340000-0x000000013F7D0000-memory.dmp

Filesize
4.6MB

Download
memory/3044-632-0x0000000006B00000-0x0000000006FC0000-memory.dmp

Filesize
4.8MB

Download
memory/3044-715-0x0000000001240000-0x0000000001560000-memory.dmp

Filesize
3.1MB

Download
memory/3044-616-0x0000000001240000-0x0000000001560000-memory.dmp

Filesize
3.1MB

Download
memory/3044-729-0x0000000006B00000-0x000000000776B000-memory.dmp

Filesize
12.4MB

Download
memory/3044-614-0x0000000006B00000-0x0000000007733000-memory.dmp

Filesize
12.2MB

Download
memory/3044-630-0x0000000006B00000-0x0000000006FC0000-memory.dmp

Filesize
4.8MB

Download
memory/3044-529-0x0000000001240000-0x0000000001560000-memory.dmp

Filesize
3.1MB

Download
memory/3044-703-0x0000000006B00000-0x0000000006FC0000-memory.dmp

Filesize
4.8MB

Download
memory/3044-754-0x0000000006B00000-0x000000000776B000-memory.dmp

Filesize
12.4MB

Download
memory/3044-576-0x0000000001240000-0x0000000001560000-memory.dmp

Filesize
3.1MB

Download
memory/3044-575-0x0000000001240000-0x0000000001560000-memory.dmp

Filesize
3.1MB

Download
memory/3044-647-0x0000000006B00000-0x0000000007733000-memory.dmp

Filesize
12.2MB

Download