amadey | 122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3

Analysis

max time kernel
143s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
Size

1.8MB
MD5

6b7cca5a323f5e7087052dbe58f4c15a
SHA1

f98a92658e8f8d25f689955b1f657fbcdc30d88e
SHA256

122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3
SHA512

8d2e7398a2f5be0044d91dcaa60f4e020baf334d8d5c822dd777226295a21fea78863c1ae806a3ea810dc9664858bfe75cdfe692e62db31edce62f06c0b7c327
SSDEEP

24576:LXxMkX4JFVvXWkDBhybHlVpKFhmOqgBvr0pyc3TXvg+DEjibUCLuEarCpy+2qW3G:9MkSFVZElVcFhVqgFrPo0+DriERQ2PL

Score

10^/10

amadey cryptbot lumma povertystealer stealc 9c9aa5 stok credential_access discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

cryptbot

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Detect Poverty Stealer Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000001d3d2-551.dat	family_povertystealer

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer
Povertystealer family
povertystealer
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2564 created 1180	2564	707140954e.exe	21

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	53eee9e79c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	bc6c46e0d7.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bc6c46e0d7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	707140954e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	CBFCBKKFBA.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	53eee9e79c.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3012	chrome.exe
3060	chrome.exe
2148	chrome.exe
2740	chrome.exe
2848	chrome.exe
1636	chrome.exe
408	chrome.exe
3008	chrome.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	53eee9e79c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	53eee9e79c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bc6c46e0d7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CBFCBKKFBA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CBFCBKKFBA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bc6c46e0d7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	707140954e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	707140954e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe

Executes dropped EXE 21 IoCs

pid	Process
2948	CBFCBKKFBA.exe
2372	skotes.exe
1256	DxfmGsU.exe
2008	53eee9e79c.exe
2216	107f162a27.exe
2204	107f162a27.exe
2776	bc6c46e0d7.exe
2564	707140954e.exe
2480	384e160cc3.exe
2744	384e160cc3.exe
556	c3eb05d22f.exe
2340	7z.exe
1528	7z.exe
2588	7z.exe
3060	7z.exe
2876	7z.exe
1856	7z.exe
1408	7z.exe
2236	7z.exe
1176	in.exe
2228	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	CBFCBKKFBA.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	53eee9e79c.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	bc6c46e0d7.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	707140954e.exe

Loads dropped DLL 40 IoCs

pid	Process
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2648	cmd.exe
2648	cmd.exe
2948	CBFCBKKFBA.exe
2948	CBFCBKKFBA.exe
2372	skotes.exe
2372	skotes.exe
2372	skotes.exe
2372	skotes.exe
2372	skotes.exe
2372	skotes.exe
2216	107f162a27.exe
2372	skotes.exe
2372	skotes.exe
2372	skotes.exe
2372	skotes.exe
2372	skotes.exe
2480	384e160cc3.exe
2372	skotes.exe
2160	cmd.exe
2340	7z.exe
2160	cmd.exe
1528	7z.exe
2160	cmd.exe
2588	7z.exe
2160	cmd.exe
3060	7z.exe
2160	cmd.exe
2876	7z.exe
2160	cmd.exe
1856	7z.exe
2160	cmd.exe
1408	7z.exe
2160	cmd.exe
2236	7z.exe
2160	cmd.exe
2160	cmd.exe
1948	taskeng.exe
1948	taskeng.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2948	CBFCBKKFBA.exe
2372	skotes.exe
2008	53eee9e79c.exe
2776	bc6c46e0d7.exe
2564	707140954e.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2216 set thread context of 2204	2216	107f162a27.exe	66
PID 2480 set thread context of 2744	2480	384e160cc3.exe	72
PID 2228 set thread context of 2060	2228	Intel_PTT_EK_Recertification.exe	98

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	CBFCBKKFBA.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53eee9e79c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	107f162a27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3eb05d22f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	384e160cc3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	107f162a27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc6c46e0d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	707140954e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	384e160cc3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CBFCBKKFBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DxfmGsU.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1532	powershell.exe
2760	PING.EXE
2596	powershell.exe
1328	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2760	PING.EXE
1328	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
3008	chrome.exe
3008	chrome.exe
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
2948	CBFCBKKFBA.exe
2372	skotes.exe
2008	53eee9e79c.exe
2008	53eee9e79c.exe
2008	53eee9e79c.exe
2008	53eee9e79c.exe
2008	53eee9e79c.exe
2008	53eee9e79c.exe
2204	107f162a27.exe
2204	107f162a27.exe
2204	107f162a27.exe
2204	107f162a27.exe
2776	bc6c46e0d7.exe
2776	bc6c46e0d7.exe
2776	bc6c46e0d7.exe
2776	bc6c46e0d7.exe
2776	bc6c46e0d7.exe
2776	bc6c46e0d7.exe
2564	707140954e.exe
2564	707140954e.exe
2564	707140954e.exe
2564	707140954e.exe
2564	707140954e.exe
2384	dialer.exe
2384	dialer.exe
2384	dialer.exe
2384	dialer.exe
2744	384e160cc3.exe
2744	384e160cc3.exe
2744	384e160cc3.exe
2744	384e160cc3.exe
1532	powershell.exe
2228	Intel_PTT_EK_Recertification.exe
2596	powershell.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeRestorePrivilege	2340	7z.exe
Token: 35	2340	7z.exe
Token: SeSecurityPrivilege	2340	7z.exe
Token: SeSecurityPrivilege	2340	7z.exe
Token: SeRestorePrivilege	1528	7z.exe
Token: 35	1528	7z.exe
Token: SeSecurityPrivilege	1528	7z.exe
Token: SeSecurityPrivilege	1528	7z.exe
Token: SeRestorePrivilege	2588	7z.exe
Token: 35	2588	7z.exe
Token: SeSecurityPrivilege	2588	7z.exe
Token: SeSecurityPrivilege	2588	7z.exe
Token: SeRestorePrivilege	3060	7z.exe
Token: 35	3060	7z.exe
Token: SeSecurityPrivilege	3060	7z.exe
Token: SeSecurityPrivilege	3060	7z.exe
Token: SeRestorePrivilege	2876	7z.exe
Token: 35	2876	7z.exe
Token: SeSecurityPrivilege	2876	7z.exe
Token: SeSecurityPrivilege	2876	7z.exe
Token: SeRestorePrivilege	1856	7z.exe
Token: 35	1856	7z.exe
Token: SeSecurityPrivilege	1856	7z.exe
Token: SeSecurityPrivilege	1856	7z.exe
Token: SeRestorePrivilege	1408	7z.exe
Token: 35	1408	7z.exe
Token: SeSecurityPrivilege	1408	7z.exe
Token: SeSecurityPrivilege	1408	7z.exe
Token: SeRestorePrivilege	2236	7z.exe
Token: 35	2236	7z.exe
Token: SeSecurityPrivilege	2236	7z.exe
Token: SeSecurityPrivilege	2236	7z.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeLockMemoryPrivilege	2060	explorer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3008	chrome.exe
2740	chrome.exe
2948	CBFCBKKFBA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3008	2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe	32
PID 2296 wrote to memory of 3008	2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe	32
PID 2296 wrote to memory of 3008	2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe	32
PID 2296 wrote to memory of 3008	2296	122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe	32
PID 3008 wrote to memory of 2944	3008	chrome.exe	33
PID 3008 wrote to memory of 2944	3008	chrome.exe	33
PID 3008 wrote to memory of 2944	3008	chrome.exe	33
PID 3008 wrote to memory of 828	3008	chrome.exe	34
PID 3008 wrote to memory of 828	3008	chrome.exe	34
PID 3008 wrote to memory of 828	3008	chrome.exe	34
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 1240	3008	chrome.exe	36
PID 3008 wrote to memory of 3036	3008	chrome.exe	37
PID 3008 wrote to memory of 3036	3008	chrome.exe	37
PID 3008 wrote to memory of 3036	3008	chrome.exe	37
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38
PID 3008 wrote to memory of 3016	3008	chrome.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1304	attrib.exe
792	attrib.exe
2500	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180
- C:\Users\Admin\AppData\Local\Temp\122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe
  "C:\Users\Admin\AppData\Local\Temp\122c8fa6cec8c75deff869aad3ee031709e084c3c46bdb5be25119f884b89fb3.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef76c9758,0x7fef76c9768,0x7fef76c9778
      4⤵
      PID:2944
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1312,i,7871374004041981931,7166676371494102886,131072 /prefetch:2
      4⤵
      PID:1240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1312,i,7871374004041981931,7166676371494102886,131072 /prefetch:8
      4⤵
      PID:3036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1312,i,7871374004041981931,7166676371494102886,131072 /prefetch:8
      4⤵
      PID:3016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2168 --field-trial-handle=1312,i,7871374004041981931,7166676371494102886,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2444 --field-trial-handle=1312,i,7871374004041981931,7166676371494102886,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2452 --field-trial-handle=1312,i,7871374004041981931,7166676371494102886,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3568 --field-trial-handle=1312,i,7871374004041981931,7166676371494102886,131072 /prefetch:2
      4⤵
      PID:2292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 --field-trial-handle=1312,i,7871374004041981931,7166676371494102886,131072 /prefetch:8
      4⤵
      PID:2016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70a9758,0x7fef70a9768,0x7fef70a9778
      4⤵
      PID:2628
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:1784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1372,i,18024480444970465227,3174712106953342276,131072 /prefetch:2
      4⤵
      PID:1960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 --field-trial-handle=1372,i,18024480444970465227,3174712106953342276,131072 /prefetch:8
      4⤵
      PID:2904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1372,i,18024480444970465227,3174712106953342276,131072 /prefetch:8
      4⤵
      PID:1980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2116 --field-trial-handle=1372,i,18024480444970465227,3174712106953342276,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2668 --field-trial-handle=1372,i,18024480444970465227,3174712106953342276,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2680 --field-trial-handle=1372,i,18024480444970465227,3174712106953342276,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1572 --field-trial-handle=1372,i,18024480444970465227,3174712106953342276,131072 /prefetch:2
      4⤵
      PID:1236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 --field-trial-handle=1372,i,18024480444970465227,3174712106953342276,131072 /prefetch:8
      4⤵
      PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\CBFCBKKFBA.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2648
  - - C:\Users\Admin\Documents\CBFCBKKFBA.exe
      "C:\Users\Admin\Documents\CBFCBKKFBA.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\1016723001\DxfmGsU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016723001\DxfmGsU.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\1016727001\53eee9e79c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016727001\53eee9e79c.exe"
        6⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\1016728001\107f162a27.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016728001\107f162a27.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\1016728001\107f162a27.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016728001\107f162a27.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\1016729001\bc6c46e0d7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016729001\bc6c46e0d7.exe"
        6⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\1016730001\707140954e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016730001\707140954e.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\1016731001\384e160cc3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016731001\384e160cc3.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\1016731001\384e160cc3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016731001\384e160cc3.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\1016732001\c3eb05d22f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1016732001\c3eb05d22f.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:556
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        7⤵
        Loads dropped DLL
        
        PID:2160
        
        C:\Windows\system32\mode.com
        
        mode 65,10
        8⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        8⤵
        Views/modifies file attributes
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        8⤵
        Executes dropped EXE
        
        PID:1176
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        9⤵
        Views/modifies file attributes
        
        PID:1304
        
        C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        9⤵
        Views/modifies file attributes
        
        PID:792
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2760
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2384

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:792

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1736

C:\Windows\system32\taskeng.exe
taskeng.exe {4A3BAAD6-0298-4796-B908-40FC5E977295} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:1948
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
66b458a927cbc7e3db44b9288dd125cd

SHA1
bca37f9291fdfaf706ea2e91f86936caec472710

SHA256
481bc064a399c309d671b4d25371c9afba388960624d1173221eac16752dea81

SHA512
897fade0ea8f816830aee0e8008868af42619005384e0a89da654ad16102cd5e7a607440bd99f9578cf951390d39f07020054cca74231cdc42a3cffa363d9869

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
1a6475dc28d2bee5e495cb5d92134dee

SHA1
547bbedc76ffa6466babe26bdd60537dc425ea15

SHA256
28eee9acff8dde73e553855f394b4ba55d036f3eac3ec16813aa704ce5460a87

SHA512
d354edf91f6595e6e6ccab071b70ee62dfc40257aa8440309ce978c1e5025668dba3ef00e04a97918cf6aa260a0329c5448fb8ba04d9f770c243c96d2d18f065

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
686d24201a19a6b85afab2fb25d340be

SHA1
348a7f56279b48d0c0351330df40814d8ec409ed

SHA256
d4abe0cd0d303beb123645706c7f34b58d3881a0e1cb9aae137f9deeb93fc4a9

SHA512
9cbe676141cae6f00a230d0158cb93ec26fd0f9cc3533d670df9a7409e2dc48216bbfcfa5e706a58a335988d039f079bc442c61dc042bef2dcc8e23660b1f72a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

Filesize
192B

MD5
8a16748076ded697b9d4180b406b0dbc

SHA1
e5b4b76f17bffcee22761e1d2623a5e34fe0e2aa

SHA256
2ffa37ccfe337bc0a757f40fe0da0a983c72f81a7879cde70091658215f9b54f

SHA512
4975c7415b1eb5636ef67d6c6a3719d5a3015da2d2873b02b155fded459af413d027c4470482a8ad2a1ced1e5ad4624ee75efe28682db42fd9af8d92773f05e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

Filesize
204B

MD5
0b5e7e5529b4e232e637c501f11fea5c

SHA1
0cac97052173e78b8946337e18178f52e10837a4

SHA256
0a17eb78f52aa7992f6db2eacac1b55325a1950c617570af605999a98dd59691

SHA512
6fcd4d97c8edc35677aca2eb74ddfbf8dffb4bda151abd256e447fa8987ceabddd6780b86e6c501fbab6b52ddc1e0da14951d7b231dd9d74eff645cda9d14e2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

Filesize
192B

MD5
9381367453ae4b68bb16f98ab50e2f55

SHA1
c7c28b2ba764f886a8f18489920e984c40a557e9

SHA256
9c7f6128a1f77a7b9b1916048bab8e35db71eca9237f839ff76bd4e48fcb9501

SHA512
bd584a499c6764e2331399d478901627f245134b12f32c0cfa5cecfc3740c288be37a04df316cca59f519bc1f8a9aacf4ded8f372e25738defdbd0853ecd079a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

Filesize
128KB

MD5
7bdab536777c532580906cc8bf2c39e9

SHA1
48c2cb0d2d9f4ea585968e4a870061bda347b011

SHA256
d40a42506bd1fd9f6bc833dce73b0c0aefb52be29866af16792d5b5b2b943456

SHA512
90664931e8623407907afab74806b92df26df4f66262ee499a7a061f07775e7de30ccb8a321c73b48b28861125d6a075186a1b75a50dfb6dc5059b5d16277dc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

Filesize
92KB

MD5
cc61507945311caab460f88a842d4ee0

SHA1
3bc76e0e88b11f7f6e67c481ea010a8d6d9138c3

SHA256
d21ac017854d6f48851ea759bfc4a1d0fa01378f8d3315a534ca7c70c200a6b1

SHA512
638104219c9e0ad434e79550366ac0419a284adf1dbcb10aa75e188acfbb6346da927b90ae53619aaccc2718024f25c2541c9febc22fd494fb55cb161fd13a04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
457a97ecf9ebb89fc872731d0baad898

SHA1
d8869649cf02e7aebf8ade383fd41e0694d8f742

SHA256
d58c5bc12f00ff709b35d1305a448b4ce799f2ee312686cee607347e34aadfe7

SHA512
9ac52d316576408f40bfb86b657b990a1ebc92327ebcbf8230393042e51de2f8387f4372fb0ce48361fbfd820a1e6707a4562c95ed2512f31c5617b6feb8e1ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
4d85705acb80e1632340105d8de1211d

SHA1
48677a9604bbe270dde851a2cfc1da281265e1d9

SHA256
73ce78c4075dff704f39b0bf05526e70de42a367ceb132cc814b162322a74632

SHA512
b544efad99dc2739db425d4542858b2c332d5c180987986a7639c49da298a5d92d0c2504267900152abf103d40490d679902089703d74d35353d049f2f62e079

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

Filesize
193B

MD5
f9c2a29de7e0614c79f8c1c8ab2e5699

SHA1
aafacdb28fb500a19f256a905a5ff98db2bdc9c6

SHA256
8b24f3f4667adc5e1e3dc54c686b8fc045b87fdadab9d61156748a1828105a94

SHA512
f28b32d49f1248c0be5b740b9106b1e58ce51235b3729e06c40e7806b6e3cab48299a1387bf7c18c14cb4a0d3c36d961330dc2636957835174b769399c39563f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Login Data For Account

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

Filesize
205B

MD5
f121ad9b42dce1f05642a17304780442

SHA1
c4d01fda8c3000c11b41ea36953262e5ba14250e

SHA256
292fe5d5fb46ef1a0bd1fe4995bb284afc42539672b8f8e9320a6f1e11d78e83

SHA512
a458673d21d918c78ffb5d5afc4a14c615aeb54a28de076aad83a481a8069ac9f655d438794c27dd5a32e8b5eb3cb0b508c78aaace7ce9b865e0241dee2ad6b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT~RFf76e35d.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

Filesize
193B

MD5
c9d8f504408e28d63c6ab33836251a70

SHA1
1319972dd386ac1ca26efa856ec20cc0239264cf

SHA256
584cc82f44cb8c7bc7fc86f57b862252525b9f932efc6429a85f7a66ee473cc1

SHA512
4a4eb6602272b574242c5e5a958e0344ff0b27ae530296d6b6ca4994bf1ec6f3a0e0deb5f8643b5e9f175d11755989b473d313c8869a199793818a3259179717

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
78694339b42c724ae9f76ccd751c1101

SHA1
6a8171fc7e556192c8677cd5520cece46be5c483

SHA256
3ef8df2e6b78912ec74d7585453a7f4edf29994732fa7c93bbb58bf90f48ce7a

SHA512
b50bfde24ea7a381a54c6d3e6fe3be52fa1d9a32ee9cd9ebe258d916704d9410de2534b49455815647d43f2303e07cd0f38cfbd79bca8467ebd63a64cbdb52e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

Filesize
200B

MD5
25fef9b4a8376eed9cdcaed58cd69096

SHA1
7b1c9e2ee4c29eaada70d704baed9575020ea4e9

SHA256
b4992e15c813f3ecd4cbf7ad03f8bf92bf8d8608e0f91db3395dea6a6629f919

SHA512
1b0fa058d265276e4ed15bea1a106c1185e1a2ca1e56d700d9f841735090b2de92963c22b5464a908a3d87190fcaa097d179fee0b542f1e5096cccd1d91f56e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016723001\DxfmGsU.exe

Filesize
29KB

MD5
d7f262a8282be1508048344c20404de9

SHA1
ce852799cb2fd8e54fc5b8f55299dd36a032e981

SHA256
810a7284e9cb3207915de92b78c40478f3fe27effa42f6f1ec242232eee4d631

SHA512
bc7d18b9a66efb0aa9f94f8ab7a167c83aa1fbea9ca94ad745424d00051a980e396c58047533ce14c99977df6f8c4640712e5f5b4b46e02008cf73fd70d70370

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016727001\53eee9e79c.exe

Filesize
4.2MB

MD5
f0d90c47fc980cb5b9678d4e5cb6378c

SHA1
c18a90dea4a0e2aa52116cda2f98a2d4d9eee3b8

SHA256
eda574b714702a176c03a18f1cc966361d9245851dc44d97f498527ffa0268ba

SHA512
5eed97a7d1fa1cceb1c0f83bacf95b7b6f4899eeb16599c4677630a260a8d0488e5bcf2a80ad3c4e255072eeb8e1c8a564ec4425e2dbb29020e74ad9494e8354

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016728001\107f162a27.exe

Filesize
758KB

MD5
afd936e441bf5cbdb858e96833cc6ed3

SHA1
3491edd8c7caf9ae169e21fb58bccd29d95aefef

SHA256
c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

SHA512
928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016729001\bc6c46e0d7.exe

Filesize
4.3MB

MD5
ed6abef07583d27bea1c8f10ff31f6f3

SHA1
d3860ef0972e66409814d42b61575097eb6d40aa

SHA256
85ea7702d92c135a551a65666811e85fbc3c2f062ab10be42ca80c98a4d896c6

SHA512
f2b443b969a84fafbfdd09fd9e0e546bd3684f04b831df1e36f4e9ae01b02a2eb5fad83efb1e8d871a8dd7ed268d4cf8e0bee626c38a764fd4bd95490898704c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016730001\707140954e.exe

Filesize
1.9MB

MD5
0409213e636d8433f9be61eac00cdb3f

SHA1
ecbd3b3e1a6db7521c3ea0c441bbe3be1fe5761a

SHA256
45a1c3aac4d7bbf621fbaf84ce2d99e4e810662e6619cf9d30a76eb734ab6cf4

SHA512
68a36ef898b835e87d38127993ab011fed435d543cc344ad3912adae035161576cf98dc5dd5d72eb2358bef56aee1eb737948165c93235748435db19a186b8b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016731001\384e160cc3.exe

Filesize
747KB

MD5
8a9cb17c0224a01bd34b46495983c50a

SHA1
00296ea6a56f6e10a0f1450a20c5fb329b8856c1

SHA256
3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

SHA512
1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016732001\c3eb05d22f.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
cc72571bad2278c3770bcc0ae6bb7d09

SHA1
95c8e8c55e927ffbc2453246349b2ad465de1f5d

SHA256
8f028023a79bc332fbeb812d20004dbb82bd35b83f38ad367483e2ced35cb9fa

SHA512
21cc828bde7e2247fa537d0480d947d13822815351d8820828e60a6b4a21616f7d59322df8ed75dad6d80dc88ea65388df36cac3314684a7669f7e0335f2e0b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L6MBL0E4O44IK2BJ7ANQ.temp

Filesize
7KB

MD5
08b1fb9f72478bd9cba3a2fd8a7c128c

SHA1
f8bae81bf48bc2194d0fd4c291894c737b665cb4

SHA256
83dc94df2991cd375b43e1661b9ed17850a0551bf5dabe45cec7d1fdeed59807

SHA512
9ee57898ace3f0dddccde412711418a6dd691d458647ef212e185578c9b25909fa78f3b946e3db80b1ebdc0fee5100ede7b3cac9ecb55e1e8fc831cfc2263c88

Download Submit
memory/1532-752-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/1532-751-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2008-577-0x0000000001380000-0x0000000001FE4000-memory.dmp

Filesize
12.4MB

Download
memory/2008-607-0x0000000001380000-0x0000000001FE4000-memory.dmp

Filesize
12.4MB

Download
memory/2008-608-0x0000000001380000-0x0000000001FE4000-memory.dmp

Filesize
12.4MB

Download
memory/2008-610-0x0000000001380000-0x0000000001FE4000-memory.dmp

Filesize
12.4MB

Download
memory/2204-600-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2204-598-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2204-596-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2204-594-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2204-592-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2204-602-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2204-603-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2204-604-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2296-4-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2296-0-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2296-533-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2296-527-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2296-506-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2296-1-0x0000000077890000-0x0000000077892000-memory.dmp

Filesize
8KB

Download
memory/2296-2-0x00000000002D1000-0x00000000002E8000-memory.dmp

Filesize
92KB

Download
memory/2296-3-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2296-456-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2296-5-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2296-23-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2296-214-0x00000000002D0000-0x0000000000986000-memory.dmp

Filesize
6.7MB

Download
memory/2372-561-0x0000000000360000-0x0000000000678000-memory.dmp

Filesize
3.1MB

Download
memory/2372-606-0x0000000006DC0000-0x0000000007A24000-memory.dmp

Filesize
12.4MB

Download
memory/2372-609-0x0000000006DC0000-0x0000000007A24000-memory.dmp

Filesize
12.4MB

Download
memory/2372-605-0x0000000000360000-0x0000000000678000-memory.dmp

Filesize
3.1MB

Download
memory/2372-578-0x0000000006DC0000-0x0000000007A24000-memory.dmp

Filesize
12.4MB

Download
memory/2372-611-0x0000000000360000-0x0000000000678000-memory.dmp

Filesize
3.1MB

Download
memory/2372-576-0x0000000006DC0000-0x0000000007A24000-memory.dmp

Filesize
12.4MB

Download
memory/2372-623-0x0000000006DC0000-0x000000000792A000-memory.dmp

Filesize
11.4MB

Download
memory/2372-546-0x0000000000360000-0x0000000000678000-memory.dmp

Filesize
3.1MB

Download
memory/2372-625-0x0000000000360000-0x0000000000678000-memory.dmp

Filesize
3.1MB

Download
memory/2372-626-0x0000000006DC0000-0x000000000792A000-memory.dmp

Filesize
11.4MB

Download
memory/2372-562-0x0000000000360000-0x0000000000678000-memory.dmp

Filesize
3.1MB

Download
memory/2372-686-0x0000000006DC0000-0x0000000007275000-memory.dmp

Filesize
4.7MB

Download
memory/2372-640-0x0000000006DC0000-0x0000000007275000-memory.dmp

Filesize
4.7MB

Download
memory/2372-643-0x0000000006DC0000-0x0000000007275000-memory.dmp

Filesize
4.7MB

Download
memory/2372-685-0x0000000006DC0000-0x0000000007275000-memory.dmp

Filesize
4.7MB

Download
memory/2372-560-0x0000000000360000-0x0000000000678000-memory.dmp

Filesize
3.1MB

Download
memory/2372-658-0x0000000000360000-0x0000000000678000-memory.dmp

Filesize
3.1MB

Download
memory/2384-653-0x0000000001D80000-0x0000000002180000-memory.dmp

Filesize
4.0MB

Download
memory/2384-656-0x0000000075940000-0x0000000075987000-memory.dmp

Filesize
284KB

Download
memory/2384-649-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download
memory/2384-654-0x00000000776A0000-0x0000000077849000-memory.dmp

Filesize
1.7MB

Download
memory/2564-644-0x0000000004C70000-0x0000000005070000-memory.dmp

Filesize
4.0MB

Download
memory/2564-648-0x0000000075940000-0x0000000075987000-memory.dmp

Filesize
284KB

Download
memory/2564-646-0x00000000776A0000-0x0000000077849000-memory.dmp

Filesize
1.7MB

Download
memory/2564-645-0x0000000004C70000-0x0000000005070000-memory.dmp

Filesize
4.0MB

Download
memory/2564-652-0x0000000000D60000-0x0000000001215000-memory.dmp

Filesize
4.7MB

Download
memory/2564-641-0x0000000000D60000-0x0000000001215000-memory.dmp

Filesize
4.7MB

Download
memory/2596-769-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2596-768-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2648-530-0x0000000002080000-0x0000000002398000-memory.dmp

Filesize
3.1MB

Download
memory/2648-532-0x0000000002080000-0x0000000002398000-memory.dmp

Filesize
3.1MB

Download
memory/2744-680-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2744-674-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2744-676-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2744-678-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2744-672-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2776-657-0x0000000001080000-0x0000000001BEA000-memory.dmp

Filesize
11.4MB

Download
memory/2776-624-0x0000000001080000-0x0000000001BEA000-memory.dmp

Filesize
11.4MB

Download
memory/2776-689-0x0000000001080000-0x0000000001BEA000-memory.dmp

Filesize
11.4MB

Download
memory/2776-642-0x0000000001080000-0x0000000001BEA000-memory.dmp

Filesize
11.4MB

Download
memory/2948-545-0x00000000002E0000-0x00000000005F8000-memory.dmp

Filesize
3.1MB

Download
memory/2948-531-0x00000000002E0000-0x00000000005F8000-memory.dmp

Filesize
3.1MB

Download
memory/2948-544-0x0000000006620000-0x0000000006938000-memory.dmp

Filesize
3.1MB

Download