Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 01:09
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
General
-
Target
file.exe
-
Size
2.9MB
-
MD5
744e8a3718a8bccb6c0bfe243c7ac195
-
SHA1
06ad06e208965913a03307439e68f1168027fb89
-
SHA256
9c41a2f71bf50c12c268e61147794c07e5a65642cd2a08235f5dce0ad0cdbc63
-
SHA512
66802302b003b51072a4eba3b81dd4728f88d642a5813d57e402fd4ab23b4f0f6f07f6812380b6c5bc42818c6a6efc32654405c96253befd023c1b26d5286273
-
SSDEEP
49152:DUEL8aWXxxR4zmtHbaTpanQ6A3tOhbDgF5yx3G9RGpelk1+a:DUE4aWXfR4CtHbaTpanQV3UVgF5W3BE
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
Extracted
cryptbot
Signatures
-
Amadey family
-
Cryptbot family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 0200dc27b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 0200dc27b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 0200dc27b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 0200dc27b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 0200dc27b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 0200dc27b8.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 7760 created 1220 7760 6f1d33df34.exe 21 -
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 3c31bb53d6.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cd4ff83cfc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 616e3ded96.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4e6c5211b6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 81bc274c20.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0200dc27b8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3c31bb53d6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1b3128729e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 17c0be04ca.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 35cca5c170.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6f1d33df34.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ CBAFIDAECB.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1888 powershell.exe 2280 powershell.exe 8708 powershell.exe 8848 powershell.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 8 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 2156 chrome.exe 3160 chrome.exe 4668 chrome.exe 4948 chrome.exe 5048 chrome.exe 2080 chrome.exe 3480 chrome.exe 4116 chrome.exe -
Checks BIOS information in registry 2 TTPs 26 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 17c0be04ca.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4e6c5211b6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4e6c5211b6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 81bc274c20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 616e3ded96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3c31bb53d6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 17c0be04ca.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6f1d33df34.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion CBAFIDAECB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cd4ff83cfc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1b3128729e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 35cca5c170.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 35cca5c170.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 616e3ded96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6f1d33df34.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CBAFIDAECB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 81bc274c20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1b3128729e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0200dc27b8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0200dc27b8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cd4ff83cfc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3c31bb53d6.exe -
Executes dropped EXE 39 IoCs
pid Process 2600 skotes.exe 2672 cd4ff83cfc.exe 560 616c6a6fe5.exe 2256 3c31bb53d6.exe 1268 1b3128729e.exe 1596 17c0be04ca.exe 2624 f5157e8889.exe 2360 9a1777e7b3.exe 1012 9a1777e7b3.exe 1776 477c0509ba.exe 2192 69c3a4d93a.exe 1104 4e6c5211b6.exe 2692 81bc274c20.exe 3060 f5157e8889.exe 272 f5157e8889.exe 2224 b24d56b4d9.exe 1972 0200dc27b8.exe 4836 35cca5c170.exe 5724 9a9afce362.exe 6120 7z.exe 6176 7z.exe 6236 7z.exe 6284 7z.exe 6332 7z.exe 6376 7z.exe 6416 7z.exe 6464 7z.exe 6524 in.exe 7120 616e3ded96.exe 7760 6f1d33df34.exe 8256 4c2179552a.exe 8440 CBAFIDAECB.exe 9208 97d47a2440.exe 1984 Intel_PTT_EK_Recertification.exe 4188 97d47a2440.exe 4048 97d47a2440.exe 4272 97d47a2440.exe 4308 97d47a2440.exe 4512 97d47a2440.exe -
Identifies Wine through registry keys 2 TTPs 13 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 3c31bb53d6.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 4e6c5211b6.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 35cca5c170.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 6f1d33df34.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine cd4ff83cfc.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 1b3128729e.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 17c0be04ca.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 81bc274c20.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 0200dc27b8.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine 616e3ded96.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine CBAFIDAECB.exe -
Loads dropped DLL 63 IoCs
pid Process 2668 file.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2360 9a1777e7b3.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2624 f5157e8889.exe 2624 f5157e8889.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 6060 cmd.exe 6120 7z.exe 6060 cmd.exe 6176 7z.exe 6060 cmd.exe 6236 7z.exe 6060 cmd.exe 6284 7z.exe 6060 cmd.exe 6332 7z.exe 6060 cmd.exe 6376 7z.exe 6060 cmd.exe 6416 7z.exe 6060 cmd.exe 6464 7z.exe 6060 cmd.exe 6060 cmd.exe 2600 skotes.exe 2600 skotes.exe 2692 81bc274c20.exe 2692 81bc274c20.exe 2600 skotes.exe 2600 skotes.exe 2600 skotes.exe 8404 cmd.exe 2600 skotes.exe 4836 35cca5c170.exe 2260 taskeng.exe 2260 taskeng.exe 9208 97d47a2440.exe 9208 97d47a2440.exe 9208 97d47a2440.exe 9208 97d47a2440.exe 9208 97d47a2440.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 0200dc27b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 0200dc27b8.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\b24d56b4d9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018068001\\b24d56b4d9.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\0200dc27b8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018069001\\0200dc27b8.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\cd4ff83cfc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018024001\\cd4ff83cfc.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\4e6c5211b6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018066001\\4e6c5211b6.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\81bc274c20.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018067001\\81bc274c20.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000500000001a4a6-2386.dat autoit_exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
pid Process 2668 file.exe 2600 skotes.exe 2672 cd4ff83cfc.exe 2256 3c31bb53d6.exe 1268 1b3128729e.exe 1596 17c0be04ca.exe 1104 4e6c5211b6.exe 2692 81bc274c20.exe 1972 0200dc27b8.exe 4836 35cca5c170.exe 7120 616e3ded96.exe 7760 6f1d33df34.exe 8440 CBAFIDAECB.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2360 set thread context of 1012 2360 9a1777e7b3.exe 41 PID 2624 set thread context of 272 2624 f5157e8889.exe 52 PID 1984 set thread context of 2264 1984 Intel_PTT_EK_Recertification.exe 138 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 33 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69c3a4d93a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81bc274c20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0200dc27b8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd4ff83cfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a9afce362.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a1777e7b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b24d56b4d9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616e3ded96.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage b24d56b4d9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35cca5c170.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97d47a2440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c2179552a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c31bb53d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1b3128729e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5157e8889.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a1777e7b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4e6c5211b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5157e8889.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language b24d56b4d9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f1d33df34.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3048 PING.EXE 6628 powershell.exe 6832 PING.EXE 2500 powershell.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 81bc274c20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 81bc274c20.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 1692 taskkill.exe 7672 taskkill.exe 7952 taskkill.exe 8048 taskkill.exe 8152 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings firefox.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a cd4ff83cfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 1b3128729e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 1b3128729e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 cd4ff83cfc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a cd4ff83cfc.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 6832 PING.EXE 3048 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6612 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2668 file.exe 2600 skotes.exe 2672 cd4ff83cfc.exe 2256 3c31bb53d6.exe 2256 3c31bb53d6.exe 2256 3c31bb53d6.exe 2256 3c31bb53d6.exe 2256 3c31bb53d6.exe 2256 3c31bb53d6.exe 1268 1b3128729e.exe 1596 17c0be04ca.exe 2192 69c3a4d93a.exe 1888 powershell.exe 2280 powershell.exe 1104 4e6c5211b6.exe 2692 81bc274c20.exe 2692 81bc274c20.exe 2624 f5157e8889.exe 2624 f5157e8889.exe 272 f5157e8889.exe 272 f5157e8889.exe 2692 81bc274c20.exe 3160 chrome.exe 3160 chrome.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 1972 0200dc27b8.exe 1972 0200dc27b8.exe 2692 81bc274c20.exe 2692 81bc274c20.exe 2080 chrome.exe 2080 chrome.exe 1972 0200dc27b8.exe 1972 0200dc27b8.exe 4836 35cca5c170.exe 4836 35cca5c170.exe 4836 35cca5c170.exe 4836 35cca5c170.exe 2692 81bc274c20.exe 2692 81bc274c20.exe 2692 81bc274c20.exe 2692 81bc274c20.exe 6628 powershell.exe 7120 616e3ded96.exe 7120 616e3ded96.exe 7120 616e3ded96.exe 2692 81bc274c20.exe 2692 81bc274c20.exe 7760 6f1d33df34.exe 7760 6f1d33df34.exe 7760 6f1d33df34.exe 7760 6f1d33df34.exe 7760 6f1d33df34.exe 7760 6f1d33df34.exe 8052 dialer.exe 8052 dialer.exe 8052 dialer.exe 8052 dialer.exe 8256 4c2179552a.exe 8440 CBAFIDAECB.exe 8440 CBAFIDAECB.exe 8440 CBAFIDAECB.exe 8708 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2192 69c3a4d93a.exe Token: SeDebugPrivilege 1888 powershell.exe Token: SeDebugPrivilege 2280 powershell.exe Token: SeDebugPrivilege 2624 f5157e8889.exe Token: SeDebugPrivilege 272 f5157e8889.exe Token: SeDebugPrivilege 1692 taskkill.exe Token: SeShutdownPrivilege 3160 chrome.exe Token: SeShutdownPrivilege 3160 chrome.exe Token: SeDebugPrivilege 7672 taskkill.exe Token: SeDebugPrivilege 7952 taskkill.exe Token: SeDebugPrivilege 8048 taskkill.exe Token: SeDebugPrivilege 8152 taskkill.exe Token: SeDebugPrivilege 8260 firefox.exe Token: SeDebugPrivilege 8260 firefox.exe Token: SeDebugPrivilege 1972 0200dc27b8.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeRestorePrivilege 6120 7z.exe Token: 35 6120 7z.exe Token: SeSecurityPrivilege 6120 7z.exe Token: SeSecurityPrivilege 6120 7z.exe Token: SeRestorePrivilege 6176 7z.exe Token: 35 6176 7z.exe Token: SeSecurityPrivilege 6176 7z.exe Token: SeSecurityPrivilege 6176 7z.exe Token: SeRestorePrivilege 6236 7z.exe Token: 35 6236 7z.exe Token: SeSecurityPrivilege 6236 7z.exe Token: SeSecurityPrivilege 6236 7z.exe Token: SeRestorePrivilege 6284 7z.exe Token: 35 6284 7z.exe Token: SeSecurityPrivilege 6284 7z.exe Token: SeSecurityPrivilege 6284 7z.exe Token: SeRestorePrivilege 6332 7z.exe Token: 35 6332 7z.exe Token: SeSecurityPrivilege 6332 7z.exe Token: SeSecurityPrivilege 6332 7z.exe Token: SeRestorePrivilege 6376 7z.exe Token: 35 6376 7z.exe Token: SeSecurityPrivilege 6376 7z.exe Token: SeSecurityPrivilege 6376 7z.exe Token: SeRestorePrivilege 6416 7z.exe Token: 35 6416 7z.exe Token: SeSecurityPrivilege 6416 7z.exe Token: SeSecurityPrivilege 6416 7z.exe Token: SeRestorePrivilege 6464 7z.exe Token: 35 6464 7z.exe Token: SeSecurityPrivilege 6464 7z.exe Token: SeSecurityPrivilege 6464 7z.exe Token: SeDebugPrivilege 6628 powershell.exe Token: SeDebugPrivilege 8256 4c2179552a.exe Token: SeDebugPrivilege 8708 powershell.exe Token: SeDebugPrivilege 8848 powershell.exe Token: SeDebugPrivilege 9208 97d47a2440.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2668 file.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 3160 chrome.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 8260 firefox.exe 8260 firefox.exe 8260 firefox.exe 8260 firefox.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2080 chrome.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 8260 firefox.exe 8260 firefox.exe 8260 firefox.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe 2224 b24d56b4d9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2600 2668 file.exe 30 PID 2668 wrote to memory of 2600 2668 file.exe 30 PID 2668 wrote to memory of 2600 2668 file.exe 30 PID 2668 wrote to memory of 2600 2668 file.exe 30 PID 2600 wrote to memory of 2672 2600 skotes.exe 32 PID 2600 wrote to memory of 2672 2600 skotes.exe 32 PID 2600 wrote to memory of 2672 2600 skotes.exe 32 PID 2600 wrote to memory of 2672 2600 skotes.exe 32 PID 2600 wrote to memory of 560 2600 skotes.exe 33 PID 2600 wrote to memory of 560 2600 skotes.exe 33 PID 2600 wrote to memory of 560 2600 skotes.exe 33 PID 2600 wrote to memory of 560 2600 skotes.exe 33 PID 2600 wrote to memory of 2256 2600 skotes.exe 35 PID 2600 wrote to memory of 2256 2600 skotes.exe 35 PID 2600 wrote to memory of 2256 2600 skotes.exe 35 PID 2600 wrote to memory of 2256 2600 skotes.exe 35 PID 2600 wrote to memory of 1268 2600 skotes.exe 36 PID 2600 wrote to memory of 1268 2600 skotes.exe 36 PID 2600 wrote to memory of 1268 2600 skotes.exe 36 PID 2600 wrote to memory of 1268 2600 skotes.exe 36 PID 2600 wrote to memory of 1596 2600 skotes.exe 37 PID 2600 wrote to memory of 1596 2600 skotes.exe 37 PID 2600 wrote to memory of 1596 2600 skotes.exe 37 PID 2600 wrote to memory of 1596 2600 skotes.exe 37 PID 2600 wrote to memory of 2624 2600 skotes.exe 38 PID 2600 wrote to memory of 2624 2600 skotes.exe 38 PID 2600 wrote to memory of 2624 2600 skotes.exe 38 PID 2600 wrote to memory of 2624 2600 skotes.exe 38 PID 2600 wrote to memory of 2360 2600 skotes.exe 39 PID 2600 wrote to memory of 2360 2600 skotes.exe 39 PID 2600 wrote to memory of 2360 2600 skotes.exe 39 PID 2600 wrote to memory of 2360 2600 skotes.exe 39 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2360 wrote to memory of 1012 2360 9a1777e7b3.exe 41 PID 2600 wrote to memory of 1776 2600 skotes.exe 42 PID 2600 wrote to memory of 1776 2600 skotes.exe 42 PID 2600 wrote to memory of 1776 2600 skotes.exe 42 PID 2600 wrote to memory of 1776 2600 skotes.exe 42 PID 2600 wrote to memory of 1776 2600 skotes.exe 42 PID 2600 wrote to memory of 1776 2600 skotes.exe 42 PID 2600 wrote to memory of 1776 2600 skotes.exe 42 PID 2600 wrote to memory of 2192 2600 skotes.exe 43 PID 2600 wrote to memory of 2192 2600 skotes.exe 43 PID 2600 wrote to memory of 2192 2600 skotes.exe 43 PID 2600 wrote to memory of 2192 2600 skotes.exe 43 PID 2192 wrote to memory of 1888 2192 69c3a4d93a.exe 45 PID 2192 wrote to memory of 1888 2192 69c3a4d93a.exe 45 PID 2192 wrote to memory of 1888 2192 69c3a4d93a.exe 45 PID 2192 wrote to memory of 1888 2192 69c3a4d93a.exe 45 PID 2192 wrote to memory of 2280 2192 69c3a4d93a.exe 47 PID 2192 wrote to memory of 2280 2192 69c3a4d93a.exe 47 PID 2192 wrote to memory of 2280 2192 69c3a4d93a.exe 47 PID 2192 wrote to memory of 2280 2192 69c3a4d93a.exe 47 PID 2600 wrote to memory of 1104 2600 skotes.exe 49 PID 2600 wrote to memory of 1104 2600 skotes.exe 49 PID 2600 wrote to memory of 1104 2600 skotes.exe 49 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 6512 attrib.exe 6564 attrib.exe 6548 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\1018024001\cd4ff83cfc.exe"C:\Users\Admin\AppData\Local\Temp\1018024001\cd4ff83cfc.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\1018058001\616c6a6fe5.exe"C:\Users\Admin\AppData\Local\Temp\1018058001\616c6a6fe5.exe"4⤵
- Executes dropped EXE
PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\1018059001\3c31bb53d6.exe"C:\Users\Admin\AppData\Local\Temp\1018059001\3c31bb53d6.exe"4⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\1018060001\1b3128729e.exe"C:\Users\Admin\AppData\Local\Temp\1018060001\1b3128729e.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
C:\Users\Admin\AppData\Local\Temp\1018061001\17c0be04ca.exe"C:\Users\Admin\AppData\Local\Temp\1018061001\17c0be04ca.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"5⤵
- Executes dropped EXE
PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:272
-
-
-
C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe"C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe"C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1012
-
-
-
C:\Users\Admin\AppData\Local\Temp\1018064001\477c0509ba.exe"C:\Users\Admin\AppData\Local\Temp\1018064001\477c0509ba.exe"4⤵
- Executes dropped EXE
PID:1776
-
-
C:\Users\Admin\AppData\Local\Temp\1018065001\69c3a4d93a.exe"C:\Users\Admin\AppData\Local\Temp\1018065001\69c3a4d93a.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\cquuy"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
-
C:\Users\Admin\AppData\Local\Temp\1018066001\4e6c5211b6.exe"C:\Users\Admin\AppData\Local\Temp\1018066001\4e6c5211b6.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\1018067001\81bc274c20.exe"C:\Users\Admin\AppData\Local\Temp\1018067001\81bc274c20.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2692 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""5⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3160 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6de9758,0x7fef6de9768,0x7fef6de97786⤵PID:3184
-
-
C:\Windows\system32\ctfmon.exectfmon.exe6⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:26⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:86⤵PID:3652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:86⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2480 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2488 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:26⤵PID:7920
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""5⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5319758,0x7fef5319768,0x7fef53197786⤵PID:2856
-
-
C:\Windows\system32\ctfmon.exectfmon.exe6⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:26⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:86⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:86⤵PID:3156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2540 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2528 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=148 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:26⤵PID:4604
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\CBAFIDAECB.exe"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:8404 -
C:\Users\Admin\Documents\CBAFIDAECB.exe"C:\Users\Admin\Documents\CBAFIDAECB.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:8440
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1018068001\b24d56b4d9.exe"C:\Users\Admin\AppData\Local\Temp\1018068001\b24d56b4d9.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2224 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:7672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:7952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:8048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:8152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking5⤵PID:8244
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8260 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.0.1721961944\767368503" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f25ada5f-7b64-4ad3-96de-339455bde6f4} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 1284 120d5b58 gpu7⤵PID:8656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.1.68233821\1431001318" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a892beb5-436e-48e4-8770-34061d40b046} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 1500 d74b58 socket7⤵PID:8792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.2.892931038\980113445" -childID 1 -isForBrowser -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04c3268d-b369-4e06-9a52-2c387f787eca} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 2116 1a6be258 tab7⤵PID:9372
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.3.978749333\1540817521" -childID 2 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4ed976-ceb8-45d7-84fb-3656f0c90e15} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 2916 d63058 tab7⤵PID:9924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.4.1935841042\427895205" -childID 3 -isForBrowser -prefsHandle 3744 -prefMapHandle 3740 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6291dccb-a44d-48ff-8f99-c3ee2fee82bf} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 3756 20f38558 tab7⤵PID:5160
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.5.565087384\365174552" -childID 4 -isForBrowser -prefsHandle 3864 -prefMapHandle 3868 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cecf3b8-49cd-421f-97d7-6888ee3de8b3} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 3852 20f9bf58 tab7⤵PID:5324
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.6.2134589127\131364990" -childID 5 -isForBrowser -prefsHandle 4040 -prefMapHandle 4044 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97856ac6-2839-4106-90a5-ac908724852c} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 4028 20f99558 tab7⤵PID:5844
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1018069001\0200dc27b8.exe"C:\Users\Admin\AppData\Local\Temp\1018069001\0200dc27b8.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\1018070001\35cca5c170.exe"C:\Users\Admin\AppData\Local\Temp\1018070001\35cca5c170.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\1018071001\9a9afce362.exe"C:\Users\Admin\AppData\Local\Temp\1018071001\9a9afce362.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5724 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"5⤵
- Loads dropped DLL
PID:6060 -
C:\Windows\system32\mode.commode 65,106⤵PID:6104
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6120
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6176
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6236
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6284
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6332
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6376
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6416
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6464
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"6⤵
- Views/modifies file attributes
PID:6512
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"6⤵
- Executes dropped EXE
PID:6524 -
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe7⤵
- Views/modifies file attributes
PID:6548
-
-
C:\Windows\system32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe7⤵
- Views/modifies file attributes
PID:6564
-
-
C:\Windows\system32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE7⤵
- Scheduled Task/Job: Scheduled Task
PID:6612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6628 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6832
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1018072001\616e3ded96.exe"C:\Users\Admin\AppData\Local\Temp\1018072001\616e3ded96.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:7120
-
-
C:\Users\Admin\AppData\Local\Temp\1018073001\6f1d33df34.exe"C:\Users\Admin\AppData\Local\Temp\1018073001\6f1d33df34.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:7760
-
-
C:\Users\Admin\AppData\Local\Temp\1018074001\4c2179552a.exe"C:\Users\Admin\AppData\Local\Temp\1018074001\4c2179552a.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8256 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\uewoyws"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8708
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:8848
-
-
-
C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:9208 -
C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"5⤵
- Executes dropped EXE
PID:4188
-
-
C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"5⤵
- Executes dropped EXE
PID:4048
-
-
C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"5⤵
- Executes dropped EXE
PID:4272
-
-
C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"5⤵
- Executes dropped EXE
PID:4308
-
-
C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"5⤵
- Executes dropped EXE
PID:4512
-
-
-
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:8052
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2876
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3932
-
C:\Windows\system32\taskeng.exetaskeng.exe {9E01D8C9-A7EB-438A-8984-A115883AEC81} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]1⤵
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1984 -
C:\Windows\explorer.exeexplorer.exe3⤵PID:2264
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- Drops file in System32 directory
- System Network Configuration Discovery: Internet Connection Discovery
PID:2500 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3048
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD544691fdf709576c5467bd86b9d95cecb
SHA19c0e49c662f20cdd89217f1bb4b4ba701e659697
SHA256bbeef7deae86cbdb634c26982101647e319bb03dce941d124f0ab0edc8a76de9
SHA512e52fb7f7091ed7a21944c629081fa5069f47fc076911101e20fdcc183c35b7b460fbbfac56f1f91052b1d35a35e66ce2dafce70349ed34ca6f16ba1e1f1fabdf
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000002.dbtmp
Filesize16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT~RFf781101.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
86B
MD5961e3604f228b0d10541ebf921500c86
SHA16e00570d9f78d9cfebe67d4da5efe546543949a7
SHA256f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
SHA512535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\download[1].htm
Filesize1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp
Filesize31KB
MD51406d39146191c18c7314fe0ddef485b
SHA159a974c74514223bf378732396da85e924197a33
SHA256519077f80fd5ec3ca1d18f96f7d47e118d5921561639d4eac7dcc65b9b41889e
SHA5121ece74d4b64602fc9fbc2a9a9331b23b598d00f47f0e5adb11487e4a0aa68d7e4b58575b1d018c28445a2133ddb6fcf65688cef12ee4e3065313df438d5a4e55
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
2.8MB
MD554bd0a4a6832cd8741dd5fc5f0daf5a6
SHA1f26f87b42fdf58061417d60eb1f88ea831170f5d
SHA256ab3c146bcd1ac658f3655aa9b5a862ec2b47811729b69fad46856e31a6e74747
SHA5129c80905c436ce23840be805222778f6a0332c768fb105ac63e11b8ebbb2f4330ac7630611d9ed5f7dc32fa70f1dbd3c6ecc7faf5f728d496102e1d96c5ce2cb9
-
Filesize
758KB
MD5afd936e441bf5cbdb858e96833cc6ed3
SHA13491edd8c7caf9ae169e21fb58bccd29d95aefef
SHA256c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf
SHA512928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325
-
Filesize
4.2MB
MD58664a5a6e958f985735b8a17171550bc
SHA13deb8bfcdc32ddf9a678f44c59aa70e3a7f5bb5f
SHA256ffcc7288342a28c0580bea142951bf4ac33a3f391d8f9323f9e74293d2817e82
SHA512adc1c9bc3af3a39b066a9231ef6bd9119d48dff41a4e5bfac695c40a5d2b9e5e9f4eb6e4779408cd7f22fe0e7e5697d7fa314778864fd13bb321db3f8d0514b0
-
Filesize
1.8MB
MD525fb9c54265bbacc7a055174479f0b70
SHA14af069a2ec874703a7e29023d23a1ada491b584e
SHA256552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c
SHA5127dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668
-
Filesize
4.3MB
MD598f2f2f0d74571af72dd4ca43c1692bf
SHA1507cac98014412c6e697ea75f3c1941bad57df48
SHA256dfe46285484362af5dc63dd0bba5de89c1c1d7105f7e8d05b2514fa39ac3750a
SHA512555b04fcb4fb1b49f35bd99bbcc9e40b85bec6fb604c71ce997a0027eb616248e0cd225de905c2d72b5e72763383438250a0063fefdf3323137e075b76cc63c5
-
Filesize
1.1MB
MD5ef08a45833a7d881c90ded1952f96cb4
SHA1f04aeeb63a1409bd916558d2c40fab8a5ed8168b
SHA25633c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501
SHA51274e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97
-
Filesize
791KB
MD5e8af4d0d0b47ac68d762b7f288ae8e6e
SHA11d65f31526cc20ab41d6b1625d6674d7f13e326c
SHA256b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e
SHA51280fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a
-
Filesize
1.3MB
MD5669ed3665495a4a52029ff680ec8eba9
SHA17785e285365a141e307931ca4c4ef00b7ecc8986
SHA2562d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6
SHA512bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6
-
Filesize
21KB
MD504f57c6fb2b2cd8dcc4b38e4a93d4366
SHA161770495aa18d480f70b654d1f57998e5bd8c885
SHA25651e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2
SHA51253f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd
-
Filesize
1.8MB
MD5bdf0a999471704099de200c1b8d4f5a5
SHA1887df22c17b497db45aabd65c03c99baea6091f9
SHA25643edbdfbc0965167d308cd328673c0be4e6e93d5144336f65eba2006161e6bc8
SHA512f6850301552cc95891caf0899237af6353b8c492c9cb2c4aae2f37ef18b19445b6a6e2a12d270d7c43d889c5686b29be121945e112da579dc72bfd1fd6d06475
-
Filesize
2.7MB
MD517689ee1bc4b479f392aa69876e90e3e
SHA11f3870d8224ff1105b03753f6850f8d66ba077ff
SHA2560bb4fdf5ddb431f5d0716e4d9094fa3bbbee5fe2ba97b98cbe25c4593f15c5e7
SHA512a681565417c865be4aa4b506726efcd161fc6d3c90d98797d05869f5eec5108f94782e6c6cb774b4b719e541110b9f1b6164e80deaed6a7235faea64ee8fa450
-
Filesize
945KB
MD594ae8249f4bf0e363bbcc67b69d52bd0
SHA1b917ee5b27c344c0147609bb994294acf9d8d6f9
SHA2569e5456a9bf5f36dd3b8288997b16fe3c55b0800b938328b481e637b4e0371e34
SHA51234c76e44717763578cc62b884ead678226d0da7a0e6711d8b073197e6ee870bf293c9396e096d9c33de8f864dea81fcdc957a69e58e7b771ff262c36068abcb1
-
Filesize
2.7MB
MD5f0e4922229913a534bd558065e1dafa2
SHA1c8d9257cd350a3b19450b584640af08a8a9a5841
SHA25673ca2fe54c0712c8ccb343ee59fdc4bfa257d57e865ba35999bcf8d099b5a588
SHA51280147ac5e71696ec84419e2fbfdceac6e9c6bd8906600b49a9c1baa159b006ce7c92aa8eceeeacd414aeba7408b8d640421b27cd588ba1aa24b366384493fc57
-
Filesize
1.8MB
MD583aa26bd8755e994141c4b6d525307ba
SHA11cc2485520840247010cd5a2a6f6ba69924a8da5
SHA2560e5c004b6ac8fd180951d14352e8eb0e4b9b3d4e32dbeaa194a7af7c77d3b4d7
SHA512ad96208839e796d6572385c838141d2b96c55388afa21d3eeca8a11135f51fd49c5f80a5de9aa1c0925cb3fea9c626bb9a42e16556eaabc2baaf727c58cf3fdb
-
Filesize
4.2MB
MD53a425626cbd40345f5b8dddd6b2b9efa
SHA17b50e108e293e54c15dce816552356f424eea97a
SHA256ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
SHA512a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668
-
Filesize
1.8MB
MD5ff279f4e5b1c6fbda804d2437c2dbdc8
SHA12feb3762c877a5ae3ca60eeebc37003ad0844245
SHA256e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378
SHA512c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967
-
Filesize
1.9MB
MD5e5129dcbd20769ce04b87c5ea32bf280
SHA14380cf7eaae822456b3b850661c219f5cdb32169
SHA256da40b7cf993a8f9173ee4fdb1830c9cc780c8ac372a0f1961392817360a53186
SHA5128ffed94739ef07725377b6c6f5d48f875d8bd0a4253bb7fe5163d7824848d033234ae7b1104ca9dea9a1187b9d20ec5674d6772546fe1d3a4068c63b575428b0
-
Filesize
21KB
MD514becdf1e2402e9aa6c2be0e6167041e
SHA172cbbae6878f5e06060a0038b25ede93b445f0df
SHA2567a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a
SHA51216b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a
-
Filesize
3.1MB
MD5c00a67d527ef38dc6f49d0ad7f13b393
SHA17b8f2de130ab5e4e59c3c2f4a071bda831ac219d
SHA25612226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3
SHA5129286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2.9MB
MD5744e8a3718a8bccb6c0bfe243c7ac195
SHA106ad06e208965913a03307439e68f1168027fb89
SHA2569c41a2f71bf50c12c268e61147794c07e5a65642cd2a08235f5dce0ad0cdbc63
SHA51266802302b003b51072a4eba3b81dd4728f88d642a5813d57e402fd4ab23b4f0f6f07f6812380b6c5bc42818c6a6efc32654405c96253befd023c1b26d5286273
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
440B
MD53626532127e3066df98e34c3d56a1869
SHA15fa7102f02615afde4efd4ed091744e842c63f78
SHA2562a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca
SHA512dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CAUPEQT6MDBQZZ7ZSLLM.temp
Filesize7KB
MD53fa5db268cebdcfad35938e5fd07c069
SHA150f7f9e7eaa5306ad94a5565e9b457735de9b07c
SHA2567c54330536af2d38ff8aef7c67d1da98ab8427e6299494f05b0fad9f663529b3
SHA512c7b9b070b2b76ea2d607f93cc6ec980cd279dcc834117eaf159bbe953ccd5b8c5589f0f291f2ad2948b0d8d3914492a366c6c88f3eb10dbec5ef790f3d0a9dfa
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5e7e6e169e7faef2fbf622f3f5a7e4338
SHA1497a0191f3e8fb90733e0dd05953688bb1e3a942
SHA25662e5172d73434e321fc22908667fa7d00c9a69f6a4b1e9100ad57aa41fdc4659
SHA51244d1163a3f4147dc84bdfa583f61bfef1818dd57e7772db102bd6b425ca5abe0b718e157d6fa8a4ed3ae5589aac44dfc1dca7e4b3010cacc47216c36fe105467
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD507b084134f6379ef8404dd6f4cadcb30
SHA189ebf34cb43f780140de77d21b0ac6f0f58a7277
SHA256aab87baaababfe70a386b6fe4c1363fb5d72cf1cbbc8fd5d163ad84b05d38a65
SHA5123c0621051a25460fdf54f619b80d5ef51f0a1054a78880d2ed8841b624c43aaa37717d32bce4d9d6e6d63b5a123fc804c2ed0c27f547e3f36e966ff2af9e7173
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\b3d8b3de-345e-4ea9-83a4-6161224d386d
Filesize733B
MD5a915281a2233ed8ad9089cb40021a162
SHA156a8b3b1559b6894926584ad74e94507370c2aac
SHA256a45826a03423bd2ac4c59f72187d111a29fad63ed776884e3f6fbd31b99201ac
SHA512ce6185deaa118b1ffc813d1ebf3ab2e8e07c86f0f920a7b793ddccad00fe752b2bc408f5ecdc504006b52ccea2f23e80a703b6dc0c7b64d37f5714294e64f13f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD527061fdd9942931782cdb021e74fd21c
SHA1d9f4cb4a09c2302ec3c7e54ef31348d36697041c
SHA256e898bbc36cafecdadfebd360b40671786bae0b48bba7836c36855a2bc72a6b93
SHA5126ad1e88dd2b9ebe856a753f23409971d634199a1f2c4c7ab12bb1447b520e62f7f252242f0017b8031707a9d1ed774805e78b5156219f0f96182a3e76c656056
-
Filesize
6KB
MD5357c887e26ac09c3b9e36b69c707c301
SHA165e4930d3520f87361f375079e74f92877709d26
SHA256b0c91c0160edb4fd029cf655b638390cbae8b1498cb3bffc9c0d0b7e8585fe5f
SHA5126d457168c9f9e92c1e06924aa4e16fad9e1c703b9cc7621d419d82d1a33e23b8f0e227ec4afa86d888bdf3befb70d42199e893641d3747052f1e69ec6045ffc2
-
Filesize
6KB
MD5f125b0d8134ce6689516d61403de7605
SHA1a673b9459abe38fd5d3c6d4d6272712080a41e39
SHA256f32fdc3cf9388495134e97b579a84ff17a0bbde2639ff045f1de665a2490d747
SHA512e8edff4a64b4f1082ed03e8111276df8347ba291b841bf7f239a85ebd40c3d539ef8e6470372b9da532621a75db92239db59f3823114bbc451f2924a542d39c3
-
Filesize
6KB
MD564386662cf1ff0a364bfdb9182126e4e
SHA179d953d1b517422f7e82d3fa0ddf347ca664f635
SHA256413f5f03700d5098ccbd4b78a0c525bb0b047e90867c1823495901210c0448cc
SHA512cd518b70b1b75db3fd049d4a4d9a9055346bbcdff82646cd7a11437a27dabf10b855e0b23b7aafc621067612047065c934227d554bd34c8160539afb64b351ef
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD57f41c614b1bd81760db474267036fbd1
SHA104b15d45e04d712f2f1bf1ac010d0b88b805adfb
SHA256e2ae03b691d4fb7410a31d4813867dc4ace5a8b50038f900171b5451992d42b2
SHA512682105861b09ac899edcac5c08b0e4362d20cbac8497c0040247fa92192b961153a06222b87229322929dcb7e7f250dec7adf844427d4fc75d686127c5975fca