amadey | e8b6019ff977c06318a16605f86966341131d037a9e5fa4a46e2ac8780e992c6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

2.9MB
MD5

8d69adfe2e1db76b837405b076979809
SHA1

b0c34909c5c70dc82384356a7a7d62877c6c82c8
SHA256

e8b6019ff977c06318a16605f86966341131d037a9e5fa4a46e2ac8780e992c6
SHA512

78a09192f872e355176b1fc642b9ad4c9d056f4c2465d17bd965c849e9e3e0669d825dbdeffe6060fc21dccef7dc76207ea585beb2653073feb9f20a7c8221bb
SSDEEP

49152:HY8f7HONSV4eK0Toe/cil9yPFSxoMu4Q56M4/n:HTOEWeK2oe//9ydIFuJD6n

Score

10^/10

amadey gcleaner lumma stealc systembc vidar 9c9aa5 stok credential_access discovery evasion execution loader persistence spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

systembc

wodresomdaymomentum.org

Attributes

dns
5.132.191.104

ns1.vic.au.dns.opennic.glue

ns2.vic.au.dns.opennic.glue

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0007000000023cf5-5107.dat	family_vidar_v7
behavioral2/memory/3584-5112-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7
behavioral2/memory/3584-5185-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 4600 created 3540	4600	systemsound.exe	56
PID 4452 created 3540	4452	Gxtuum.exe	56
PID 592 created 3540	592	Gxtuum.exe	56
PID 5452 created 3540	5452	eula.exe	56
PID 4960 created 3540	4960	Gxtuum.exe	56
PID 5880 created 3540	5880	ptbvaxi.exe	56

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Systembc family
systembc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	a530d299f2.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a530d299f2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	799c578aed.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4e384af530.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7e6db00ac8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	KDLBJP7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2be412dd05.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
76	4860	rundll32.exe
77	4860	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5676	powershell.exe
856	powershell.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2380	chrome.exe
824	chrome.exe
2796	chrome.exe
6776	chrome.exe
5964	chrome.exe

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a530d299f2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2be412dd05.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KDLBJP7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4e384af530.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2be412dd05.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7e6db00ac8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a530d299f2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	799c578aed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4e384af530.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7e6db00ac8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KDLBJP7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	799c578aed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dd7b1db6e14e434c89ff5a943dfdb1d9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	systemsound.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	d6e9d0e123.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Gxtuum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	d4c1f13bd8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	f340f0c7301049dfaf017911d69f2ccf.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Target.vbs	systemsound.exe

Executes dropped EXE 37 IoCs

pid	Process
4536	skotes.exe
3920	KDLBJP7.exe
4600	systemsound.exe
2120	systemsound.exe
4452	Gxtuum.exe
4404	d6e9d0e123.exe
1408	7z.exe
2208	7z.exe
1644	7z.exe
1620	7z.exe
2800	7z.exe
3604	7z.exe
1424	7z.exe
4036	7z.exe
4964	in.exe
2644	skotes.exe
592	Gxtuum.exe
5772	Gxtuum.exe
2536	a530d299f2.exe
4924	Gxtuum.exe
5452	eula.exe
5468	38deaf1368.exe
3296	d4c1f13bd8.exe
2004	eula.exe
3584	dd7b1db6e14e434c89ff5a943dfdb1d9.exe
3868	f340f0c7301049dfaf017911d69f2ccf.exe
4376	799c578aed.exe
3464	4e384af530.exe
1152	2be412dd05.exe
3724	skotes.exe
4960	Gxtuum.exe
5880	ptbvaxi.exe
5684	Intel_PTT_EK_Recertification.exe
1788	7e6db00ac8.exe
6596	Gxtuum.exe
6364	acb29b9008.exe
5944	ptbvaxi.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	a530d299f2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	799c578aed.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	4e384af530.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	KDLBJP7.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	2be412dd05.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	7e6db00ac8.exe

Loads dropped DLL 9 IoCs

pid	Process
1408	7z.exe
2208	7z.exe
1644	7z.exe
1620	7z.exe
2800	7z.exe
3604	7z.exe
1424	7z.exe
4036	7z.exe
4860	rundll32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\terms.dll = "rundll32 C:\\Users\\Admin\\AppData\\Roaming\\10001320110\\terms.dll, Main"	Gxtuum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2be412dd05.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018827001\\2be412dd05.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7e6db00ac8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018828001\\7e6db00ac8.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acb29b9008.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018829001\\acb29b9008.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
101	raw.githubusercontent.com
99	raw.githubusercontent.com
100	raw.githubusercontent.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023da7-7972.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
1716	file.exe
4536	skotes.exe
3920	KDLBJP7.exe
2644	skotes.exe
2536	a530d299f2.exe
4376	799c578aed.exe
3464	4e384af530.exe
1152	2be412dd05.exe
3724	skotes.exe
1788	7e6db00ac8.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4600 set thread context of 2120	4600	systemsound.exe	103
PID 4452 set thread context of 5772	4452	Gxtuum.exe	130
PID 592 set thread context of 4924	592	Gxtuum.exe	136
PID 5452 set thread context of 2004	5452	eula.exe	147
PID 5684 set thread context of 6168	5684	Intel_PTT_EK_Recertification.exe	185
PID 4960 set thread context of 6596	4960	Gxtuum.exe	190
PID 5880 set thread context of 5944	5880	ptbvaxi.exe	195

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023cea-2536.dat	upx
behavioral2/memory/4964-2539-0x00007FF626E90000-0x00007FF627320000-memory.dmp	upx
behavioral2/memory/4964-2544-0x00007FF626E90000-0x00007FF627320000-memory.dmp	upx
behavioral2/memory/5684-7806-0x00007FF6E04F0000-0x00007FF6E0980000-memory.dmp	upx
behavioral2/memory/5684-7821-0x00007FF6E04F0000-0x00007FF6E0980000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Gxtuum.job	systemsound.exe
File created	C:\Windows\Tasks\Test Task17.job	eula.exe
File created	C:\Windows\Tasks\skotes.job	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5792	3464	WerFault.exe	153

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acb29b9008.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	acb29b9008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ptbvaxi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eula.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2be412dd05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systemsound.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4c1f13bd8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd7b1db6e14e434c89ff5a943dfdb1d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ptbvaxi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KDLBJP7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6e9d0e123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	acb29b9008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eula.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e384af530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a530d299f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	799c578aed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systemsound.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38deaf1368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e6db00ac8.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4960	powershell.exe
3772	PING.EXE
1080	powershell.exe
5224	PING.EXE

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dd7b1db6e14e434c89ff5a943dfdb1d9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dd7b1db6e14e434c89ff5a943dfdb1d9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7e6db00ac8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7e6db00ac8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
924	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
6388	taskkill.exe
6648	taskkill.exe
6188	taskkill.exe
6236	taskkill.exe
2476	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133791992134894939"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	firefox.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3772	PING.EXE
5224	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1716	file.exe
1716	file.exe
4536	skotes.exe
4536	skotes.exe
3920	KDLBJP7.exe
3920	KDLBJP7.exe
4600	systemsound.exe
4960	powershell.exe
2644	skotes.exe
2644	skotes.exe
4960	powershell.exe
4960	powershell.exe
4452	Gxtuum.exe
4452	Gxtuum.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
2536	a530d299f2.exe
592	Gxtuum.exe
5468	38deaf1368.exe
5468	38deaf1368.exe
3296	d4c1f13bd8.exe
5676	powershell.exe
5676	powershell.exe
5676	powershell.exe
5468	38deaf1368.exe
856	powershell.exe
856	powershell.exe
856	powershell.exe
5452	eula.exe
5452	eula.exe
4376	799c578aed.exe
4376	799c578aed.exe
3584	dd7b1db6e14e434c89ff5a943dfdb1d9.exe
3584	dd7b1db6e14e434c89ff5a943dfdb1d9.exe
3464	4e384af530.exe
3464	4e384af530.exe
6016	msedge.exe
6016	msedge.exe
3516	msedge.exe
3516	msedge.exe
1152	2be412dd05.exe
1152	2be412dd05.exe
5568	identity_helper.exe
5568	identity_helper.exe
3724	skotes.exe
3724	skotes.exe
5684	Intel_PTT_EK_Recertification.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1788	7e6db00ac8.exe
1788	7e6db00ac8.exe
1788	7e6db00ac8.exe
1788	7e6db00ac8.exe
4960	Gxtuum.exe
4960	Gxtuum.exe
5880	ptbvaxi.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	systemsound.exe
Token: SeDebugPrivilege	4600	systemsound.exe
Token: SeDebugPrivilege	4452	Gxtuum.exe
Token: SeRestorePrivilege	1408	7z.exe
Token: 35	1408	7z.exe
Token: SeSecurityPrivilege	1408	7z.exe
Token: SeSecurityPrivilege	1408	7z.exe
Token: SeRestorePrivilege	2208	7z.exe
Token: 35	2208	7z.exe
Token: SeSecurityPrivilege	2208	7z.exe
Token: SeSecurityPrivilege	2208	7z.exe
Token: SeRestorePrivilege	1644	7z.exe
Token: 35	1644	7z.exe
Token: SeSecurityPrivilege	1644	7z.exe
Token: SeSecurityPrivilege	1644	7z.exe
Token: SeRestorePrivilege	1620	7z.exe
Token: 35	1620	7z.exe
Token: SeSecurityPrivilege	1620	7z.exe
Token: SeSecurityPrivilege	1620	7z.exe
Token: SeRestorePrivilege	2800	7z.exe
Token: 35	2800	7z.exe
Token: SeSecurityPrivilege	2800	7z.exe
Token: SeSecurityPrivilege	2800	7z.exe
Token: SeRestorePrivilege	3604	7z.exe
Token: 35	3604	7z.exe
Token: SeSecurityPrivilege	3604	7z.exe
Token: SeSecurityPrivilege	3604	7z.exe
Token: SeRestorePrivilege	1424	7z.exe
Token: 35	1424	7z.exe
Token: SeSecurityPrivilege	1424	7z.exe
Token: SeSecurityPrivilege	1424	7z.exe
Token: SeRestorePrivilege	4036	7z.exe
Token: 35	4036	7z.exe
Token: SeSecurityPrivilege	4036	7z.exe
Token: SeSecurityPrivilege	4036	7z.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	592	Gxtuum.exe
Token: SeDebugPrivilege	4452	Gxtuum.exe
Token: SeDebugPrivilege	592	Gxtuum.exe
Token: SeDebugPrivilege	5452	eula.exe
Token: SeDebugPrivilege	3296	d4c1f13bd8.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	5452	eula.exe
Token: SeDebugPrivilege	3868	f340f0c7301049dfaf017911d69f2ccf.exe
Token: SeDebugPrivilege	4960	Gxtuum.exe
Token: SeDebugPrivilege	5880	ptbvaxi.exe
Token: SeLockMemoryPrivilege	6168	explorer.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	4960	Gxtuum.exe
Token: SeDebugPrivilege	5880	ptbvaxi.exe
Token: SeDebugPrivilege	6188	taskkill.exe
Token: SeDebugPrivilege	6236	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	6388	taskkill.exe
Token: SeDebugPrivilege	6648	taskkill.exe
Token: SeDebugPrivilege	6944	firefox.exe
Token: SeDebugPrivilege	6944	firefox.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1716	file.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6944	firefox.exe
6364	acb29b9008.exe
6364	acb29b9008.exe
6364	acb29b9008.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6944	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 4536	1716	file.exe	83
PID 1716 wrote to memory of 4536	1716	file.exe	83
PID 1716 wrote to memory of 4536	1716	file.exe	83
PID 4536 wrote to memory of 3920	4536	skotes.exe	85
PID 4536 wrote to memory of 3920	4536	skotes.exe	85
PID 4536 wrote to memory of 3920	4536	skotes.exe	85
PID 4536 wrote to memory of 4600	4536	skotes.exe	99
PID 4536 wrote to memory of 4600	4536	skotes.exe	99
PID 4536 wrote to memory of 4600	4536	skotes.exe	99
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 4600 wrote to memory of 2120	4600	systemsound.exe	103
PID 2120 wrote to memory of 4452	2120	systemsound.exe	104
PID 2120 wrote to memory of 4452	2120	systemsound.exe	104
PID 2120 wrote to memory of 4452	2120	systemsound.exe	104
PID 4536 wrote to memory of 4404	4536	skotes.exe	105
PID 4536 wrote to memory of 4404	4536	skotes.exe	105
PID 4536 wrote to memory of 4404	4536	skotes.exe	105
PID 4404 wrote to memory of 5024	4404	d6e9d0e123.exe	106
PID 4404 wrote to memory of 5024	4404	d6e9d0e123.exe	106
PID 5024 wrote to memory of 2084	5024	cmd.exe	108
PID 5024 wrote to memory of 2084	5024	cmd.exe	108
PID 5024 wrote to memory of 1408	5024	cmd.exe	109
PID 5024 wrote to memory of 1408	5024	cmd.exe	109
PID 5024 wrote to memory of 2208	5024	cmd.exe	110
PID 5024 wrote to memory of 2208	5024	cmd.exe	110
PID 5024 wrote to memory of 1644	5024	cmd.exe	111
PID 5024 wrote to memory of 1644	5024	cmd.exe	111
PID 5024 wrote to memory of 1620	5024	cmd.exe	112
PID 5024 wrote to memory of 1620	5024	cmd.exe	112
PID 5024 wrote to memory of 2800	5024	cmd.exe	113
PID 5024 wrote to memory of 2800	5024	cmd.exe	113
PID 5024 wrote to memory of 3604	5024	cmd.exe	114
PID 5024 wrote to memory of 3604	5024	cmd.exe	114
PID 5024 wrote to memory of 1424	5024	cmd.exe	115
PID 5024 wrote to memory of 1424	5024	cmd.exe	115
PID 5024 wrote to memory of 4036	5024	cmd.exe	116
PID 5024 wrote to memory of 4036	5024	cmd.exe	116
PID 5024 wrote to memory of 1584	5024	cmd.exe	117
PID 5024 wrote to memory of 1584	5024	cmd.exe	117
PID 5024 wrote to memory of 4964	5024	cmd.exe	118
PID 5024 wrote to memory of 4964	5024	cmd.exe	118
PID 4964 wrote to memory of 4688	4964	in.exe	119
PID 4964 wrote to memory of 4688	4964	in.exe	119
PID 4964 wrote to memory of 2324	4964	in.exe	120
PID 4964 wrote to memory of 2324	4964	in.exe	120
PID 4964 wrote to memory of 2728	4964	in.exe	123
PID 4964 wrote to memory of 2728	4964	in.exe	123
PID 4964 wrote to memory of 4960	4964	in.exe	124
PID 4964 wrote to memory of 4960	4964	in.exe	124
PID 4960 wrote to memory of 3772	4960	powershell.exe	128
PID 4960 wrote to memory of 3772	4960	powershell.exe	128
PID 4452 wrote to memory of 5772	4452	Gxtuum.exe	130
PID 4452 wrote to memory of 5772	4452	Gxtuum.exe	130
PID 4452 wrote to memory of 5772	4452	Gxtuum.exe	130
PID 4452 wrote to memory of 5772	4452	Gxtuum.exe	130
PID 4452 wrote to memory of 5772	4452	Gxtuum.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1584	attrib.exe
4688	attrib.exe
2324	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3540
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\1018586001\KDLBJP7.exe
      "C:\Users\Admin\AppData\Local\Temp\1018586001\KDLBJP7.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\1018676001\systemsound.exe
      "C:\Users\Admin\AppData\Local\Temp\1018676001\systemsound.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\1018821001\d6e9d0e123.exe
      "C:\Users\Admin\AppData\Local\Temp\1018821001\d6e9d0e123.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5024
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
      - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        6⤵
        Views/modifies file attributes
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:4688
        
        C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:2324
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\1018822001\a530d299f2.exe
      "C:\Users\Admin\AppData\Local\Temp\1018822001\a530d299f2.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\1018823001\38deaf1368.exe
      "C:\Users\Admin\AppData\Local\Temp\1018823001\38deaf1368.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\1018824001\d4c1f13bd8.exe
      "C:\Users\Admin\AppData\Local\Temp\1018824001\d4c1f13bd8.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3296
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\tykmbrtj"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5676
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
    - - C:\tykmbrtj\dd7b1db6e14e434c89ff5a943dfdb1d9.exe
        
        "C:\tykmbrtj\dd7b1db6e14e434c89ff5a943dfdb1d9.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3584
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\tykmbrtj\dd7b1db6e14e434c89ff5a943dfdb1d9.exe" & rd /s /q "C:\ProgramData\7Y58Q9RIE3W4" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:924
    - - C:\tykmbrtj\f340f0c7301049dfaf017911d69f2ccf.exe
        
        "C:\tykmbrtj\f340f0c7301049dfaf017911d69f2ccf.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9MSZ40SLW145?ocid=&referrer=psi
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80db246f8,0x7ff80db24708,0x7ff80db24718
        7⤵
        
        PID:4688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
        7⤵
        
        PID:6048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
        7⤵
        
        PID:628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        7⤵
        
        PID:6136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        7⤵
        
        PID:4424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
        7⤵
        
        PID:4352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
        7⤵
        
        PID:1452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
        7⤵
        
        PID:4780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        7⤵
        
        PID:5372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9178709970533695019,13624391984039754982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        7⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\1018825001\799c578aed.exe
      "C:\Users\Admin\AppData\Local\Temp\1018825001\799c578aed.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\1018826001\4e384af530.exe
      "C:\Users\Admin\AppData\Local\Temp\1018826001\4e384af530.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3464
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1472
        5⤵
        Program crash
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\1018827001\2be412dd05.exe
      "C:\Users\Admin\AppData\Local\Temp\1018827001\2be412dd05.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\1018828001\7e6db00ac8.exe
      "C:\Users\Admin\AppData\Local\Temp\1018828001\7e6db00ac8.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1788
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2380
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffffce0cc40,0x7ffffce0cc4c,0x7ffffce0cc58
        6⤵
        
        PID:5412
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2112,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:2
        6⤵
        
        PID:6528
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1908,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2144 /prefetch:3
        6⤵
        
        PID:4480
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2452 /prefetch:8
        6⤵
        
        PID:852
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3212 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2796
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:824
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4524,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4348 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:6776
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:8
        6⤵
        
        PID:7160
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5020,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
        6⤵
        
        PID:5980
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4552,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4420 /prefetch:8
        6⤵
        
        PID:5712
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5132 /prefetch:8
        6⤵
        
        PID:5124
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4808,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5104 /prefetch:8
        6⤵
        
        PID:1420
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5076,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
        6⤵
        
        PID:7020
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4812,i,4282045671772381195,4485492173567720201,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5132 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\1018829001\acb29b9008.exe
      "C:\Users\Admin\AppData\Local\Temp\1018829001\acb29b9008.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:6364
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6188
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6236
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6388
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6648
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:6664
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:6944
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d173b144-9686-4c02-b563-2d4a76682cfa} 6944 "\\.\pipe\gecko-crash-server-pipe.6944" gpu
        7⤵
        
        PID:6912
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {040f5830-c665-47ef-b1e0-be76f4de53d5} 6944 "\\.\pipe\gecko-crash-server-pipe.6944" socket
        7⤵
        
        PID:7112
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3036 -childID 1 -isForBrowser -prefsHandle 3152 -prefMapHandle 3048 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58dc4eb9-b8c9-48d7-892b-459df723c4be} 6944 "\\.\pipe\gecko-crash-server-pipe.6944" tab
        7⤵
        
        PID:6112
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4156 -childID 2 -isForBrowser -prefsHandle 4152 -prefMapHandle 4100 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7258093-f095-4fdc-92df-9b6636a1a516} 6944 "\\.\pipe\gecko-crash-server-pipe.6944" tab
        7⤵
        
        PID:4088
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4024 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4864 -prefMapHandle 4832 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a9b445a-7701-46d7-a59e-6ca784e0c40d} 6944 "\\.\pipe\gecko-crash-server-pipe.6944" utility
        7⤵
        Checks processor information in registry
        
        PID:4960
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5300 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc4fe41a-a4c8-49fe-8325-06d54f5c3e31} 6944 "\\.\pipe\gecko-crash-server-pipe.6944" tab
        7⤵
        
        PID:2020
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5524 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54a9344a-9cb2-499f-b458-12d83ac2a9fb} 6944 "\\.\pipe\gecko-crash-server-pipe.6944" tab
        7⤵
        
        PID:5608
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 5 -isForBrowser -prefsHandle 5432 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92e50f9b-8751-44dd-a4d5-98c39b3e309c} 6944 "\\.\pipe\gecko-crash-server-pipe.6944" tab
        7⤵
        
        PID:4980
- C:\Users\Admin\AppData\Local\Temp\1018676001\systemsound.exe
  "C:\Users\Admin\AppData\Local\Temp\1018676001\systemsound.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
    "C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4452
- C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
  "C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5772
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\10001320110\terms.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\10001330101\eula.exe
    "C:\Users\Admin\AppData\Local\Temp\10001330101\eula.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
  "C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe"
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Users\Admin\AppData\Local\Temp\10001330101\eula.exe
  "C:\Users\Admin\AppData\Local\Temp\10001330101\eula.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2004
- C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
  "C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe"
  2⤵
  - Executes dropped EXE
  PID:6596
- C:\ProgramData\adje\ptbvaxi.exe
  "C:\ProgramData\adje\ptbvaxi.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5944

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2644

C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3724

C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\23e3360290\Gxtuum.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5684
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- - C:\Windows\system32\PING.EXE
    "C:\Windows\system32\PING.EXE" 127.1.10.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5224

C:\ProgramData\adje\ptbvaxi.exe
C:\ProgramData\adje\ptbvaxi.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3464 -ip 3464
1⤵
PID:6140

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
897f27bae933b79ede68656c94dd218d

SHA1
bb4cada02674959e5e6eb11cfd08f489f7036eca

SHA256
12285f14443631b6548e6693b860dc108f19fd4b85add0a9632d4f57e9eb7db8

SHA512
68a96f7d7db00af0fe9bcfde2ff78fb3f9b368652ce022d389c7803cf7d7c601e1d2995b0dba0a45726791cffd5cdb2b17e254d0eca1975c5df106a570c62b33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
0d900ccc79205c8c83dfcc7b604515fd

SHA1
ddb611d5a841875bbdd815965467072051a9b7d7

SHA256
1936a9486c834bd370d289be030f3008283e897c69f8636b2589e56c48ed85d8

SHA512
ec700881457b57c84630be9239a66e5dbde6758c5531cbed6494c5f236a28e5dff8729c8f424e0494b6885cb48ad204a8a24549a344726331d90a16f9b3feab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f57610ab5f3c2ea162d4e122e6ab0253

SHA1
8bafaa5dce704c4511bc28d0bd864e1a42899018

SHA256
0f03f35f7618aa5b3a32b59e2a3951a77be2780a0148f458ab48ff8127e36e06

SHA512
b46d50d0af721735876152f895422c87cea7947f4b36ed75f974948195fc4c4538fed080f00ad2cc9cd9ee39fd0ccc405c8bffbd256db4c783c57e9e6bcc4b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
facd60040a7f4bd454f0440837b70480

SHA1
60518a076fe462376149c8727e43ad8746fa6a1f

SHA256
9c94c3b1c54514b66476eb069eb21bac168ae94087448e639a461dda54d276dd

SHA512
a745175f7abc6c7916cbe5398772932acc03e54c423cdd202f98f2004c96f4f28d1943fe9127cd9a8a39d2a62c29128d068e6ca4bf5991d5f8da4744effc32c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\2936b26d-08dd-4131-aa29-e4d14497954b\index-dir\the-real-index

Filesize
72B

MD5
519e8723c6066ceb58452578460fd4a1

SHA1
3b660f9e0592dc47f3b2f3f85ca5aee06a30fe31

SHA256
a274edfd2fab77608f53f23587f3c16e397cf2301369309f68599d01d0536313

SHA512
9bb13b5f0b895eeb0d009d7771595f28e3e1214d4dbb999bdba0cdc77bba312326d47f4250ace94c20c3525d634038835afe9d09b9cdbb5ec1e461f84ce75a29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\2936b26d-08dd-4131-aa29-e4d14497954b\index-dir\the-real-index~RFe5963a2.TMP

Filesize
48B

MD5
d02f59aeeeaa3fd0f2f5ae0d28064d5f

SHA1
e40971d7998d0b61189bd878757fae7d16173251

SHA256
e2c082e4fcd5a4ee28fca0b0511311620fbcbf51adc513d3b0e3a7db02d7285a

SHA512
afabd70ba5e8410939eb35417aaa57cee7b85dc05d267d82e070b1c0c909c5351f1ab4e888659337abacdd3325ceb1561cdee63598bc9a9d221b8b12f688611f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
109B

MD5
05e3bf6406fa282f70f8f188370f3a76

SHA1
44b72c481dbf713e235eabb62f3afac49318d89d

SHA256
f0668811a5300bfb801e5f127d047247bd47235a36d70facc82eb4513e08cc13

SHA512
0ae887e5c12684ee591cd50afc71ec946ee9bf3c9a60c3168571ff245821d2db4d3d6e04d5ceaac0db5cd26add18ca7dd6993166b4e24f57ca8adbf4d8dd5a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
204B

MD5
9ca039ba12db85742fe235838f907f02

SHA1
c85fb0f8694dc5a8e62314fe739693e148f5a56c

SHA256
0d253921c1624e83967c945766ed8b79e25e6773d91c10c34ece4589b84b0264

SHA512
9da13975298e33af8ba2f1af1dc7579b3e0fdbe96d253c6454c2da89d7ddd3b32d7db36575ff1ffed92a8c7209ab565953be432154937b5da04f991095e2d619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e50946904d6df855cc3ff83650e536b8

SHA1
e648be7b57cc35ed3bea2286f19ad5f4bfeee07c

SHA256
b5a461ea42395ff8fbd830f6ba052888c92c6acb0a1c3f0c9b0ee7152b657873

SHA512
fd677a1149dc2cf7907e322ecfb5b73c7aaf33aa4a80896c80c067d5f00ad199aefdad8a02810659dda204a3bde6ec8095422327dfd563908d4fb3572707880f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596344.TMP

Filesize
48B

MD5
98c278ad2d4339f0c9495228ebdbae17

SHA1
0c4a5d94177d6563fcfb16fe2c244b9c03ee0e9a

SHA256
b8d2eb749899ffbce048f5168fdf18e39902f8c564ba630cb93514f5a4bf717e

SHA512
3b43bfd60ab4d7c4487895390df700068e7777cdf759129f1318b237d796692b00cfa7eb4af4ebda39a010f1e4c6c270fbf93d5a71b74069b0fcd338783dd24c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
a3897fb69534d9894158a21c833ceb8f

SHA1
6bd5e5b35336b57eefa556edd551983b76fb8d8e

SHA256
ad16d18c56d92cdfe941aefd47d4cf89da9645e00acc7a35b4b0f6c76b9f7d64

SHA512
dbb39717460285e8182f250ab5541b3d76184fe53275a26eb2fea2977a7a1dadf287878eb4fdf86ff4b8f9e0ed83023b93cedf1a80443d1a6c0a87ae07dbacb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
a4ab3fcfe38127cc8f0d066a4626a1b6

SHA1
a4a2a45b3051a2c95685c54f0ba29c3eae0d6d49

SHA256
082caf594e6a61b7514d2d06eeabeddea6a640fa1d386beda1d989b0a7328bbb

SHA512
1ea9842e073aaeaabff8ff25c5fc1b0a0a41ddd27d4e4c6eff5d2ecb64a130401090d86ede2113f9545a6fb30767913aab54c2c074399af4166e6ce7e637c22e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5955a8.TMP

Filesize
204B

MD5
2979925093b129192bc27df97ffb9ecf

SHA1
2ee939f3ed67ded978e215b91231888f9eaf7305

SHA256
29bbd5567eb6822a948b64c24fea48a3095df27b7b8e1ffa65f5a83913683f66

SHA512
32021426317efddbc7386597eff9826517bc311f83b08ab89e231f881dd5856191b1cca17c1b6cbf609225e6c09672ca7bfe5f565f75d32331500b7130edcfd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c978003817a46c2927c45f6e426d269

SHA1
b4e40552a5e1a0e4fa28d8c8362047f4249b0128

SHA256
7611f13fdf79df98300b96de4fe855e11360134a6179d2401897a496a68a5de6

SHA512
9e8df699f8b565549585fbd533fb9ba792540624f20002441b57d3ca6e2e251b1f8cdd0147595b4c6d0c166e456b81d9caba23cd58dfe75e740bbf60d9073c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
db925f44fc698dfa51e7ea6632521a4a

SHA1
7b923154848c5b2d86c5b0bc80d0740f1aee5c48

SHA256
d1c10fdc02b251b4ef53933864e04cb764444bcae0decabd0214aa5f33b5ff83

SHA512
9465fefa5ac1bbf12fb095f921612be1fe5e7abeedb54d7ac0bcd573b063e499ff1458c8375bfe2b0c7efcaf20b1af37a189e01f502be863692fc910e076275c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\10001330101\eula.exe

Filesize
2.0MB

MD5
cf14dd806489fb5772ebcea711b535a3

SHA1
064e5c703dd348e7408bbfbc0351467e624eea9b

SHA256
f719bd30d817c69e08d81266a4007c60a8c9ad98ddae27d0fa73f9e530b644ac

SHA512
d409ae1228e64f2d311a07e21f04c6a2eea38730db1178e8214725943a1bda31bf9c47d5eba6ea860403b593b98a8ba7ec42dc183385cf659fa64d18a7abb67f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10001330101\eula.exe

Filesize
1.0MB

MD5
73703d5bb617732c13350e6cc99e6c25

SHA1
c09633d94f419676a89c525ff7044bee3b27edf5

SHA256
e29f810eb7e50e88f466808b49e5068fdef0158c0646c14bada596b4cecdf0e4

SHA512
6e25df2bea7571e94258b4e1beca337caa535ab4abe713602a1e50a39c604d332bb82504615b07da799b1e5435dd117ea178dbce0c03992d2e9da6a60dcebde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018586001\KDLBJP7.exe

Filesize
1.8MB

MD5
27c1f96d7e1b72b6817b6efeff037f90

SHA1
2972cc112fc7e20cbf5952abe07407b8c1fbb2a2

SHA256
aec3ec473de321d123e939985579227ee62b53b3b3edb7ab96e2a66c17e9696d

SHA512
9a31dc9945889d35aea8710df2f42806c72c422b7b5f4aa8acba6986cbd9ea6a49181a41a50ee21ccbed86cbff87c98a742e681ac3f6a87e2bd4436c9112eb32

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018676001\systemsound.exe

Filesize
1.2MB

MD5
b5c16c628277965fd1fb8fead07b149d

SHA1
cf25269a9896c550ae73eb4c71c2080d0273553a

SHA256
fbaf4ce60142ad358be5fcbf6545462d24053982161606e5212203ecfc733d27

SHA512
35a92b04c2e7879d0c7605f173a86b7cf83689f8fa2cf9ccda6cb236ec10f845c9626f6028858e23cc7240fabb860538da25b40eb415151eae13a1b116ad278b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018821001\d6e9d0e123.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018822001\a530d299f2.exe

Filesize
4.2MB

MD5
ece3b1a61f2977c90820f0601637020e

SHA1
36ec33851c696b440730b3d9c8b59e2ab2e1b0b6

SHA256
239eb2c35896d73e83b650bf4c5637188e9bb1a5a85c74a2202cd50c2382d6e6

SHA512
e8fbbe975f739a40a97055bdda605bdf72210d6bfaaf7e0f1a78083238dfd816317de56a21590f5e05c1dd1e170b45e2610415c0b7ca3c27c12d037173161df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018823001\38deaf1368.exe

Filesize
1.3MB

MD5
669ed3665495a4a52029ff680ec8eba9

SHA1
7785e285365a141e307931ca4c4ef00b7ecc8986

SHA256
2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

SHA512
bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018824001\d4c1f13bd8.exe

Filesize
21KB

MD5
04f57c6fb2b2cd8dcc4b38e4a93d4366

SHA1
61770495aa18d480f70b654d1f57998e5bd8c885

SHA256
51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

SHA512
53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018825001\799c578aed.exe

Filesize
4.2MB

MD5
ee69644c05220b20497029110c3a4d6c

SHA1
0459d2706d2b61ce1510b30be64934a2d5a1f4b1

SHA256
d93b5614d8a0e4b0e6e0b80906ffbef339ecee97b08833b690dad9470d4bd2a9

SHA512
b0441b806ce9269957211a4f0725dfb57bc171484975da423d4cb1b72813b32cb51f1a101673b798ccad7949f1e3304ab9f918f8030750f6338ee5b0183e7c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018826001\4e384af530.exe

Filesize
1.9MB

MD5
81c164e0c2d7d36e812fe860548569a1

SHA1
97825c34e950ed01f6111b524c114f209a1b9819

SHA256
f88321d520c20b67f4fba3b0dcc89003e30d1aabf2e728e5c50773badd64632e

SHA512
e13101abd29bc203bfc553056741cc9fadc239350230f92397c74697dd069cc5f6540e1979063b35c18aaab913682104dbe24b17430d359adaaa583e6ef6c548

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018827001\2be412dd05.exe

Filesize
1.8MB

MD5
184cee9b3f334e2cee2ccc95977e5335

SHA1
3c13283ed8c4e0e09ae0e5f361da46f073cd2386

SHA256
188e74bab6540e25c1cc694264d96ed609f113267f747be27e09a2420ef90577

SHA512
adbe8c840684e0d56f2ab56677548a4dd47a8c8f0810557cbdfd21c27829b7ecf4950bd8ff7008a3c2e6d6ecbac84a368542109d103d493c412751f56748ef6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018828001\7e6db00ac8.exe

Filesize
2.7MB

MD5
d7593c78ec8bf3f98603559b67cb3ccd

SHA1
4db5fb73dfc7d2067058437eb1e8b6d8da90f742

SHA256
5ffb2e33be22c35585ffe74f82986dcd542e9b89fdc9e0e9243c804f17c32521

SHA512
69b1b4c1d2691a3fa85d6e04557761b28d8c0f57c1db5f4500a7166717323b1920a429e4c700dca6b5c0badeb40023bb1dfbcbed20040c72b185e0aaba0c8f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018829001\acb29b9008.exe

Filesize
947KB

MD5
92755c6663e0aa7af1dd7aaa7abcfcbd

SHA1
53097d488facff9896f2adff5399f783314a8cc0

SHA256
8a7034c6750914f3a966287a9e97307cf3f83eaca584fec77d7ebf5b2665d4ad

SHA512
9a49a39acf2840acbce159401964c4542f81c237259901f57aa45d78fbb2b7f9a9abc046ca20107bf12ca0f8c2afaaa4275c00283df47d9fe8812450e23c6803

Download Submit
C:\Users\Admin\AppData\Local\Temp\72de3c5e-3c66-4832-8c5f-26792f83931b.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpF2C7.tmp

Filesize
1KB

MD5
a10f31fa140f2608ff150125f3687920

SHA1
ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b

SHA256
28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6

SHA512
cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmyoh4d0.5qe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
8d69adfe2e1db76b837405b076979809

SHA1
b0c34909c5c70dc82384356a7a7d62877c6c82c8

SHA256
e8b6019ff977c06318a16605f86966341131d037a9e5fa4a46e2ac8780e992c6

SHA512
78a09192f872e355176b1fc642b9ad4c9d056f4c2465d17bd965c849e9e3e0669d825dbdeffe6060fc21dccef7dc76207ea585beb2653073feb9f20a7c8221bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

Filesize
2.2MB

MD5
579a63bebccbacab8f14132f9fc31b89

SHA1
fca8a51077d352741a9c1ff8a493064ef5052f27

SHA256
0ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0

SHA512
4a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

Filesize
1.7MB

MD5
5659eba6a774f9d5322f249ad989114a

SHA1
4bfb12aa98a1dc2206baa0ac611877b815810e4c

SHA256
e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4

SHA512
f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

Filesize
1.7MB

MD5
5404286ec7853897b3ba00adf824d6c1

SHA1
39e543e08b34311b82f6e909e1e67e2f4afec551

SHA256
ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266

SHA512
c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

Filesize
1.7MB

MD5
5eb39ba3698c99891a6b6eb036cfb653

SHA1
d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

SHA256
e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

SHA512
6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

Filesize
1.7MB

MD5
7187cc2643affab4ca29d92251c96dee

SHA1
ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

SHA256
c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

SHA512
27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

Filesize
1.7MB

MD5
b7d1e04629bec112923446fda5391731

SHA1
814055286f963ddaa5bf3019821cb8a565b56cb8

SHA256
4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

SHA512
79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

Filesize
1.7MB

MD5
0dc4014facf82aa027904c1be1d403c1

SHA1
5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

SHA256
a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

SHA512
cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip

Filesize
3.3MB

MD5
cea368fc334a9aec1ecff4b15612e5b0

SHA1
493d23f72731bb570d904014ffdacbba2334ce26

SHA256
07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

SHA512
bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\in.exe

Filesize
1.7MB

MD5
83d75087c9bf6e4f07c36e550731ccde

SHA1
d5ff596961cce5f03f842cfd8f27dde6f124e3ae

SHA256
46db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f

SHA512
044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
3.3MB

MD5
045b0a3d5be6f10ddf19ae6d92dfdd70

SHA1
0387715b6681d7097d372cd0005b664f76c933c7

SHA256
94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

SHA512
58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2380_1423018069\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2380_1423018069\a6b0c088-06b6-486f-a2b2-037589da0d47.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\AppData\Roaming\10001320110\terms.dll

Filesize
27KB

MD5
4dff588e6b10db3454aed96bde5764cd

SHA1
4bb138f3be2afa756ad64aaabf7183936db20304

SHA256
c34dba935e9e13317d2aba4b46c4c602d11658730e6c26c209ff11f2e1dff405

SHA512
2a980b5710a4d3e33b12a5507945358428254abe16ec1ef84a43d9fbb4c3764fe8e356ec9d92d5c8f4b8b3137d8a003e10156f57b328cb47d0d6c7791b33b410

Download Submit
C:\Users\Admin\AppData\Roaming\10001320110\terms.dll

Filesize
13KB

MD5
44163d81bb5710839fb9ba265de2c942

SHA1
a7497d6085ed8ce25e9728a0af7e989e026eaf04

SHA256
de4e3ff7f7da5d5561e384585a9d0cb66f2c51ea324c184848d125d8792bf666

SHA512
97ef4974f41affd04eb960fa873cd9754f31007c3d7239a7fb5b17cc152c01f2050c3b25d107e36ab5c65010610624e773f726de7d39255bb2c0ad5d8b9929a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
6KB

MD5
ee8d04fe43630c79aa2353b003650c8e

SHA1
e59bd80e6271a69d9e7a250f8ab8b6b1ef277b54

SHA256
85756ec19c0b8917490e1de8381fec6bd70da033c0370d83ee20ae8dfad2e721

SHA512
ccc65431682ab21326fb55a7c67e98b5f4271afbf0801135e62c68043b893c50333cb5a2ae61227b2867fe0f35190b972c03b6bcceae529250c13004edd010b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
8KB

MD5
3060913b58839e6dc6bae16b925571f3

SHA1
4ab797c92f00117186b4c56d277ed988c93d684e

SHA256
fa8b3681ccaceee98cd67ad6c6b000693730d8bcb5f29ef3272b87df3fb3f6f4

SHA512
338eb988c5a2b104956ee61de33da83e9833d32c60c98cb4b0371d8d51d0a79d87c98bb751817f82e2421865b2bf162963dcf33c91b1e011c32c697c3513e2fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
12KB

MD5
76aba9b5d998c4293d0fee8686ed2a2d

SHA1
8c55dc8951ad48ee53c88883e6b52aca5b1ef3a8

SHA256
42e6e038f9f5d084e8182c8638b4ade5249ce3761201a7e45d8a63fc11f970f8

SHA512
c65e521ed01bd613c190bf750b616240474f362d5536d890fb0d7b5be3bcda6d8d1b150fc489797f1bfab67313d238623abf661cd6540470713fc097d7f4a5e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
dc2ceb93f9f4edc0a3e490588406c935

SHA1
d4dd30689d98265ca19c95216d9c8fb5af1ac3fd

SHA256
1bbb701191d2c76a1ce8217a7f9239febbb9ca7d0655e0be845584c9b15bc7f4

SHA512
ac9e404c3651ae5f61633c93462c46b022a24fd55065f8eb0c43924f8877f67f6abd4599fd3e9a4438df9b99571366a0d3e706289d6d1af9e0189979fdb24a84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\052e3ded-c707-4aec-ba31-fd17ea5feb32

Filesize
26KB

MD5
658a3a4eafa112596eff418c243da77c

SHA1
604930fa7ed4ada5fe7f945d4a443bac60d79fe8

SHA256
bc21316eecfbbfbed12b0dc5302fe5660422cabc8988f2f6dc1c1d07beb599da

SHA512
2e40a06d2ec3b62c4c7cea43bf2b091658145b85400f75bf2501104f6c7ac38722c92b911a262f1ddf547bfe06c464d2d2a9699c613b3193a7a26467f12c9d44

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\bbe0d666-562d-46aa-ab6a-5b35080a65a1

Filesize
671B

MD5
074d7b13ea7ee1a549454637d6680a5b

SHA1
0acd2e43f28a220e1c1fdd206ffa942d771492cb

SHA256
20ca26418802fa4ebb7b869964cd4c37f3a554a60146f39513aef1d28f6c4bcf

SHA512
5cc6528783b55f1fbccd5d938a54cc00550fafb271effae8be79cf28f3af3b4dc42c00daf4cbcb9f1ea6ac7431f5f5063a258f4b99a4f6622f854eb1f63117a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\c7268ac1-e7be-4133-98dc-2072c0d7e888

Filesize
982B

MD5
0d29c219fde9522acd818f405de7619b

SHA1
3d4046d960c88aac55f5f0b6c266336cf15f8624

SHA256
387c8217dfa4c10775a4145e85f4cbf19198909876db80911eb87c7ad8590275

SHA512
cc286f9eb068d7494caccf60c16681d8df7aa3a112b4ea5c8a28f0ca2db5bd4c8d74887709d066cf3f6aa1f748a00c8ecf8b6669f7eb6aab13abc61dcadbc1d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
10KB

MD5
5b441cb7824ba84fb898503680f50409

SHA1
7679677a79db6d71c334a52dbce01581f8a36d24

SHA256
f13e9f1b8f5c3e01d8e0632df2e261d066b4511089be1055a94eb63a4a35a871

SHA512
5a48fc6ee2f16af4e6365d82b387709d5eedda760f6ba3af0a50a71aaadc6023abe41cef609dfe9561b34f709144b164f97d4e488b3459b2eefa9a8055e8dffe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
11KB

MD5
2dd7b552a456d440f571c49e7f4cbc9d

SHA1
f4d6346b48c97f4a45452aa361908fac08de44df

SHA256
f9fc2dcef1037864706d3ae64a1a5b5661cacbb9a694435e76d670cfa91a5684

SHA512
2aba193381b8d70f476746c35974710197eaa20684ec8a959638fb56d49a573fb634d6622bb115d2c23c859a6853bd6e31ed580f86f7d6319fe020d9b4dad73e

Download Submit
C:\tykmbrtj\dd7b1db6e14e434c89ff5a943dfdb1d9.exe

Filesize
144KB

MD5
cc36e2a5a3c64941a79c31ca320e9797

SHA1
50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

SHA256
6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

SHA512
fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

Download Submit
C:\tykmbrtj\f340f0c7301049dfaf017911d69f2ccf.exe

Filesize
1.0MB

MD5
971b0519b1c0461db6700610e5e9ca8e

SHA1
9a262218310f976aaf837e54b4842e53e73be088

SHA256
47cf75570c1eca775b2dd1823233d7c40924d3a8d93e0e78c943219cf391d023

SHA512
d234a9c5a1da8415cd4d2626797197039f2537e98f8f43d155f815a7867876cbc1bf466be58677c79a9199ea47d146a174998d21ef0aebc29a4b0443f8857cb9

Download Submit
memory/856-5077-0x0000000006030000-0x0000000006384000-memory.dmp

Filesize
3.3MB

Download
memory/856-5079-0x0000000070670000-0x00000000706BC000-memory.dmp

Filesize
304KB

Download
memory/1152-5368-0x00000000001A0000-0x000000000063C000-memory.dmp

Filesize
4.6MB

Download
memory/1152-5237-0x00000000001A0000-0x000000000063C000-memory.dmp

Filesize
4.6MB

Download
memory/1716-1-0x00000000779D4000-0x00000000779D6000-memory.dmp

Filesize
8KB

Download
memory/1716-3-0x0000000000FD0000-0x00000000012F8000-memory.dmp

Filesize
3.2MB

Download
memory/1716-18-0x0000000000FD0000-0x00000000012F8000-memory.dmp

Filesize
3.2MB

Download
memory/1716-0-0x0000000000FD0000-0x00000000012F8000-memory.dmp

Filesize
3.2MB

Download
memory/1716-2-0x0000000000FD1000-0x0000000000FFF000-memory.dmp

Filesize
184KB

Download
memory/1716-4-0x0000000000FD0000-0x00000000012F8000-memory.dmp

Filesize
3.2MB

Download
memory/1788-7859-0x0000000000E20000-0x0000000001309000-memory.dmp

Filesize
4.9MB

Download
memory/1788-7990-0x0000000000E20000-0x0000000001309000-memory.dmp

Filesize
4.9MB

Download
memory/2536-3762-0x0000000000190000-0x0000000000E15000-memory.dmp

Filesize
12.5MB

Download
memory/2536-4999-0x0000000000190000-0x0000000000E15000-memory.dmp

Filesize
12.5MB

Download
memory/2536-5364-0x0000000000190000-0x0000000000E15000-memory.dmp

Filesize
12.5MB

Download
memory/2644-2557-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/2644-2543-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/3296-5018-0x0000000000C60000-0x0000000000C6C000-memory.dmp

Filesize
48KB

Download
memory/3464-8331-0x0000000000400000-0x0000000000C69000-memory.dmp

Filesize
8.4MB

Download
memory/3464-5183-0x0000000000400000-0x0000000000C69000-memory.dmp

Filesize
8.4MB

Download
memory/3464-5333-0x0000000000400000-0x0000000000C69000-memory.dmp

Filesize
8.4MB

Download
memory/3584-5112-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/3584-5185-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/3724-5716-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/3868-5163-0x00000244D6DD0000-0x00000244D6E08000-memory.dmp

Filesize
224KB

Download
memory/3868-5164-0x00000244D4B60000-0x00000244D4B6E000-memory.dmp

Filesize
56KB

Download
memory/3868-5168-0x00000244D7E80000-0x00000244D8006000-memory.dmp

Filesize
1.5MB

Download
memory/3868-5122-0x00000244B97F0000-0x00000244B98F2000-memory.dmp

Filesize
1.0MB

Download
memory/3868-5156-0x00000244D40C0000-0x00000244D40D2000-memory.dmp

Filesize
72KB

Download
memory/3868-5137-0x00000244BB560000-0x00000244BB56A000-memory.dmp

Filesize
40KB

Download
memory/3868-5184-0x00000244D8010000-0x00000244D8036000-memory.dmp

Filesize
152KB

Download
memory/3868-5140-0x00000244D41A0000-0x00000244D425A000-memory.dmp

Filesize
744KB

Download
memory/3868-5162-0x00000244D4B30000-0x00000244D4B38000-memory.dmp

Filesize
32KB

Download
memory/3868-5157-0x00000244D4120000-0x00000244D415C000-memory.dmp

Filesize
240KB

Download
memory/3920-46-0x0000000000CF0000-0x000000000118A000-memory.dmp

Filesize
4.6MB

Download
memory/3920-48-0x0000000000CF0000-0x000000000118A000-memory.dmp

Filesize
4.6MB

Download
memory/3920-47-0x0000000000CF0000-0x000000000118A000-memory.dmp

Filesize
4.6MB

Download
memory/3920-51-0x0000000000CF0000-0x000000000118A000-memory.dmp

Filesize
4.6MB

Download
memory/3920-44-0x0000000000CF0000-0x000000000118A000-memory.dmp

Filesize
4.6MB

Download
memory/3920-43-0x0000000000CF0000-0x000000000118A000-memory.dmp

Filesize
4.6MB

Download
memory/3920-42-0x0000000000CF1000-0x0000000000D16000-memory.dmp

Filesize
148KB

Download
memory/3920-40-0x0000000000CF0000-0x000000000118A000-memory.dmp

Filesize
4.6MB

Download
memory/4376-5141-0x00000000008A0000-0x00000000014ED000-memory.dmp

Filesize
12.3MB

Download
memory/4376-5138-0x00000000008A0000-0x00000000014ED000-memory.dmp

Filesize
12.3MB

Download
memory/4536-41-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4536-49-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4536-45-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4536-34-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4536-23-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4536-22-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4536-21-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4536-20-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4536-19-0x0000000000071000-0x000000000009F000-memory.dmp

Filesize
184KB

Download
memory/4536-16-0x0000000000070000-0x0000000000398000-memory.dmp

Filesize
3.2MB

Download
memory/4600-87-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-125-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-79-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-77-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-103-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-75-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-81-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-74-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-1250-0x0000000005940000-0x00000000059CA000-memory.dmp

Filesize
552KB

Download
memory/4600-1253-0x0000000005A40000-0x0000000005A94000-memory.dmp

Filesize
336KB

Download
memory/4600-1251-0x00000000058E0000-0x000000000592C000-memory.dmp

Filesize
304KB

Download
memory/4600-70-0x0000000000B50000-0x0000000000C84000-memory.dmp

Filesize
1.2MB

Download
memory/4600-71-0x0000000005660000-0x0000000005778000-memory.dmp

Filesize
1.1MB

Download
memory/4600-85-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-72-0x0000000005D30000-0x00000000062D4000-memory.dmp

Filesize
5.6MB

Download
memory/4600-73-0x0000000005840000-0x00000000058D2000-memory.dmp

Filesize
584KB

Download
memory/4600-83-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-89-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-91-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-93-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-95-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-97-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-99-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-101-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-106-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-107-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-121-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-109-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-111-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-113-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-117-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-119-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-123-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-115-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-127-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-129-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4600-131-0x0000000005660000-0x0000000005773000-memory.dmp

Filesize
1.1MB

Download
memory/4960-2546-0x0000011CF88B0000-0x0000011CF88D2000-memory.dmp

Filesize
136KB

Download
memory/4964-2539-0x00007FF626E90000-0x00007FF627320000-memory.dmp

Filesize
4.6MB

Download
memory/4964-2544-0x00007FF626E90000-0x00007FF627320000-memory.dmp

Filesize
4.6MB

Download
memory/5452-3802-0x0000000000EE0000-0x0000000000FE2000-memory.dmp

Filesize
1.0MB

Download
memory/5452-3803-0x0000000005870000-0x0000000005956000-memory.dmp

Filesize
920KB

Download
memory/5452-4997-0x0000000005B30000-0x0000000005B88000-memory.dmp

Filesize
352KB

Download
memory/5676-5037-0x00000000065A0000-0x00000000065EC000-memory.dmp

Filesize
304KB

Download
memory/5676-5034-0x0000000005F30000-0x0000000006284000-memory.dmp

Filesize
3.3MB

Download
memory/5676-5061-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

Filesize
56KB

Download
memory/5676-5062-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

Filesize
80KB

Download
memory/5676-5055-0x0000000007760000-0x0000000007803000-memory.dmp

Filesize
652KB

Download
memory/5676-5044-0x0000000070670000-0x00000000706BC000-memory.dmp

Filesize
304KB

Download
memory/5676-5054-0x0000000007730000-0x000000000774E000-memory.dmp

Filesize
120KB

Download
memory/5676-5043-0x0000000006B40000-0x0000000006B72000-memory.dmp

Filesize
200KB

Download
memory/5676-5057-0x0000000007890000-0x00000000078AA000-memory.dmp

Filesize
104KB

Download
memory/5676-5036-0x0000000006560000-0x000000000657E000-memory.dmp

Filesize
120KB

Download
memory/5676-5063-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

Filesize
104KB

Download
memory/5676-5060-0x0000000007A90000-0x0000000007AA1000-memory.dmp

Filesize
68KB

Download
memory/5676-5024-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/5676-5023-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/5676-5022-0x0000000005CF0000-0x0000000005D12000-memory.dmp

Filesize
136KB

Download
memory/5676-5020-0x0000000005650000-0x0000000005C78000-memory.dmp

Filesize
6.2MB

Download
memory/5676-5019-0x0000000004FE0000-0x0000000005016000-memory.dmp

Filesize
216KB

Download
memory/5676-5064-0x0000000007BB0000-0x0000000007BB8000-memory.dmp

Filesize
32KB

Download
memory/5676-5059-0x0000000007B10000-0x0000000007BA6000-memory.dmp

Filesize
600KB

Download
memory/5676-5058-0x0000000007900000-0x000000000790A000-memory.dmp

Filesize
40KB

Download
memory/5676-5056-0x0000000007ED0000-0x000000000854A000-memory.dmp

Filesize
6.5MB

Download
memory/5684-7806-0x00007FF6E04F0000-0x00007FF6E0980000-memory.dmp

Filesize
4.6MB

Download
memory/5684-7821-0x00007FF6E04F0000-0x00007FF6E0980000-memory.dmp

Filesize
4.6MB

Download