Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 00:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    2.9MB

  • MD5

    5c8cb972f2920bd6edc98690f1634958

  • SHA1

    73d87008bda6fd11921bfad989b48c09ce82b20f

  • SHA256

    246affa1629352f335434a02500b288a55592990b1b669a6a5cb112c20f04f8f

  • SHA512

    cc9c4e3d03b493778a2475b02e6d0fa14b27688ca09fdbef1ba2e7ace2bb6c591c5e93d0b4596ce1eb1c85252461089193a14390725f01fd4a2a4f1598e21d4d

  • SSDEEP

    49152:D5TQ0VpSQkbo7FoWKxx/X0+fI1HARitBDodeFIbi:NfVpSTl/xxPxfI1gRitao

Score
10/10
amadeylumma9c9aa5credential_accessdiscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 47 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Users\Admin\AppData\Local\Temp\1018969001\4d6c2b4436.exe
        "C:\Users\Admin\AppData\Local\Temp\1018969001\4d6c2b4436.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1800
      • C:\Users\Admin\AppData\Local\Temp\1018970001\e009ed13ff.exe
        "C:\Users\Admin\AppData\Local\Temp\1018970001\e009ed13ff.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1164
        • C:\Users\Admin\AppData\Local\Temp\1018970001\e009ed13ff.exe
          "C:\Users\Admin\AppData\Local\Temp\1018970001\e009ed13ff.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:2384
      • C:\Users\Admin\AppData\Local\Temp\1018971001\ba5f309d91.exe
        "C:\Users\Admin\AppData\Local\Temp\1018971001\ba5f309d91.exe"
        3⤵
        • Enumerates VirtualBox registry keys
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1672
      • C:\Users\Admin\AppData\Local\Temp\1018972001\7371936518.exe
        "C:\Users\Admin\AppData\Local\Temp\1018972001\7371936518.exe"
        3⤵
        • Executes dropped EXE
        PID:1004
      • C:\Users\Admin\AppData\Local\Temp\1018973001\1f9ee06a50.exe
        "C:\Users\Admin\AppData\Local\Temp\1018973001\1f9ee06a50.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3020
        • C:\Users\Admin\AppData\Local\Temp\1018973001\1f9ee06a50.exe
          "C:\Users\Admin\AppData\Local\Temp\1018973001\1f9ee06a50.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2032
      • C:\Users\Admin\AppData\Local\Temp\1018974001\899eba7e20.exe
        "C:\Users\Admin\AppData\Local\Temp\1018974001\899eba7e20.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath "C:\ugiokhl"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2728
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2576
      • C:\Users\Admin\AppData\Local\Temp\1018975001\125c7b824c.exe
        "C:\Users\Admin\AppData\Local\Temp\1018975001\125c7b824c.exe"
        3⤵
        • Enumerates VirtualBox registry keys
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1960
      • C:\Users\Admin\AppData\Local\Temp\1018976001\68c999725c.exe
        "C:\Users\Admin\AppData\Local\Temp\1018976001\68c999725c.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1032
      • C:\Users\Admin\AppData\Local\Temp\1018977001\73d3e8c809.exe
        "C:\Users\Admin\AppData\Local\Temp\1018977001\73d3e8c809.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:844
      • C:\Users\Admin\AppData\Local\Temp\1018978001\308ae8c64c.exe
        "C:\Users\Admin\AppData\Local\Temp\1018978001\308ae8c64c.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:10588
      • C:\Users\Admin\AppData\Local\Temp\1018979001\8149d3447a.exe
        "C:\Users\Admin\AppData\Local\Temp\1018979001\8149d3447a.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:10900
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:10936
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:10996
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:11040
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:11084
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:11128
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
            PID:11180
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:11188
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11188.0.588086132\1072126812" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbda29b7-7e07-4cec-97db-fcc18f6b121d} 11188 "\\.\pipe\gecko-crash-server-pipe.11188" 1320 14107758 gpu
                6⤵
                  PID:652
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11188.1.1220724365\1420338322" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e39ea877-2e0b-47cc-82e0-1110ee057f5b} 11188 "\\.\pipe\gecko-crash-server-pipe.11188" 1528 f3f1358 socket
                  6⤵
                    PID:1984
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11188.2.1916390487\1408937944" -childID 1 -isForBrowser -prefsHandle 2176 -prefMapHandle 2172 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 672 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1228a03c-6ed1-49f5-8f2e-bebb7c86bf9f} 11188 "\\.\pipe\gecko-crash-server-pipe.11188" 2188 1a096858 tab
                    6⤵
                      PID:1588
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11188.3.860765085\1407442140" -childID 2 -isForBrowser -prefsHandle 2836 -prefMapHandle 2832 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 672 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a57cd7a8-2171-4c33-9447-7b31b3ae8609} 11188 "\\.\pipe\gecko-crash-server-pipe.11188" 2848 d5d258 tab
                      6⤵
                        PID:3328
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11188.4.641539998\1559995161" -childID 3 -isForBrowser -prefsHandle 2832 -prefMapHandle 3820 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 672 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98c6564f-a62b-4650-8b65-856098cadf84} 11188 "\\.\pipe\gecko-crash-server-pipe.11188" 3852 210c1058 tab
                        6⤵
                          PID:6088
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11188.5.2040618809\1187404120" -childID 4 -isForBrowser -prefsHandle 3956 -prefMapHandle 3960 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 672 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {655b42ca-bccc-4d69-9ac3-27b95f66a24d} 11188 "\\.\pipe\gecko-crash-server-pipe.11188" 3944 210c2e58 tab
                          6⤵
                            PID:6104
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11188.6.592018884\785370397" -childID 5 -isForBrowser -prefsHandle 4128 -prefMapHandle 3920 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 672 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e6ca72e-a9ca-4233-b9f0-8e8aab82da63} 11188 "\\.\pipe\gecko-crash-server-pipe.11188" 4116 20ec7558 tab
                            6⤵
                              PID:6120
                      • C:\Users\Admin\AppData\Local\Temp\1018980001\2942d9c36c.exe
                        "C:\Users\Admin\AppData\Local\Temp\1018980001\2942d9c36c.exe"
                        3⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3528
                      • C:\Users\Admin\AppData\Local\Temp\1018981001\0e71f4d4b8.exe
                        "C:\Users\Admin\AppData\Local\Temp\1018981001\0e71f4d4b8.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:7116
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                          4⤵
                          • Loads dropped DLL
                          PID:7428
                          • C:\Windows\system32\mode.com
                            mode 65,10
                            5⤵
                              PID:7484
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7512
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_7.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7596
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_6.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7700
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_5.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7784
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_4.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7852
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_3.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7904
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_2.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7948
                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                              7z.exe e extracted/file_1.zip -oextracted
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7996
                            • C:\Windows\system32\attrib.exe
                              attrib +H "in.exe"
                              5⤵
                              • Views/modifies file attributes
                              PID:8056
                            • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                              "in.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:8076
                              • C:\Windows\system32\attrib.exe
                                attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                6⤵
                                • Views/modifies file attributes
                                PID:8100
                              • C:\Windows\system32\attrib.exe
                                attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                6⤵
                                • Views/modifies file attributes
                                PID:8116
                              • C:\Windows\system32\schtasks.exe
                                schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                6⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:8148
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell ping 127.0.0.1; del in.exe
                                6⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:8184
                                • C:\Windows\system32\PING.EXE
                                  "C:\Windows\system32\PING.EXE" 127.0.0.1
                                  7⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:8492
                        • C:\Users\Admin\AppData\Local\Temp\1018982001\9e472453cf.exe
                          "C:\Users\Admin\AppData\Local\Temp\1018982001\9e472453cf.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:8560
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd
                            4⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:8792
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              5⤵
                              • Enumerates processes with tasklist
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:8848
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr /I "opssvc wrsa"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:8868
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              5⤵
                              • Enumerates processes with tasklist
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:8936
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:8952
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c md 245347
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:9012
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr /V "profiles" Organizing
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:9036
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:9088
                            • C:\Users\Admin\AppData\Local\Temp\245347\Dry.com
                              Dry.com b
                              5⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:9112
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\245347\Dry.com" & rd /s /q "C:\ProgramData\EKNYUS2NOP8Y" & exit
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:3016
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout /t 10
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Delays execution with timeout.exe
                                  PID:2428
                            • C:\Windows\SysWOW64\choice.exe
                              choice /d y /t 5
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:9148
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {8F25EEFF-5383-448C-9C77-D7665B4C445B} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
                      1⤵
                      • Loads dropped DLL
                      PID:4220
                      • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4288
                        • C:\Windows\explorer.exe
                          explorer.exe
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4304
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                          3⤵
                          • Drops file in System32 directory
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4380
                          • C:\Windows\system32\PING.EXE
                            "C:\Windows\system32\PING.EXE" 127.1.10.1
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:4532

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Hide Artifacts

                    1
                    T1564

                    Hidden Files and Directories

                    1
                    T1564.001

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify Tools

                    2
                    T1562.001

                    Modify Registry

                    4
                    T1112

                    Subvert Trust Controls

                    1
                    T1553

                    Install Root Certificate

                    1
                    T1553.004

                    Virtualization/Sandbox Evasion

                    3
                    T1497

                    Credential Access

                    Unsecured Credentials

                    2
                    T1552

                    Credentials In Files

                    2
                    T1552.001

                    Discovery

                    Process Discovery

                    1
                    T1057

                    Query Registry

                    7
                    T1012

                    Remote System Discovery

                    1
                    T1018

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Virtualization/Sandbox Evasion

                    3
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOGPI1N2\download[1].htm
                      Filesize

                      1B

                      MD5

                      cfcd208495d565ef66e7dff9f98764da

                      SHA1

                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                      SHA256

                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                      SHA512

                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
                      Filesize

                      25KB

                      MD5

                      59a9024388e1372f8f248f9d3f17a3f6

                      SHA1

                      d344b948503d56731bf598b60f8d42463da5a591

                      SHA256

                      18acd88c459c0008957458b5eafb7a4cdec69897ac3ee3ea1b5569b5fe805e68

                      SHA512

                      9a3c783fb6833c32523554ca881dc23d880383536fc4cb3593752061806450c22df471bb5eb0da531c1f0960772de90c0a66fd02fb06fa6d47d627fa4b22c528

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018969001\4d6c2b4436.exe
                      Filesize

                      1.8MB

                      MD5

                      27c1f96d7e1b72b6817b6efeff037f90

                      SHA1

                      2972cc112fc7e20cbf5952abe07407b8c1fbb2a2

                      SHA256

                      aec3ec473de321d123e939985579227ee62b53b3b3edb7ab96e2a66c17e9696d

                      SHA512

                      9a31dc9945889d35aea8710df2f42806c72c422b7b5f4aa8acba6986cbd9ea6a49181a41a50ee21ccbed86cbff87c98a742e681ac3f6a87e2bd4436c9112eb32

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018970001\e009ed13ff.exe
                      Filesize

                      758KB

                      MD5

                      afd936e441bf5cbdb858e96833cc6ed3

                      SHA1

                      3491edd8c7caf9ae169e21fb58bccd29d95aefef

                      SHA256

                      c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                      SHA512

                      928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018971001\ba5f309d91.exe
                      Filesize

                      4.2MB

                      MD5

                      202e966732fe7168248ceb69d8d41b48

                      SHA1

                      c8a79dfd26f55136ef9e15518b74cbccbdc8b78e

                      SHA256

                      d911a311afa36598e6bfcfca5597bad9a3ce1dae2c372a9fe53771ffdca2e95c

                      SHA512

                      025de5673ea2b770a8dfcd61c0434714f32a8617722cf19f96d042a1890ceefac4f78154702b55c754233a8c16f20299e844e59cb4bf73319a10465ee181e3d3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018972001\7371936518.exe
                      Filesize

                      1.3MB

                      MD5

                      669ed3665495a4a52029ff680ec8eba9

                      SHA1

                      7785e285365a141e307931ca4c4ef00b7ecc8986

                      SHA256

                      2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

                      SHA512

                      bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018973001\1f9ee06a50.exe
                      Filesize

                      1.1MB

                      MD5

                      ef08a45833a7d881c90ded1952f96cb4

                      SHA1

                      f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                      SHA256

                      33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                      SHA512

                      74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018974001\899eba7e20.exe
                      Filesize

                      21KB

                      MD5

                      04f57c6fb2b2cd8dcc4b38e4a93d4366

                      SHA1

                      61770495aa18d480f70b654d1f57998e5bd8c885

                      SHA256

                      51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

                      SHA512

                      53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018975001\125c7b824c.exe
                      Filesize

                      4.2MB

                      MD5

                      d228347f8369873db1b362b04fee4616

                      SHA1

                      873979151c8cf376b01de0fd2bd3184d7d5a3d72

                      SHA256

                      ec926af920d655b0bc2e829cb659cb2b766eecabf1cd91b4b726fde612373854

                      SHA512

                      15d8bf9c12a199de0488b98d25459e8f9c73f8de1d19574387b1f77c4917c3a7173eb55004222bde6fe14e8113df13db6b1dd6be76977990476a74d3fd65a4b8

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018976001\68c999725c.exe
                      Filesize

                      1.9MB

                      MD5

                      6ed0e9bba4efff4dbf02479ff858d1bf

                      SHA1

                      863eba935e16612a8345a3e5dbee6674c466de7b

                      SHA256

                      2c20ceb3727c819a6225dfb1e1b172bd64cb7c82d872dd239eff410170965f31

                      SHA512

                      5c457272b5241dc1ef02bad1fdd6c0c937ef37d3fe39ce86baccba602a335df37364ffc2107b7877a52ab6977de4cb252892f05d4b19730d0df3249ab47b2781

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018977001\73d3e8c809.exe
                      Filesize

                      1.8MB

                      MD5

                      fb844316e47ea9385fa4f6c91884764d

                      SHA1

                      48a227b7b5e785c6b9bcfabafa302567abc3ec82

                      SHA256

                      f60ceb03785b3f48fc9660456d5c3b6f14e0f462787e1c4c7bc2cf45cc8f7386

                      SHA512

                      1e8af35b7f09ea40dc03f3196648436d622e2910b0429cb91026f30d12894c5dbaba5a30845acaaeca20c1942e05821e240bc46c6918cb83f4ae4c5f70daf344

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018978001\308ae8c64c.exe
                      Filesize

                      2.7MB

                      MD5

                      eeb8c5b88b7952fa1293e3b5a69e201a

                      SHA1

                      f28b5cfc126ee0bc2a51934e7417b19949313ac5

                      SHA256

                      bf6016b0809cc844d4d01fbc162ff3ca9f33ec038e424154224e58dd2927bf26

                      SHA512

                      5199ee754d6dd8d561c888ed0eeb61598acfa7915bf54b4fcf0070caa2025d5bc70fc173518cfc8f432da38e4410cf49b1205ffdf0ad42271e7428deb0c2e1b5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018979001\8149d3447a.exe
                      Filesize

                      948KB

                      MD5

                      c957cde08a4008c1744dd056ff1d056f

                      SHA1

                      e467e5d29a5df43c6df3bf67d672ad41dd582e7d

                      SHA256

                      dc55f5fc8402f8705e20e2afd1c1c8ecbc0fe752d5f05e16c3ea823f2c95c791

                      SHA512

                      45de56321733461cca310f1d29572d2dc0354209e77f941fdfcdffd0d968298050f9aa1052cad63a5ce2465e950d0faa2faa721930796ce9e4ffba77a2366a91

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018980001\2942d9c36c.exe
                      Filesize

                      2.6MB

                      MD5

                      312d975fc87ef275ed3d7bbc77b225a0

                      SHA1

                      a4e221b6492ef225fa73c18dd175b82b812f6039

                      SHA256

                      dd170078dad42d0def58d4d7a6a5ede2de402350187923a0462aa3a957519710

                      SHA512

                      430ad2a7b1667a6e14c6be732a9f7cbe7c6dbbb46527dea69c9f4f961cd9603240d0c6062e48a8ef84336d63d112468d28670dbbe3187b1d3028015bb0c886fb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018981001\0e71f4d4b8.exe
                      Filesize

                      4.2MB

                      MD5

                      3a425626cbd40345f5b8dddd6b2b9efa

                      SHA1

                      7b50e108e293e54c15dce816552356f424eea97a

                      SHA256

                      ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                      SHA512

                      a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1018982001\9e472453cf.exe
                      Filesize

                      842KB

                      MD5

                      8eb4f92605e35c57a42b0917c221d65c

                      SHA1

                      0e64d77ef1b917b3afe512b49710250c71369175

                      SHA256

                      b57d78d93f74f7ae840ab03d3fda4f22a24ad35afcf9a53128cf82a92a67a085

                      SHA512

                      4cc5db426c8de3d7afdcfa26440d5bd9a885f5148e4307b8d04c5d56c96672d5c82ed9989bf346ce7aecea07d980735c46a930b885f824ba53738ac76dbb05bf

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Cab2A9B.tmp
                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Tar2AFC.tmp
                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                      Filesize

                      1.6MB

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      Filesize

                      458KB

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                      Filesize

                      1.7MB

                      MD5

                      0dc4014facf82aa027904c1be1d403c1

                      SHA1

                      5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                      SHA256

                      a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                      SHA512

                      cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                      Filesize

                      3.3MB

                      MD5

                      cea368fc334a9aec1ecff4b15612e5b0

                      SHA1

                      493d23f72731bb570d904014ffdacbba2334ce26

                      SHA256

                      07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                      SHA512

                      bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                      Filesize

                      3.3MB

                      MD5

                      045b0a3d5be6f10ddf19ae6d92dfdd70

                      SHA1

                      0387715b6681d7097d372cd0005b664f76c933c7

                      SHA256

                      94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                      SHA512

                      58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                      Filesize

                      440B

                      MD5

                      3626532127e3066df98e34c3d56a1869

                      SHA1

                      5fa7102f02615afde4efd4ed091744e842c63f78

                      SHA256

                      2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                      SHA512

                      dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                      Filesize

                      7KB

                      MD5

                      e8492b96a54dab0cc9bda83f8995bae9

                      SHA1

                      c04028f42e4b89c9bdf808f403d773f68f91673c

                      SHA256

                      43ab0fd0782e5a4a1e878e2276fd4ed5c97631cc89a35b0583c845ccafce855a

                      SHA512

                      05b8ff0a438585d3d72cd5569f37b41a79ce8ca17a2cec939ffdbe8263b9f90d3a798d671fece2f03428f2e12b768c17dbad4b1dbca9b4d318e0fa8c73917310

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin
                      Filesize

                      9KB

                      MD5

                      8867baea9b83f1131c060106310e5765

                      SHA1

                      53d68e1aa315bf4bd9caa2265d3b053b94d3282f

                      SHA256

                      1e93d426dd96ca00f4ffb4ea8b998799e745cceedcf3939c3d88bde12bfb400b

                      SHA512

                      776f0679b9b8c4492771016f54cac57b45856e58a3f02bb8e6b27436ba84a4207187384b5db8d7c7691f354ffd42c6575773e4ab1c2096053832c10b34055f3e

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\3ec872db-875c-42b7-aabf-311098eca604
                      Filesize

                      733B

                      MD5

                      31cbcd950407c555f9634942a50df9dd

                      SHA1

                      750a026e450c21898f9527caa9660f1a54c422ce

                      SHA256

                      d41a6bdebc32c8962f996f4123c59051deecee020e1de3f415d3713f068d9e23

                      SHA512

                      ba5b6cb25e12ea1d101480325facdbf00bec4c89d887df736d62e71225770bcba59b0aca27334c2fa4ddbdc34dabed7ebb40d27aa4a5d0be42a272f869a64870

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
                      Filesize

                      6KB

                      MD5

                      fa4b97cfe906740f49ccd17b118249ae

                      SHA1

                      8289ba0483eeed67b11672b7b931648bd2b55a15

                      SHA256

                      422d4fd595718cf5d7abedd4b68af488d558d93994dc8a6363c87f339dedf110

                      SHA512

                      868a45e9619eb5256eede1ea2d67a39b052538dcca5e6f158e0d38ec4a356b73c7d4a8309eef102610d77564ebc0ff214671697abdc24177e95d123714c0e854

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
                      Filesize

                      6KB

                      MD5

                      e4709f71ed0b8f01fe14ec4a6f0e413a

                      SHA1

                      4f70dd71391ef904a27073652a6a58aa1c35c063

                      SHA256

                      b1e4a805792202bfc8a2b82a904f9186d3ba21b0a494966970e3c404fd1a82bf

                      SHA512

                      056c4182ad1fa0d00248e3e344bedf119b4c2070eb9eeae199314439ad40ef73d2daf09bf2d3d26dca99ff2183cde0eb1c7da96e54e10dce41c272ba4d80b3a5

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js
                      Filesize

                      7KB

                      MD5

                      d2971f20b06ef44bb81075a8f599c5b9

                      SHA1

                      535dc88c1d9dc4a810bda3c8f2f0d2c59a0ad17d

                      SHA256

                      d315961c8407a242e65901e92dd81cbd4376f4050c96dda00277a2ef49796e74

                      SHA512

                      971f43bdb4bc691053e58513d5189ff1b7ce9be3d45bcd7354e302a30c7a90911fb0cbb38d458207bcec595aaf8962124a6b7ef17e15795100cdd603a4d37ccc

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
                      Filesize

                      4KB

                      MD5

                      a8fde4d68431c1a182cfd4e8c41d6b68

                      SHA1

                      6db995c93fa71577312a1e263fb2bbea49850ef5

                      SHA256

                      0ae8dbf26c91a2f47c69cdf89e083535fb7a80719fef1575939b37b3dc181cc6

                      SHA512

                      0a5aeccc617b313c83a2dc70696bdac9d8561ef9721ff2abfacb404f96f1a21f2cd319a73186bfa3a61f87258a8f60b76b7d144ea546ccbf7dcdce372b6eccc2

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      Filesize

                      2.9MB

                      MD5

                      5c8cb972f2920bd6edc98690f1634958

                      SHA1

                      73d87008bda6fd11921bfad989b48c09ce82b20f

                      SHA256

                      246affa1629352f335434a02500b288a55592990b1b669a6a5cb112c20f04f8f

                      SHA512

                      cc9c4e3d03b493778a2475b02e6d0fa14b27688ca09fdbef1ba2e7ace2bb6c591c5e93d0b4596ce1eb1c85252461089193a14390725f01fd4a2a4f1598e21d4d

                      Download Submit

                    • memory/548-14-0x0000000006800000-0x0000000006B18000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/548-17-0x0000000000B20000-0x0000000000E38000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/548-5-0x0000000000B20000-0x0000000000E38000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/548-0-0x0000000000B20000-0x0000000000E38000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/548-4-0x0000000000B20000-0x0000000000E38000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/548-3-0x0000000000B20000-0x0000000000E38000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/548-2-0x0000000000B21000-0x0000000000B4F000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/548-1-0x00000000779B0000-0x00000000779B2000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/1004-171-0x0000000000290000-0x00000000003E7000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/1032-252-0x0000000010000000-0x000000001001C000-memory.dmp

                      Filesize

                      112KB

                      Download

                    • memory/1672-188-0x0000000000A50000-0x00000000016E0000-memory.dmp

                      Filesize

                      12.6MB

                      Download

                    • memory/1672-101-0x0000000000A50000-0x00000000016E0000-memory.dmp

                      Filesize

                      12.6MB

                      Download

                    • memory/1672-214-0x0000000000A50000-0x00000000016E0000-memory.dmp

                      Filesize

                      12.6MB

                      Download

                    • memory/1672-189-0x0000000000A50000-0x00000000016E0000-memory.dmp

                      Filesize

                      12.6MB

                      Download

                    • memory/1800-45-0x00000000010D0000-0x000000000156A000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/1800-100-0x00000000010D0000-0x000000000156A000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/1800-126-0x00000000010D0000-0x000000000156A000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/1800-137-0x00000000010D0000-0x000000000156A000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/1960-257-0x0000000000F30000-0x0000000001B9F000-memory.dmp

                      Filesize

                      12.4MB

                      Download

                    • memory/1960-212-0x0000000000F30000-0x0000000001B9F000-memory.dmp

                      Filesize

                      12.4MB

                      Download

                    • memory/1960-2362-0x0000000000F30000-0x0000000001B9F000-memory.dmp

                      Filesize

                      12.4MB

                      Download

                    • memory/1960-258-0x0000000000F30000-0x0000000001B9F000-memory.dmp

                      Filesize

                      12.4MB

                      Download

                    • memory/2032-2341-0x0000000000D70000-0x0000000000DBC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2032-290-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-2340-0x0000000000590000-0x00000000005BC000-memory.dmp

                      Filesize

                      176KB

                      Download

                    • memory/2032-298-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-273-0x0000000000400000-0x0000000000464000-memory.dmp

                      Filesize

                      400KB

                      Download

                    • memory/2032-271-0x0000000000400000-0x0000000000464000-memory.dmp

                      Filesize

                      400KB

                      Download

                    • memory/2032-268-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/2032-266-0x0000000000400000-0x0000000000464000-memory.dmp

                      Filesize

                      400KB

                      Download

                    • memory/2032-264-0x0000000000400000-0x0000000000464000-memory.dmp

                      Filesize

                      400KB

                      Download

                    • memory/2032-274-0x00000000006B0000-0x0000000000748000-memory.dmp

                      Filesize

                      608KB

                      Download

                    • memory/2032-262-0x0000000000400000-0x0000000000464000-memory.dmp

                      Filesize

                      400KB

                      Download

                    • memory/2032-260-0x0000000000400000-0x0000000000464000-memory.dmp

                      Filesize

                      400KB

                      Download

                    • memory/2032-275-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-278-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-282-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-286-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-288-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-269-0x0000000000400000-0x0000000000464000-memory.dmp

                      Filesize

                      400KB

                      Download

                    • memory/2032-294-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-296-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-292-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-284-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-280-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2032-276-0x00000000006B0000-0x0000000000741000-memory.dmp

                      Filesize

                      580KB

                      Download

                    • memory/2384-79-0x0000000000400000-0x0000000000456000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2384-77-0x0000000000400000-0x0000000000456000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2384-76-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/2384-66-0x0000000000400000-0x0000000000456000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2384-74-0x0000000000400000-0x0000000000456000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2384-72-0x0000000000400000-0x0000000000456000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2384-70-0x0000000000400000-0x0000000000456000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2384-68-0x0000000000400000-0x0000000000456000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2612-187-0x00000000013B0000-0x00000000013BC000-memory.dmp

                      Filesize

                      48KB

                      Download

                    • memory/2792-95-0x0000000006A50000-0x0000000006EEA000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2792-39-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-211-0x0000000006A50000-0x00000000076BF000-memory.dmp

                      Filesize

                      12.4MB

                      Download

                    • memory/2792-99-0x0000000006A50000-0x00000000076E0000-memory.dmp

                      Filesize

                      12.6MB

                      Download

                    • memory/2792-18-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-19-0x0000000001011000-0x000000000103F000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/2792-20-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-98-0x0000000006A50000-0x0000000006EEA000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2792-172-0x0000000006A50000-0x00000000076E0000-memory.dmp

                      Filesize

                      12.6MB

                      Download

                    • memory/2792-228-0x0000000006A50000-0x00000000072B4000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/2792-22-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-2360-0x0000000006A50000-0x00000000072B4000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/2792-138-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-230-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-232-0x0000000006A50000-0x00000000076BF000-memory.dmp

                      Filesize

                      12.4MB

                      Download

                    • memory/2792-23-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-41-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-40-0x0000000006A50000-0x0000000006EEA000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2792-47-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-43-0x0000000006A50000-0x0000000006EEA000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2792-44-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-197-0x0000000001010000-0x0000000001328000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2792-97-0x0000000006A50000-0x00000000076E0000-memory.dmp

                      Filesize

                      12.6MB

                      Download

                    • memory/3020-170-0x0000000000400000-0x0000000000426000-memory.dmp

                      Filesize

                      152KB

                      Download

                    • memory/3020-229-0x0000000005B50000-0x0000000005C12000-memory.dmp

                      Filesize

                      776KB

                      Download

                    • memory/3020-169-0x0000000001260000-0x0000000001376000-memory.dmp

                      Filesize

                      1.1MB

                      Download

                    • memory/3528-2487-0x00000000003C0000-0x0000000000668000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/3528-2485-0x00000000003C0000-0x0000000000668000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/4380-2964-0x000000001B5A0000-0x000000001B882000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/4380-2965-0x00000000027A0000-0x00000000027A8000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/8184-2642-0x0000000001D90000-0x0000000001D98000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/8184-2641-0x000000001B580000-0x000000001B862000-memory.dmp

                      Filesize

                      2.9MB

                      Download