amadey | 81f13f2861dcdcf514bdda56ef8ef4865e131ce2aec71cff4ae54c7263846690

Analysis

max time kernel
139s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
Size

3.1MB
MD5

1790b57cfe11d52a447cb53b7632e0d9
SHA1

3e4eb8d73efbe3ba55fbb61c8a0cfda695e302ef
SHA256

09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761
SHA512

a313ee1313aa77c1174af8a753eb82e23380247d1f915a1c6615bb553306732cbd30717ec37bf755c7e40520623ec4d81bb67942fd6a9f310568d0385b4996dd
SSDEEP

49152:AC5ecDgoqWFmKbjvQk5Nr2eXR7UaLqxHND9KqaC:BecDg3WFmKbjvQk5F2khUYq1J9Kqa

Score

10^/10

amadey cryptbot gcleaner lumma 9c9aa5 credential_access discovery evasion loader persistence spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://pollution-raker.cyou/api

https://hosue-billowy.cyou/api

https://ripe-blade.cyou/api

https://smash-boiling.cyou/api

https://supporse-comment.cyou/api

https://greywe-snotty.cyou/api

https://steppriflej.xyz/api

https://sendypaster.xyz/api

Extracted

Family

cryptbot

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	3c789485f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	4c1926d29d.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4c1926d29d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f783b370a1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a76682da47.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	05d4d33d36.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3c789485f7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	082c04b5ed.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9bc39151e6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SdVB3P2.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2264	chrome.exe
1912	chrome.exe

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	05d4d33d36.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4c1926d29d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4c1926d29d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f783b370a1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	082c04b5ed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a76682da47.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9bc39151e6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SdVB3P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	05d4d33d36.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	082c04b5ed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9bc39151e6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SdVB3P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3c789485f7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3c789485f7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f783b370a1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a76682da47.exe

Executes dropped EXE 30 IoCs

pid	Process
2736	skotes.exe
2788	O8FeZRE.exe
1780	SdVB3P2.exe
2496	b01779e476.exe
2120	Laptops.com
1344	47b5ab5eba.exe
3012	7a4ac5827b.exe
1540	graph.exe
852	960f854309.exe
2096	ec22a6a26b.exe
2544	Sale.com
1076	05d4d33d36.exe
2420	3c789485f7.exe
2212	082c04b5ed.exe
1032	4c1926d29d.exe
2492	be419d8eff.exe
2324	f783b370a1.exe
588	0cd2beb4e5.exe
1524	7z.exe
1216	7z.exe
988	7z.exe
2428	7z.exe
1416	7z.exe
1172	7z.exe
1728	7z.exe
2236	7z.exe
1668	in.exe
2340	a76682da47.exe
2672	9bc39151e6.exe
2376	b967c8a5d4.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	082c04b5ed.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	4c1926d29d.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	f783b370a1.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	a76682da47.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	05d4d33d36.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	SdVB3P2.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	3c789485f7.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	9bc39151e6.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe

Loads dropped DLL 51 IoCs

pid	Process
2104	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2496	b01779e476.exe
276	cmd.exe
2736	skotes.exe
2736	skotes.exe
1344	47b5ab5eba.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2096	ec22a6a26b.exe
1216	cmd.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2212	082c04b5ed.exe
2780	cmd.exe
1524	7z.exe
2780	cmd.exe
1216	7z.exe
2780	cmd.exe
988	7z.exe
2780	cmd.exe
2428	7z.exe
2780	cmd.exe
1416	7z.exe
2780	cmd.exe
1172	7z.exe
2780	cmd.exe
1728	7z.exe
2780	cmd.exe
2236	7z.exe
2780	cmd.exe
2780	cmd.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Graph = "C:\\Program Files\\Windows Media Player\\graph\\graph.exe"	47b5ab5eba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\a76682da47.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1020595001\\a76682da47.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\9bc39151e6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1020596001\\9bc39151e6.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\b967c8a5d4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1020597001\\b967c8a5d4.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	drive.google.com
18	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ipinfo.io
29	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001a5d2-1008.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
1664	tasklist.exe
2436	tasklist.exe
1348	tasklist.exe
908	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2104	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
2736	skotes.exe
1780	SdVB3P2.exe
1076	05d4d33d36.exe
2420	3c789485f7.exe
2212	082c04b5ed.exe
1032	4c1926d29d.exe
2324	f783b370a1.exe
2672	9bc39151e6.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1668-926-0x000000013FF00000-0x0000000140390000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	47b5ab5eba.exe
File created	C:\Program Files\Windows Media Player\graph\graph.exe	47b5ab5eba.exe
File opened for modification	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	47b5ab5eba.exe
File opened for modification	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	47b5ab5eba.exe
File created	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	47b5ab5eba.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\YuBad	b01779e476.exe
File opened for modification	C:\Windows\ScienceCom	ec22a6a26b.exe
File opened for modification	C:\Windows\FarmingDesignation	ec22a6a26b.exe
File created	C:\Windows\Tasks\skotes.job	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
File opened for modification	C:\Windows\RingsAnything	b01779e476.exe
File opened for modification	C:\Windows\BuzzDisorders	b01779e476.exe
File opened for modification	C:\Windows\BaconTicket	ec22a6a26b.exe
File opened for modification	C:\Windows\EmiratesHeads	b01779e476.exe
File opened for modification	C:\Windows\SimsCoastal	b01779e476.exe
File opened for modification	C:\Windows\OmissionsEmerald	ec22a6a26b.exe
File opened for modification	C:\Windows\RenewableProgramme	ec22a6a26b.exe
File opened for modification	C:\Windows\SodiumLegend	ec22a6a26b.exe
File opened for modification	C:\Windows\BuildAid	b01779e476.exe
File opened for modification	C:\Windows\CouplesWizard	b01779e476.exe
File opened for modification	C:\Windows\KrugerPowers	ec22a6a26b.exe
File opened for modification	C:\Windows\GradVitamins	ec22a6a26b.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f783b370a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	O8FeZRE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SdVB3P2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sale.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be419d8eff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05d4d33d36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c1926d29d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cd2beb4e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a76682da47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	b967c8a5d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b01779e476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec22a6a26b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b967c8a5d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	082c04b5ed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9bc39151e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c789485f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	b967c8a5d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laptops.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1716	powershell.exe
2824	PING.EXE
672	powershell.exe
2288	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9bc39151e6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9bc39151e6.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1148	taskkill.exe
2292	taskkill.exe
1620	taskkill.exe
2288	taskkill.exe
1644	taskkill.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Laptops.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	47b5ab5eba.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	47b5ab5eba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	O8FeZRE.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	O8FeZRE.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	O8FeZRE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Laptops.com

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2824	PING.EXE
2288	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2104	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
2736	skotes.exe
1780	SdVB3P2.exe
2120	Laptops.com
2120	Laptops.com
2120	Laptops.com
1344	47b5ab5eba.exe
1344	47b5ab5eba.exe
1344	47b5ab5eba.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
2544	Sale.com
2544	Sale.com
2544	Sale.com
1540	graph.exe
1540	graph.exe
1540	graph.exe
1076	05d4d33d36.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
2420	3c789485f7.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe
2420	3c789485f7.exe
2420	3c789485f7.exe
2420	3c789485f7.exe
2420	3c789485f7.exe
2420	3c789485f7.exe
1540	graph.exe
1540	graph.exe
1540	graph.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	tasklist.exe
Token: SeDebugPrivilege	1348	tasklist.exe
Token: SeDebugPrivilege	908	tasklist.exe
Token: SeDebugPrivilege	1664	tasklist.exe
Token: SeRestorePrivilege	1524	7z.exe
Token: 35	1524	7z.exe
Token: SeSecurityPrivilege	1524	7z.exe
Token: SeSecurityPrivilege	1524	7z.exe
Token: SeRestorePrivilege	1216	7z.exe
Token: 35	1216	7z.exe
Token: SeSecurityPrivilege	1216	7z.exe
Token: SeSecurityPrivilege	1216	7z.exe
Token: SeRestorePrivilege	988	7z.exe
Token: 35	988	7z.exe
Token: SeSecurityPrivilege	988	7z.exe
Token: SeSecurityPrivilege	988	7z.exe
Token: SeRestorePrivilege	2428	7z.exe
Token: 35	2428	7z.exe
Token: SeSecurityPrivilege	2428	7z.exe
Token: SeSecurityPrivilege	2428	7z.exe
Token: SeRestorePrivilege	1416	7z.exe
Token: 35	1416	7z.exe
Token: SeSecurityPrivilege	1416	7z.exe
Token: SeSecurityPrivilege	1416	7z.exe
Token: SeRestorePrivilege	1172	7z.exe
Token: 35	1172	7z.exe
Token: SeSecurityPrivilege	1172	7z.exe
Token: SeSecurityPrivilege	1172	7z.exe
Token: SeRestorePrivilege	1728	7z.exe
Token: 35	1728	7z.exe
Token: SeSecurityPrivilege	1728	7z.exe
Token: SeSecurityPrivilege	1728	7z.exe
Token: SeRestorePrivilege	2236	7z.exe
Token: 35	2236	7z.exe
Token: SeSecurityPrivilege	2236	7z.exe
Token: SeSecurityPrivilege	2236	7z.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeDebugPrivilege	2292	taskkill.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2104	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
2120	Laptops.com
2120	Laptops.com
2120	Laptops.com
2544	Sale.com
2544	Sale.com
2544	Sale.com
2264	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
2376	b967c8a5d4.exe
1076	chrome.exe
1076	chrome.exe
2376	b967c8a5d4.exe
1076	chrome.exe
1076	chrome.exe
2376	b967c8a5d4.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
2120	Laptops.com
2120	Laptops.com
2120	Laptops.com
2544	Sale.com
2544	Sale.com
2544	Sale.com
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
2376	b967c8a5d4.exe
1076	chrome.exe
2376	b967c8a5d4.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
2376	b967c8a5d4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2736	2104	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe	30
PID 2104 wrote to memory of 2736	2104	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe	30
PID 2104 wrote to memory of 2736	2104	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe	30
PID 2104 wrote to memory of 2736	2104	09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe	30
PID 2736 wrote to memory of 2788	2736	skotes.exe	33
PID 2736 wrote to memory of 2788	2736	skotes.exe	33
PID 2736 wrote to memory of 2788	2736	skotes.exe	33
PID 2736 wrote to memory of 2788	2736	skotes.exe	33
PID 2736 wrote to memory of 1780	2736	skotes.exe	34
PID 2736 wrote to memory of 1780	2736	skotes.exe	34
PID 2736 wrote to memory of 1780	2736	skotes.exe	34
PID 2736 wrote to memory of 1780	2736	skotes.exe	34
PID 2736 wrote to memory of 2496	2736	skotes.exe	35
PID 2736 wrote to memory of 2496	2736	skotes.exe	35
PID 2736 wrote to memory of 2496	2736	skotes.exe	35
PID 2736 wrote to memory of 2496	2736	skotes.exe	35
PID 2496 wrote to memory of 276	2496	b01779e476.exe	36
PID 2496 wrote to memory of 276	2496	b01779e476.exe	36
PID 2496 wrote to memory of 276	2496	b01779e476.exe	36
PID 2496 wrote to memory of 276	2496	b01779e476.exe	36
PID 276 wrote to memory of 2436	276	cmd.exe	38
PID 276 wrote to memory of 2436	276	cmd.exe	38
PID 276 wrote to memory of 2436	276	cmd.exe	38
PID 276 wrote to memory of 2436	276	cmd.exe	38
PID 276 wrote to memory of 1708	276	cmd.exe	39
PID 276 wrote to memory of 1708	276	cmd.exe	39
PID 276 wrote to memory of 1708	276	cmd.exe	39
PID 276 wrote to memory of 1708	276	cmd.exe	39
PID 276 wrote to memory of 1348	276	cmd.exe	41
PID 276 wrote to memory of 1348	276	cmd.exe	41
PID 276 wrote to memory of 1348	276	cmd.exe	41
PID 276 wrote to memory of 1348	276	cmd.exe	41
PID 276 wrote to memory of 1416	276	cmd.exe	42
PID 276 wrote to memory of 1416	276	cmd.exe	42
PID 276 wrote to memory of 1416	276	cmd.exe	42
PID 276 wrote to memory of 1416	276	cmd.exe	42
PID 276 wrote to memory of 1920	276	cmd.exe	43
PID 276 wrote to memory of 1920	276	cmd.exe	43
PID 276 wrote to memory of 1920	276	cmd.exe	43
PID 276 wrote to memory of 1920	276	cmd.exe	43
PID 276 wrote to memory of 1484	276	cmd.exe	44
PID 276 wrote to memory of 1484	276	cmd.exe	44
PID 276 wrote to memory of 1484	276	cmd.exe	44
PID 276 wrote to memory of 1484	276	cmd.exe	44
PID 276 wrote to memory of 2504	276	cmd.exe	45
PID 276 wrote to memory of 2504	276	cmd.exe	45
PID 276 wrote to memory of 2504	276	cmd.exe	45
PID 276 wrote to memory of 2504	276	cmd.exe	45
PID 276 wrote to memory of 2120	276	cmd.exe	46
PID 276 wrote to memory of 2120	276	cmd.exe	46
PID 276 wrote to memory of 2120	276	cmd.exe	46
PID 276 wrote to memory of 2120	276	cmd.exe	46
PID 276 wrote to memory of 2404	276	cmd.exe	47
PID 276 wrote to memory of 2404	276	cmd.exe	47
PID 276 wrote to memory of 2404	276	cmd.exe	47
PID 276 wrote to memory of 2404	276	cmd.exe	47
PID 2736 wrote to memory of 1344	2736	skotes.exe	48
PID 2736 wrote to memory of 1344	2736	skotes.exe	48
PID 2736 wrote to memory of 1344	2736	skotes.exe	48
PID 2736 wrote to memory of 1344	2736	skotes.exe	48
PID 2736 wrote to memory of 3012	2736	skotes.exe	50
PID 2736 wrote to memory of 3012	2736	skotes.exe	50
PID 2736 wrote to memory of 3012	2736	skotes.exe	50
PID 2736 wrote to memory of 3012	2736	skotes.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2060	attrib.exe
1944	attrib.exe
2924	attrib.exe

C:\Users\Admin\AppData\Local\Temp\09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe
"C:\Users\Admin\AppData\Local\Temp\09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\1020068001\O8FeZRE.exe
    "C:\Users\Admin\AppData\Local\Temp\1020068001\O8FeZRE.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\1020416001\SdVB3P2.exe
    "C:\Users\Admin\AppData\Local\Temp\1020416001\SdVB3P2.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\1020583001\b01779e476.exe
    "C:\Users\Admin\AppData\Local\Temp\1020583001\b01779e476.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Podcasts Podcasts.cmd & Podcasts.cmd
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:276
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1416
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 99123
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "follow" Traveller
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1484
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Sky + ..\Images + ..\Similarly + ..\Mp + ..\Investigators + ..\Accompanying + ..\Provincial J
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\99123\Laptops.com
        
        Laptops.com J
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2120
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
- - C:\Users\Admin\AppData\Local\Temp\1020584001\47b5ab5eba.exe
    "C:\Users\Admin\AppData\Local\Temp\1020584001\47b5ab5eba.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
  - - C:\Program Files\Windows Media Player\graph\graph.exe
      "C:\Program Files\Windows Media Player\graph\graph.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
        5⤵
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1076
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6729758,0x7fef6729768,0x7fef6729778
        6⤵
        
        PID:1856
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1784,i,16993139167861220506,4357081238899821351,131072 /prefetch:2
        6⤵
        
        PID:2648
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1404 --field-trial-handle=1784,i,16993139167861220506,4357081238899821351,131072 /prefetch:8
        6⤵
        
        PID:2196
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1484 --field-trial-handle=1784,i,16993139167861220506,4357081238899821351,131072 /prefetch:8
        6⤵
        
        PID:900
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2348 --field-trial-handle=1784,i,16993139167861220506,4357081238899821351,131072 /prefetch:1
        6⤵
        
        PID:1564
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2356 --field-trial-handle=1784,i,16993139167861220506,4357081238899821351,131072 /prefetch:1
        6⤵
        
        PID:2320
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=720 --field-trial-handle=1784,i,16993139167861220506,4357081238899821351,131072 /prefetch:2
        6⤵
        
        PID:1264
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2916 --field-trial-handle=1784,i,16993139167861220506,4357081238899821351,131072 /prefetch:1
        6⤵
        
        PID:888
- - C:\Users\Admin\AppData\Local\Temp\1020585001\7a4ac5827b.exe
    "C:\Users\Admin\AppData\Local\Temp\1020585001\7a4ac5827b.exe"
    3⤵
    - Executes dropped EXE
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\1020586001\960f854309.exe
    "C:\Users\Admin\AppData\Local\Temp\1020586001\960f854309.exe"
    3⤵
    - Executes dropped EXE
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\1020587001\ec22a6a26b.exe
    "C:\Users\Admin\AppData\Local\Temp\1020587001\ec22a6a26b.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1216
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1380
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 370821
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Anchor" Veterinary
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\370821\Sale.com
        
        Sale.com w
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2544
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
- - C:\Users\Admin\AppData\Local\Temp\1020588001\05d4d33d36.exe
    "C:\Users\Admin\AppData\Local\Temp\1020588001\05d4d33d36.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\1020589001\3c789485f7.exe
    "C:\Users\Admin\AppData\Local\Temp\1020589001\3c789485f7.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\1020590001\082c04b5ed.exe
    "C:\Users\Admin\AppData\Local\Temp\1020590001\082c04b5ed.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\1020591001\4c1926d29d.exe
    "C:\Users\Admin\AppData\Local\Temp\1020591001\4c1926d29d.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\1020592001\be419d8eff.exe
    "C:\Users\Admin\AppData\Local\Temp\1020592001\be419d8eff.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\1020593001\f783b370a1.exe
    "C:\Users\Admin\AppData\Local\Temp\1020593001\f783b370a1.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\1020594001\0cd2beb4e5.exe
    "C:\Users\Admin\AppData\Local\Temp\1020594001\0cd2beb4e5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:588
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      PID:2780
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:1668
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:2060
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:1944
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2824
- - C:\Users\Admin\AppData\Local\Temp\1020595001\a76682da47.exe
    "C:\Users\Admin\AppData\Local\Temp\1020595001\a76682da47.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - System Location Discovery: System Language Discovery
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\1020596001\9bc39151e6.exe
    "C:\Users\Admin\AppData\Local\Temp\1020596001\9bc39151e6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      PID:2264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6a09758,0x7fef6a09768,0x7fef6a09778
        5⤵
        
        PID:2560
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1268,i,13891167358442641552,2871100888336194125,131072 /prefetch:2
        5⤵
        
        PID:2100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1412 --field-trial-handle=1268,i,13891167358442641552,2871100888336194125,131072 /prefetch:8
        5⤵
        
        PID:1172
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1512 --field-trial-handle=1268,i,13891167358442641552,2871100888336194125,131072 /prefetch:8
        5⤵
        
        PID:2924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2144 --field-trial-handle=1268,i,13891167358442641552,2871100888336194125,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1912
- - C:\Users\Admin\AppData\Local\Temp\1020597001\b967c8a5d4.exe
    "C:\Users\Admin\AppData\Local\Temp\1020597001\b967c8a5d4.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2376
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:1620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:2288
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:1644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:1148
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:2868
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:1048
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.0.640636897\833846144" -parentBuildID 20221007134813 -prefsHandle 1140 -prefMapHandle 1132 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b47422f-d1dd-4445-b32d-bce0ba37d936} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 1276 108d7558 gpu
        6⤵
        
        PID:2148
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.1.1784867346\1991649672" -parentBuildID 20221007134813 -prefsHandle 1472 -prefMapHandle 1468 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7633296-ad57-426f-8dac-374a0dadf691} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 1484 f6e5258 socket
        6⤵
        
        PID:2700
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.2.1127916554\221036964" -childID 1 -isForBrowser -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 644 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccccaccf-d79e-490c-9aca-327ecd4d2bf5} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 2072 14b7e058 tab
        6⤵
        
        PID:1932
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.3.897322182\246876033" -childID 2 -isForBrowser -prefsHandle 2908 -prefMapHandle 2904 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 644 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {369ff9e3-bd81-4aac-ae2e-1020ac9c80c4} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 2920 e63b58 tab
        6⤵
        
        PID:928
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.4.2086025233\1124478033" -childID 3 -isForBrowser -prefsHandle 3708 -prefMapHandle 3704 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 644 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa98bdaa-07ff-4395-b8bc-34809704d987} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3720 1f76e258 tab
        6⤵
        
        PID:3420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.5.13925401\474307233" -childID 4 -isForBrowser -prefsHandle 3328 -prefMapHandle 3324 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 644 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b05fcc9a-b0db-4c05-b3ca-1bb0d3fa0e82} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3320 1f76f458 tab
        6⤵
        
        PID:3468
- - C:\Users\Admin\AppData\Local\Temp\1020598001\92d0a70140.exe
    "C:\Users\Admin\AppData\Local\Temp\1020598001\92d0a70140.exe"
    3⤵
    PID:2396

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:276

C:\Windows\system32\taskeng.exe
taskeng.exe {3A34B410-7B1B-4391-B471-02EE37623236} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
PID:2328
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  PID:1884
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:672
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\graph\graph.exe

Filesize
245KB

MD5
7d254439af7b1caaa765420bea7fbd3f

SHA1
7bd1d979de4a86cb0d8c2ad9e1945bd351339ad0

SHA256
d6e7ceb5b05634efbd06c3e28233e92f1bd362a36473688fbaf952504b76d394

SHA512
c3164b2f09dc914066201562be6483f61d3c368675ac5d3466c2d5b754813b8b23fd09af86b1f15ab8cc91be8a52b3488323e7a65198e5b104f9c635ec5ed5cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
1d6994c9e7456e30a9c2dcecdc184047

SHA1
ad85ecf6f00da14dbde2b4b22e52809a02ad11cb

SHA256
32d641a0b1a4d012ac26b4511e84b1ce3a0c129fccd4e85a78a31d46b14f1a8d

SHA512
45820fc375361f0518efc53e283a5421a58ace75b2d4d94c9a190ac75a3b3717b9b797e8d27cec3014fcc9e9ea27f2ffc586777d8d658e0e24d379fe7604c607

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
87639867680b5bf09187c033f61c5b2e

SHA1
7ed2839ed79c2f213a2921f492564134d685f39c

SHA256
09d5aa212fe40b455a0c89bf95e9153576b6554cab82f4844779fe087de228d7

SHA512
c6730925d66d6ade5e644f48224e7b57120343d47b6d8ce0f44ee4af46b477a276203b00c4820a1854f9c553805ccfadcadae320e61973e8844248e204cb47b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020068001\O8FeZRE.exe

Filesize
295KB

MD5
ef9b9ffab9d91e590c6bda0280686d52

SHA1
bcbdca605606f483e76ae821b7bf81ca3e1b529a

SHA256
1345ad4c782c91049a16ec9f01b04bfc83a4f0e1e259cfed2b535f8ec6b75590

SHA512
3b362b306ba8357ac2eecd7354799e203d42fdee849584b26ee2c4c7b2c632c64558fd84f22c1dff35957f6950e333d005a225a54bdab4b3f53812041ea6345c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020416001\SdVB3P2.exe

Filesize
1.8MB

MD5
8a0feb447f024f32d1ee001a56d7ee23

SHA1
39086a8133462fbbdbaad4a313789d216497e68a

SHA256
b474d829617220d8d949fa58a39d9eafde02ec488f0c7a4330950fefed66bd86

SHA512
09efc757b29341d91d08619e8924b5cbb3acd73f2fe13b1aa21327c4133721102110b17f6717b09e703d1137d4266ab6e563f85bd34e98a1ee03b1b50e7ddbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020583001\b01779e476.exe

Filesize
1017KB

MD5
af97661ca877fa1c644ead6567388945

SHA1
6ecb6d1a317e72a39a88f86c1f47b4e00427b8fc

SHA256
f88e4323299b2af453ce04ef6f5dc55b753d9210d7e598a0085bf3c21a5a4f0a

SHA512
9f99c8f1f4c343fc920146dd3c8d130d724b838a80ed2b4514172bbdfea2e5bc98fd27d42a2748cfec73a5680861bcf170c70ae9e45a2fed86ad6ec621899713

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020584001\47b5ab5eba.exe

Filesize
591KB

MD5
3567cb15156760b2f111512ffdbc1451

SHA1
2fdb1f235fc5a9a32477dab4220ece5fda1539d4

SHA256
0285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630

SHA512
e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020585001\7a4ac5827b.exe

Filesize
2.5MB

MD5
87330f1877c33a5a6203c49075223b16

SHA1
55b64ee8b2d1302581ab1978e9588191e4e62f81

SHA256
98f2344ed45ff0464769e5b006bf0e831dc3834f0534a23339bb703e50db17e0

SHA512
7c747d3edb04e4e71dce7efa33f5944a191896574fee5227316739a83d423936a523df12f925ee9b460cce23b49271f549c1ee5d77b50a7d7c6e3f31ba120c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020586001\960f854309.exe

Filesize
758KB

MD5
afd936e441bf5cbdb858e96833cc6ed3

SHA1
3491edd8c7caf9ae169e21fb58bccd29d95aefef

SHA256
c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

SHA512
928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020587001\ec22a6a26b.exe

Filesize
1.2MB

MD5
5a909c9769920208ed3d4d7279f08de5

SHA1
656f447088626150e252cbf7df6f8cd0de596fa0

SHA256
5f2c26e780639a76f10c549e7dea1421c4f06093c1facbf4dd8cf0a8b2fee8cb

SHA512
c6038048bd09c8f704246a6ba176ea63b1c8d23f2e127600c50bac50f3032c1b751ea8e405a2fe1ea707f75f21cf6516447345a84751bc677d94874d4b91090b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020589001\3c789485f7.exe

Filesize
4.3MB

MD5
e3449d1a8c12d6d9510f67519efc97d5

SHA1
707ca92c9b69ef43a3a567adc42a0882d95377f0

SHA256
1534caaa2fad0ed1beed2ec7e738d77ab8aa6b27807613116cac79580f2cb049

SHA512
d038ed41f48eca30f66400d9e1ac0eeec33c19ac776fcde39fb7b4dabce9c38760017009419c2d8744d17ac29c16c543c7c8cc3e7a82e6b2f171fd3051784c89

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020590001\082c04b5ed.exe

Filesize
1.9MB

MD5
6dcbb5e075d2153c3df63c0c23ff052b

SHA1
2276e179d6b5b6cfb29a3e38991f83bb06dfdd36

SHA256
2c09c80db93c11961dc8380cafc12e5b579155e9e8a74f4ded97cb084e05b941

SHA512
de3231444b2be0b38173f3feb2f807370362d66c57056bb6197d455b8349313d9150d302d76dfc66e6e3e003966277edeb09c71bc0c9b7cfa24ff6c19f934da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020591001\4c1926d29d.exe

Filesize
4.3MB

MD5
075fa1c9ab37da504f2ebc0bdb1c5e8b

SHA1
3f5c22c0f4968ea41941c2a24eea0e025da54b7f

SHA256
4f1587e3998b79e7f9bb6248e401da9e89922ee19f520d5cfff3bae1516ca19d

SHA512
7694940d68a988f95baf515143edb62fdc9faee12c2d18f450848789489903286f4db94ca59863566b0310f60a8baf3411f31660efd1295960b996cedcceb701

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020593001\f783b370a1.exe

Filesize
2.8MB

MD5
aab5668cd6598644b60f99c567ae1fde

SHA1
f1a03df4c5616ca25e80f27f4d31c897938fa267

SHA256
c78b0964068592f6274a1efb4892a5cb98a57b6933c462a2e58490505f7b971a

SHA512
cd128a377c12932606e4e7500336e7c7a038dcf178277770ed0c57e2e95865ab761834df28f3b0701ba21f852910f1119483241540822b7d7a04a498fc577bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020594001\0cd2beb4e5.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020595001\a76682da47.exe

Filesize
1.8MB

MD5
00936b70810900b3468fbb2fa49274b5

SHA1
5ac1c47426dde25a4a063a8e0173db1350003074

SHA256
cc6192e5014961df506df8a5b6cbac0819186990c163f9108407591c73685d53

SHA512
e8148d1507a62dc1b33f52e3dbf92d4c52d6c8de2de669bdadded673aa9c8f468aa46a0f2412f39be94d0ee28dadfa1a222cca20651865d23a6b6e37294fdc3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020596001\9bc39151e6.exe

Filesize
2.8MB

MD5
b25f2117faddee0012b548e795fa75de

SHA1
735cab6e4cf78ed64e1609e9ba06ed0d919afdc4

SHA256
56998c972948a8dc69e388158cdb4ad9fc38fbc05538e91295a130a34cfe69ca

SHA512
30e86652a3c4b4219887d1cec08406389f71992623e06de1a1e498468ef3552a2dd258c1e4e17eaba7b0672b16c6a48aec9e0835ac6b53d8651277950aa619a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020597001\b967c8a5d4.exe

Filesize
947KB

MD5
637dec52e26715b1b69ff8853d36f867

SHA1
38569bd9e109b4775e67c26e70851c0b1288fd88

SHA256
f6f8452b72a0aa504389ec557003251063127ae1adb37ffcb44c05f453ba1ea0

SHA512
a13a2799df9efdd9aa841ab7ec40c7addfacfef43a6e2d8c696994ca29d857b536238d379f48efb1a690850ef17b0cb8fb847ed675f475f8482a82c5a0205859

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020598001\92d0a70140.exe

Filesize
2.6MB

MD5
21df530e46f87250f7de1cbbbae4e225

SHA1
617685d30a48f67eaa0febf5a3356ae3fff5672d

SHA256
155174a7df31d1e64670f9859fc6d16a82be5bf478d457bda0906bfce287fef6

SHA512
d6b6b60430fa75c5ebd45e0d7d284d89469cb0c429b8799fbd00cda2546ae88219e20e068816b988604128e211f2655c810b82d4556cde43c09455eb82e6afc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\99123\J

Filesize
452KB

MD5
9d5451c35e68d36eae4ebe88777a2703

SHA1
a68074d54baf2f148d6358e86232f02075eb6cce

SHA256
e812fb4a46034951670ae35690a99ccb89ccdd964ce2ec993cc5edbb42b97a7b

SHA512
ccb0a305243532f665974c2c6eedc89a58a960f27d5a86511726319502c4a146bbad3b075a6f2d1e153a17f74580411637cfa4d9fc9de53d0d070a1d0fc56d22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Accompanying

Filesize
51KB

MD5
5301e544069f4abbbc2feba1e75d5839

SHA1
134528e199d21ddae5f17d41ab5ec1148910e8f3

SHA256
fef3f6d3ba309563a0d6fa00821d85267fe5e97d88009a6c9dc2f103ba7b638f

SHA512
ab9db4f66c30f28da1f59d8407191c915f214fce384a7dabe8b1bcc70d54fdc76f03d0a44d6646b5478eeec9caa9df69b58b6c59778034902a46dea0ac14a608

Download Submit
C:\Users\Admin\AppData\Local\Temp\Anybody

Filesize
121KB

MD5
c89fd1314a2184d5d7b4a66de377d5b2

SHA1
f0ebbc2c8c6f9ebadc6ace713aec1b06f3f841e8

SHA256
9d1e82e2e430b87b28867ff9745a74e53a128671e9d300f111b1904786c2f856

SHA512
4b0b16e99d0cacab0b7af1d65cbf9226988752d8fa020b955bf54c634d9d64a05bb036ef590fa0d852d513621a84f4c3dc3c341aa8feffdf350dd8a5dbc75778

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AE7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Campbell

Filesize
11KB

MD5
e7567ec4057933fa6e06322b7c08b72a

SHA1
4e733e77915c7dfb7d25e31738e9d596962d4177

SHA256
1896ef25a6223f19f770da125a4b1bc7c90815ccb682ec7ca780d231a01c28b0

SHA512
d8a14e5c8225ad8bdbb45317fd41588c12e9e60f1c9ff819d0d15cbc35801b82e7c7981b7dbc815666354950a7f5362fc00765f8a67c9478bd95dc5a31b12c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Conferencing

Filesize
130KB

MD5
638e7812c5e9c55c5f339cc64d197b28

SHA1
5ef8a953ef65ab7d0620a5d144f2c410e2a77a2f

SHA256
347a3459dd74aea0a6b2f62955d1bc9bdb091bb66ca8a42274f7ebf310527fd8

SHA512
194b0d8799a83210968746c4d3e364ee512669e6080c6b3d215d97c141e8ef7f09152ea524691efcd2276acb1dc158ffd484e3f595ddf2cceb690bd1996c8266

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cooling

Filesize
86KB

MD5
3e203e6316f562d31cde3c9c3c416bdd

SHA1
c77d7fc854662f8b5051dfef8118cd20438de6ca

SHA256
8e3db2b70a0e30eacb80191bef9ccf3625a2c12a2784837f7b7c83cc6f8a0e0a

SHA512
08f4598c0c55238069bbaf3b6fc36920a5556aeb1da354e17a834c6bbe5a8253e5f1f3d6b8d16de13e5dff9052044b48bf05b555fde36cc0d5ba8786bb84a99e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cradle

Filesize
65KB

MD5
4b991fcc2b73b98f1450ec87c1e39643

SHA1
51b13446dbbf3658f5a4c97fef9757de7d1bb8e9

SHA256
e940ddb06d156cb37e95dbf088a8e762247393ef96b9f025b8d44e786dc932a6

SHA512
5060225eb979a6779c6e706eba924013ea1a63bdacd5cbd8469500c4d3efa2b5d4ddaef30533a8770199e261482e5f8740d9b8c20dfef8f32b7b8d461dbc9a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Debug

Filesize
112KB

MD5
d9daf89d86b32df3d7da7ec1cfbf7212

SHA1
59e1ba3dd32168a3d79a9da2626c99c52970a53e

SHA256
06f48747a4acb2ee437d03a9e8331cca5c76ee5684e118f491e4faf7799adcc4

SHA512
24d26b6112417d75915f08562af53eb1bb7ddef2e89e779db52ae0f674ea8ce102984fa2628cee5588c7dc34df00a32497e49ee18f7259c51e4d1c855ab69a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dod

Filesize
3KB

MD5
682d77b5a6d22691a869ab4bea11ad53

SHA1
f56fab8959a05c77570652f5f8e9e4103489e676

SHA256
c269725998f8f5acdab6a0067457065cc9059326ee0a38ff353c2939a0190c1b

SHA512
c42d04178ed59683fc4597b83496d7b3c61c1a075b4542abb491c9639531f9737d70ae4172186fd6a3450c26701d794496bd4ae0f5e50db8a3818cd78ed7fd27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Draws

Filesize
90KB

MD5
44951d98b49859e4785cb033fcd69dfc

SHA1
ec472265152d7030d26536eff22c5ee4cda39601

SHA256
9f14969cb5a7c30e265939a12cc0000034fb59dd25167a1ce0a7f68ef5ab1c9a

SHA512
eaca2ea6193708e5e96d7acc66f22568bfab61d1ef8b97d02aace105fd5b0485a55c64b521828af28c043f2bb6d5dcf400880adbd80a716d92c759e6e20d6d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ejaculation

Filesize
148KB

MD5
2e9e29f8ed97f2de8ebb1652bdbd545a

SHA1
5577d360b25daffa0af907fc5d852894b784f81d

SHA256
aeb399054cff321f752d4f93143815ff1a2cc2398668c2e1110065a2c6f502f1

SHA512
f4f925daf3f576441d2b7a0e250a51400b23e714d76870a640734912da783d83ac113586f121161d96d7f06eb70b8d89eb4e0524d591232b0b2a342063e8bcb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Execution

Filesize
112KB

MD5
42fb34ddb94507c5a125bf02c2983904

SHA1
4e400c020121235e3de490f5cbb38c4a25e686dc

SHA256
d59efea25d1e316b8a9248f52081ab14113c97603f3e90d533f4f373f743b3c7

SHA512
639d90cd1cd451ebcb9e5e1c165f7eebb62b30d6bf24c596990ca40e08bce5d0b5864e7a4f0a83624c7cf9ac4ec5c1e7385f59602b206f3346554d62721cd71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Genre

Filesize
88KB

MD5
5ce4409c4aaa9fd5a27ec4974734f1df

SHA1
bf7ee5465ef96ee0186388b5b0685ad727ed9493

SHA256
a401b4cd0afbaee57d8025bf4fce12583c825cbc2e3d3f308eb0627cd5bba412

SHA512
1155b1c58221ba1c809d9d60cd440ebd8788dcd3169ee87bda72fb7061b1e2f849f8bc79ac7053df5de8bc7955db088df778af66900d6f303bde6d61925014e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hydrocodone

Filesize
61KB

MD5
1e356494658efcd99f6240a5243924f5

SHA1
0fe6e730cf03e0cade72ceb459fa5756c2fb1757

SHA256
9f29364243c72d66d3977e7d6f2c44ad95bdb835e7aef2ea4df56746a63145af

SHA512
acfd4f95a56e179b2b97a0a55aea201e570c5ddf99c52b6de9b740e670803b17cc90a757c4b82e1e041f4bc7724126d4534d509198873a985fd02fc9770b9102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Images

Filesize
71KB

MD5
805da0b25e5659b2090c9b59ed0c7100

SHA1
94d0fbf1e8d9b856a899012bc9b99a5b4cea0a66

SHA256
f2b4db508c5d89fa3acf03f7387d547fa365af9e4b0cc6c3d6398bfc964e2ef9

SHA512
e760d76f033158e848bd3e3fea0bc49ccf8f235e851ee66981314073cf8bdf8a457b2a996635cf5929e205878678e388d1e93013e7a7b5fd5fd3fb66232a7679

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intent

Filesize
92KB

MD5
b4094aca25b2abdc05d69604783dba5e

SHA1
0dfdbc2c2376df2be8980940052ca6950565b76d

SHA256
838c88e7e1b851813d41731e5817e318732191667d2de05d06fbb0583ae00838

SHA512
5abfa7d12a17a04b12d8191d4c5a03ff94a2faddaa34f778714e25a46299e6f25e60acdd49230936b9e8809349f88dc55334991120fa036e6653565427320d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Investigators

Filesize
93KB

MD5
a4e4656e273804d0f852a899c72b8ac8

SHA1
052e483b2ad90917fb0edb6ee864a45dd304d149

SHA256
9e75061906cf194ba753c0e5da129c76746353de036fcdad88215d186bc07142

SHA512
865ab23ad5d0b833c46d8ca5e50c1e4313fabee3aa4e846a8ddd150be92120daa2fd182d302179b6c4d18ca69cd724d82f31b9ac15410ace57b2c19f77e4ba62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Making

Filesize
52KB

MD5
e34dad8abc86ddec0b36739e14998200

SHA1
7ca425845b3ad0f610e4e97920361ade864a1321

SHA256
0ee35aa05a54819055b686be31c6fe0c0d6d918ce54e7994f648b13e95f5a539

SHA512
9f488f76466e8a13f187aa8d7d6b217682248a33b179f8c3bcb70858c64b74d5bc7af9e4ef3ea5b2d7255cb260d21fa5a4c09c2bf0cc0f06c459b8e87b4e1d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Marijuana

Filesize
58KB

MD5
d830821fe60d6cd810fb9ec7102838f3

SHA1
9264b78903fa373e0a1b697cc056decc1dfafb5f

SHA256
00a96ac0e8600a9fa0a00ef1f939b58be93618c4fe4e3be9d0bfab0a4a0ff57d

SHA512
2a8e2bb9d599964ca112aacbb0fda37c01466898a7af5d7c8543013949b0bc6e5665402692a1072845b1a72211d350963c608a81a7c3450c19a56a948ced5d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mp

Filesize
62KB

MD5
6bdc450c376beeb2315627124f2cceea

SHA1
6b5ff983669677bd6e58d34511cf2bb42e4ded7e

SHA256
20e5f6e77d1a252cc4b1050f373d5a8d93c05dd5ae0fbd92514595406cbf88f4

SHA512
7321a2e930133590114041b4cd6e693e03dc284923e54f7db96822d6bce1fc86a87423868ac7ba8d87f35be8632ce4dcc82b4b7e8545f76067bcbf8d4fdbf4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Non

Filesize
73KB

MD5
d487bb0be6a5dfc11120e16415eaf254

SHA1
e688decd45d311d7c441a86238a340ec8a4e2c12

SHA256
e90c0c5ab08b586b8e5c148f9fff879c9d664a8d50d2fcda8e518555c5a29d04

SHA512
082e262ce56cb7321dcbdae18c1caac261e1cbe29c1924822e454fae5a5d57ac53dfd4f357649c43afb99a338b6dcfb1bedac56f206cd61963765c850ea8967a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Podcasts.cmd

Filesize
19KB

MD5
270e797dcc891238ecb4753b12ad9740

SHA1
2714eaaf585411ca91ee2ffb905d6271bfee6d9e

SHA256
2b87d3a5678436374f66000bc263763f35d1662b675f004b55002cb4f473a3d0

SHA512
409f2d91ea614e28a6a966cc52769bedd8786d1e655629da544d93a9d0547c8d151798f3f5010e11cd4308d58a419616dc35a4273df17afb94022a29f6f26a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Producing

Filesize
71KB

MD5
aa4d881ea35979e4eab13c982d3d0898

SHA1
cf301086d6e43e603571762fbc7d754f0246fb74

SHA256
31d85bebe7949c9b7b40af007fbbe61c8cd6c25f8e4fc7dcfe9b7dcd8a1d79e7

SHA512
f64491753f2cf57b72740ca91f10c2bd677219bc89bf86d2476a8567cf83955f986a481c92d19bef9c466438af97d071686ea2fc496c5e477c900568f129b5f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Provincial

Filesize
21KB

MD5
b3ba8505107e9d073a550ccba98eb968

SHA1
7c2b8d580417b0ac00c72742e7f2a3dadba2037c

SHA256
962591c18363189e560b8c270d622211b8816d682ff198c85175bda20dfd936d

SHA512
1ffda708e501e4d2290d1f823c98a616c60d5703da8d8dd1933a262169d061bbcecb88b1905a50ad6e431e0b65f0bf9af337cd8319bdce30d087b5cf9cf19024

Download Submit
C:\Users\Admin\AppData\Local\Temp\Reality

Filesize
138KB

MD5
2f19bb4cd5c2064eff5481daab21998b

SHA1
b90e3a2c59845bf9db96290892c3ffc0931d0660

SHA256
cef09842dd65e03840d74a9b99f480bce506833a64761e4685e4ce911b77967d

SHA512
7515b6da13ae4cd6cac7693a9120984a22cc851a24726f01cd92282bdeb8b8c48126bae69795edd1eb261f4df83bf344d1a6be7e2e33b8408cc00badec3adb53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Similarly

Filesize
85KB

MD5
2a0a1ee171590176fe15f4642b8a760d

SHA1
4aa9f7a03075b102216671f2317a1ffe255d3711

SHA256
72e64f8c258c2187da2a8668a6cdaaf9e00d0231f4dd53962bec9ea2c4361192

SHA512
b948bbe8b1b96652fb7d86de4af5ba74e3665da02b51d81e1ec7ae2a3888bc2be540bfd38b5eccf69f37daf59cf8bf3e2f3f226fb0ae2609fa0c5f850b6ada99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sky

Filesize
69KB

MD5
4932c3ce2af6353e67c7c5f350aa4d78

SHA1
bfc9ad2b57cf1889da29df3bf890dc3ccf47052c

SHA256
66f710bd4b6c369c0c5cd62d20fc74d01d728567ec3e27bccc6878632c9b32ac

SHA512
204ee6621b85e96592fc4633bb26d6ea60a49041cc4b3aca4344fde6ba72ea2d828864ce5af4f7ac263eaab6b8237fc8586b4d6dbf7d6b906932737264e3fe92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solely

Filesize
105KB

MD5
2fadd2bf6f3cdc055416baa1528652e9

SHA1
342d96c7ce7b431e76c15c9a7386c2a75e3dc511

SHA256
8df18d17c715e689b9cb222beb699120b592464460fd407dbb14f59ccec5fdb3

SHA512
08bc19703dad1441e1da8fb011c42241a4c90d8355575b7f41d465e3e84d797ecac7d6bf9af6163e6f4ef506cd98561f62d06446f861aeba2d7644beb7f6abb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Steven

Filesize
144KB

MD5
d48116c78de0b7a19a42a803f1c7bc10

SHA1
a7e478e2987746c4aad980b87be2b6e34366d790

SHA256
645449e2fa6cb0460ddcb955cca87bcfaf3bad4d2c13df5192ede5b15f91e1c8

SHA512
17468a6e770545bf81c35c7f6c892e02a4b0704bf4990700acf5041e801ccae651e404712f40ac05f4f2d628854f2f9eae9050fb8d24ffd48b7305fdcc6243dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sunrise

Filesize
62KB

MD5
9e4fe1f2538c08f75ae16a3e349c9ef2

SHA1
559879228568b2f405400b34dfb19e59f139fa2c

SHA256
22ce756672aca3a4ba015903b4c36e7667e15c73157759e5a2212e7d4e727cc0

SHA512
a1f6bf183c590cc62000dddb0fea63bae2bdc30fce8ebfa24286b9fb8b2415c67b2363f739d36b32cc7b477e608397efbe45173173aa3f27ed44e9b75448b9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C03.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Titanium

Filesize
123KB

MD5
54e8846da2e826944aeb7af79d077db8

SHA1
4b3f32b33d7479c08b1af98fea297e66b0fbbbbb

SHA256
31512137663462a5bf630869af643c9ac3d44a354b3c442bbb90292d4aad9e38

SHA512
1c78464b7954de3732243adcfeb7584a3454f4536b52a40463d692f4851e73679b05c1b5e16374f471e0a9a2f8134cb87282b8e889d52bf2c50174a4630ead06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Traveller

Filesize
148B

MD5
34399bad11f65167027ba746bf5173be

SHA1
adeb8efcedd109ff1de4dffaccb61f3a4f8bf207

SHA256
3aa351a4f2dee96e357418948fe5f017987d8e7dde3def2eb06b5cb0a3a7eae4

SHA512
a054b103d05bbcfccbd1d3087f5f6226713b8002ca8bba63f4e1f4de7c97b017d8d5b729ef9f5461a781d4b42b78c869d16366949ee7e43477109c7848385430

Download Submit
C:\Users\Admin\AppData\Local\Temp\Veterinary

Filesize
2KB

MD5
6f07c56590cb57e03b68f9e2f994390c

SHA1
aee254034b1f3394a97304c8dfbae1911440e2c0

SHA256
1772cfd25c5deb74dacc6fc88aa8793a74c89a81452b27e886ca49557ba32d84

SHA512
0af18e6d07c161a5088cec9a56654c9f661ac003f0e22b68b6dbfe2920bb344f4d9a1326c261957c2309bb44dcb39453630f33068a057a1a6c2960edfbd39001

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.1MB

MD5
1790b57cfe11d52a447cb53b7632e0d9

SHA1
3e4eb8d73efbe3ba55fbb61c8a0cfda695e302ef

SHA256
09b5590de6b345c0c942426b23309b24e5504a692f408a8353de5fbf38986761

SHA512
a313ee1313aa77c1174af8a753eb82e23380247d1f915a1c6615bb553306732cbd30717ec37bf755c7e40520623ec4d81bb67942fd6a9f310568d0385b4996dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
945db9e1e36cc63c9d707ee9c319d4b7

SHA1
d0df06b4c835cfbee6cc280388d86570e2e22c76

SHA256
5867c4c5851cd0f1c6cea0e2c8686ddfc645b9756cac6774275bc1eb0608b5c2

SHA512
ffd78fb3d4336f5427c06778a96d6d4ed45ece56d58e1fa714017a248582e71fb413dcaf6be974a1b9ca18b1acef0aac73f8178cf2ad36dbc78cb2b2588f0a2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\0cba5961-5cd2-4211-a9e9-0c785a7ef11c

Filesize
733B

MD5
9356435e12cb644a3f6017a40511aeb9

SHA1
c693b199b6ca6790b2d38bdb6771a97a2c511709

SHA256
738b3ecb6a9e355dee08d1e0838c7e09b7b2accd781e3b0106efaabf85fc2839

SHA512
9e575095adacecd137912a32b8b582513fb5ade0e7a005e276cc0b65e1bef170ab31821e6a55403b91a0ce5256cc20d57a0e8141bafce871229fde172482f6f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs.js

Filesize
6KB

MD5
3a4e1475d2191eca8de430a5d0c5adba

SHA1
baac25a2a376dbfa3977b468054afc3f4b3a2a1e

SHA256
a4a727ab0ee6c054eb6cdfff74a68e48bd542b298ffa28beb1f1506bdee190cf

SHA512
12a80fe56e5180fd5b27394e563aeaa2e09c10703363f3a9333815b94a0f0983b86584709e32a0f5e93294b23d9254fefccf9afc5ae8bb12aab92fb0636aff2d

Download Submit
\Users\Admin\AppData\Local\Temp\99123\Laptops.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
memory/672-1117-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/672-1116-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/1032-853-0x0000000000C80000-0x00000000018E7000-memory.dmp

Filesize
12.4MB

Download
memory/1032-874-0x0000000000C80000-0x00000000018E7000-memory.dmp

Filesize
12.4MB

Download
memory/1032-946-0x0000000000C80000-0x00000000018E7000-memory.dmp

Filesize
12.4MB

Download
memory/1076-765-0x00000000003E0000-0x0000000000886000-memory.dmp

Filesize
4.6MB

Download
memory/1076-756-0x00000000003E0000-0x0000000000886000-memory.dmp

Filesize
4.6MB

Download
memory/1076-760-0x00000000003E0000-0x0000000000886000-memory.dmp

Filesize
4.6MB

Download
memory/1076-726-0x00000000003E0000-0x0000000000886000-memory.dmp

Filesize
4.6MB

Download
memory/1076-768-0x00000000003E0000-0x0000000000886000-memory.dmp

Filesize
4.6MB

Download
memory/1076-745-0x00000000003E0000-0x0000000000886000-memory.dmp

Filesize
4.6MB

Download
memory/1076-742-0x00000000003E0000-0x0000000000886000-memory.dmp

Filesize
4.6MB

Download
memory/1668-926-0x000000013FF00000-0x0000000140390000-memory.dmp

Filesize
4.6MB

Download
memory/1716-931-0x000000001B850000-0x000000001BB32000-memory.dmp

Filesize
2.9MB

Download
memory/1716-932-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/1780-728-0x0000000000E00000-0x00000000012A6000-memory.dmp

Filesize
4.6MB

Download
memory/1780-758-0x0000000000E00000-0x00000000012A6000-memory.dmp

Filesize
4.6MB

Download
memory/1780-63-0x0000000000E00000-0x00000000012A6000-memory.dmp

Filesize
4.6MB

Download
memory/1780-763-0x0000000000E00000-0x00000000012A6000-memory.dmp

Filesize
4.6MB

Download
memory/1780-555-0x0000000000E00000-0x00000000012A6000-memory.dmp

Filesize
4.6MB

Download
memory/1780-752-0x0000000000E00000-0x00000000012A6000-memory.dmp

Filesize
4.6MB

Download
memory/1780-710-0x0000000000E00000-0x00000000012A6000-memory.dmp

Filesize
4.6MB

Download
memory/1780-554-0x0000000000E00000-0x00000000012A6000-memory.dmp

Filesize
4.6MB

Download
memory/2104-1-0x0000000077380000-0x0000000077382000-memory.dmp

Filesize
8KB

Download
memory/2104-17-0x0000000000951000-0x00000000009B9000-memory.dmp

Filesize
416KB

Download
memory/2104-5-0x0000000000950000-0x0000000000C72000-memory.dmp

Filesize
3.1MB

Download
memory/2104-3-0x0000000000950000-0x0000000000C72000-memory.dmp

Filesize
3.1MB

Download
memory/2104-2-0x0000000000951000-0x00000000009B9000-memory.dmp

Filesize
416KB

Download
memory/2104-0-0x0000000000950000-0x0000000000C72000-memory.dmp

Filesize
3.1MB

Download
memory/2104-14-0x0000000000950000-0x0000000000C72000-memory.dmp

Filesize
3.1MB

Download
memory/2120-617-0x0000000003420000-0x0000000003476000-memory.dmp

Filesize
344KB

Download
memory/2120-616-0x0000000003420000-0x0000000003476000-memory.dmp

Filesize
344KB

Download
memory/2120-620-0x0000000003420000-0x0000000003476000-memory.dmp

Filesize
344KB

Download
memory/2120-618-0x0000000003420000-0x0000000003476000-memory.dmp

Filesize
344KB

Download
memory/2120-619-0x0000000003420000-0x0000000003476000-memory.dmp

Filesize
344KB

Download
memory/2212-798-0x0000000000400000-0x0000000000C62000-memory.dmp

Filesize
8.4MB

Download
memory/2212-881-0x0000000000400000-0x0000000000C62000-memory.dmp

Filesize
8.4MB

Download
memory/2212-859-0x0000000000400000-0x0000000000C62000-memory.dmp

Filesize
8.4MB

Download
memory/2212-782-0x0000000000400000-0x0000000000C62000-memory.dmp

Filesize
8.4MB

Download
memory/2212-851-0x0000000000400000-0x0000000000C62000-memory.dmp

Filesize
8.4MB

Download
memory/2212-789-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2212-797-0x0000000000400000-0x0000000000C62000-memory.dmp

Filesize
8.4MB

Download
memory/2324-856-0x0000000000FF0000-0x00000000012F0000-memory.dmp

Filesize
3.0MB

Download
memory/2340-962-0x0000000076F70000-0x000000007706A000-memory.dmp

Filesize
1000KB

Download
memory/2340-960-0x0000000000240000-0x00000000006D3000-memory.dmp

Filesize
4.6MB

Download
memory/2396-1110-0x0000000000A80000-0x0000000000D2C000-memory.dmp

Filesize
2.7MB

Download
memory/2396-1109-0x0000000000A80000-0x0000000000D2C000-memory.dmp

Filesize
2.7MB

Download
memory/2420-759-0x0000000001070000-0x0000000001CDF000-memory.dmp

Filesize
12.4MB

Download
memory/2420-755-0x0000000001070000-0x0000000001CDF000-memory.dmp

Filesize
12.4MB

Download
memory/2420-764-0x0000000001070000-0x0000000001CDF000-memory.dmp

Filesize
12.4MB

Download
memory/2420-744-0x0000000001070000-0x0000000001CDF000-memory.dmp

Filesize
12.4MB

Download
memory/2420-785-0x0000000001070000-0x0000000001CDF000-memory.dmp

Filesize
12.4MB

Download
memory/2420-754-0x0000000001070000-0x0000000001CDF000-memory.dmp

Filesize
12.4MB

Download
memory/2420-794-0x0000000001070000-0x0000000001CDF000-memory.dmp

Filesize
12.4MB

Download
memory/2420-769-0x0000000001070000-0x0000000001CDF000-memory.dmp

Filesize
12.4MB

Download
memory/2544-747-0x00000000035A0000-0x00000000035F5000-memory.dmp

Filesize
340KB

Download
memory/2544-750-0x00000000035A0000-0x00000000035F5000-memory.dmp

Filesize
340KB

Download
memory/2544-751-0x00000000035A0000-0x00000000035F5000-memory.dmp

Filesize
340KB

Download
memory/2544-748-0x00000000035A0000-0x00000000035F5000-memory.dmp

Filesize
340KB

Download
memory/2544-749-0x00000000035A0000-0x00000000035F5000-memory.dmp

Filesize
340KB

Download
memory/2672-964-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2736-796-0x00000000064F0000-0x0000000006D52000-memory.dmp

Filesize
8.4MB

Download
memory/2736-23-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-850-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-724-0x00000000064F0000-0x0000000006996000-memory.dmp

Filesize
4.6MB

Download
memory/2736-537-0x00000000064F0000-0x0000000006996000-memory.dmp

Filesize
4.6MB

Download
memory/2736-854-0x00000000064F0000-0x0000000007157000-memory.dmp

Filesize
12.4MB

Download
memory/2736-800-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-727-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-860-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-536-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-535-0x00000000064F0000-0x0000000006996000-memory.dmp

Filesize
4.6MB

Download
memory/2736-783-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-62-0x00000000064F0000-0x0000000006996000-memory.dmp

Filesize
4.6MB

Download
memory/2736-781-0x00000000064F0000-0x0000000006D52000-memory.dmp

Filesize
8.4MB

Download
memory/2736-60-0x00000000064F0000-0x0000000006996000-memory.dmp

Filesize
4.6MB

Download
memory/2736-44-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-43-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-42-0x0000000000E51000-0x0000000000EB9000-memory.dmp

Filesize
416KB

Download
memory/2736-41-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-819-0x00000000064F0000-0x0000000007157000-memory.dmp

Filesize
12.4MB

Download
memory/2736-766-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-761-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-963-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-757-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-22-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-21-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-19-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-18-0x0000000000E51000-0x0000000000EB9000-memory.dmp

Filesize
416KB

Download
memory/2736-656-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-753-0x00000000064F0000-0x000000000715F000-memory.dmp

Filesize
12.4MB

Download
memory/2736-746-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-16-0x0000000000E50000-0x0000000001172000-memory.dmp

Filesize
3.1MB

Download
memory/2736-743-0x00000000064F0000-0x000000000715F000-memory.dmp

Filesize
12.4MB

Download
memory/2736-740-0x00000000064F0000-0x0000000006996000-memory.dmp

Filesize
4.6MB

Download
memory/2736-725-0x00000000064F0000-0x0000000006996000-memory.dmp

Filesize
4.6MB

Download
memory/2736-741-0x00000000064F0000-0x0000000006996000-memory.dmp

Filesize
4.6MB

Download
memory/3012-814-0x00000000000F0000-0x0000000000146000-memory.dmp

Filesize
344KB

Download