Overview

overview

10

Static

static

3

random.exe

windows10-ltsc_2021-x64

10

random.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-en
  • resource tags

    arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31/03/2025, 12:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    random.exe
  • Size 1.8MB
  • Sample250331-pffftaztbt
  • SHA256 83c18fb1aeabee9c2108288562cef143babeabe3eed9e14eece66cfe7ecfa880
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygcleanerhealerlummaquasarstealc092155office04trumpbootkitdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

  • amadey

Version

  • 5.21

Botnet

  • 092155

C2

  • http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

  • quasar

Version

  • 1.5.0

Botnet

  • Office04

C2

  • 51.89.204.80:4782

Mutex

  • 65581c6d-14ba-4da9-86dd-ffd8304b8eb1

Attributes
  • encryption_key

    8C25D2F2D6CDE756BAFC0531B3B70446BFBAF003

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Extracted

Family

  • lumma

C2

  • https://cosmosyf.top/GOsznj

  • https://byteplusx.digital/aXweAX

  • https://travewlio.shop/ZNxbHi

  • https://skynetxc.live/AksoPA

  • https://pixtreev.run/LkaUz

  • https://advennture.top/GKsiio

  • https://targett.top/dsANGt

  • https://sparkiob.digital/KeASUp

  • https://appgridn.live/LEjdAK

  • https://rodformi.run/aUosoz

  • https://metalsyo.digital/opsa

  • https://ironloxp.live/aksdd

  • https://navstarx.shop/FoaJSi

  • https://starcloc.bet/GOksAo

  • https://cspacedbv.world/EKdlsk

  • https://8galxnetb.today/GsuIAo

  • https://esccapewz.run/ANSbwqy

  • https://touvrlane.bet/ASKwjq

  • https://sighbtseeing.shop/ASJnzh

  • https://holidamyup.today/AOzkns

Extracted

Family

  • stealc

Botnet

  • trump

C2

  • http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 15 IoCs
  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 32 IoCs
  • Identifies Wine through registry keys 2 TTPs 15 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3176
      • C:\Users\Admin\AppData\Local\Temp\10393770101\Natsu.exe
        "C:\Users\Admin\AppData\Local\Temp\10393770101\Natsu.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6124
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:3088
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:908
        • C:\Users\Admin\AppData\Local\Temp\10393920101\1317ddcae1.exe
          "C:\Users\Admin\AppData\Local\Temp\10393920101\1317ddcae1.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:5760
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3548
        • C:\Users\Admin\AppData\Local\Temp\10393930101\amnew.exe
          "C:\Users\Admin\AppData\Local\Temp\10393930101\amnew.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2856
          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
            "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
            4⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2300
            • C:\Users\Admin\AppData\Local\Temp\10046280101\f0effb0ce4.exe
              "C:\Users\Admin\AppData\Local\Temp\10046280101\f0effb0ce4.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3700
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                "C:\Users\Admin\AppData\Local\Temp\10046280101\f0effb0ce4.exe"
                6⤵
                • Downloads MZ/PE file
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3368
            • C:\Users\Admin\AppData\Local\Temp\10046290101\7043974004.exe
              "C:\Users\Admin\AppData\Local\Temp\10046290101\7043974004.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1236
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                "C:\Users\Admin\AppData\Local\Temp\10046290101\7043974004.exe"
                6⤵
                • Downloads MZ/PE file
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:404
        • C:\Users\Admin\AppData\Local\Temp\10393940101\3288aa81bf.exe
          "C:\Users\Admin\AppData\Local\Temp\10393940101\3288aa81bf.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5484
        • C:\Users\Admin\AppData\Local\Temp\10393950101\e4a33717ca.exe
          "C:\Users\Admin\AppData\Local\Temp\10393950101\e4a33717ca.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5672
        • C:\Users\Admin\AppData\Local\Temp\10393960101\93e8970edf.exe
          "C:\Users\Admin\AppData\Local\Temp\10393960101\93e8970edf.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3684
        • C:\Users\Admin\AppData\Local\Temp\10393970101\c7b3c05149.exe
          "C:\Users\Admin\AppData\Local\Temp\10393970101\c7b3c05149.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1652
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2024
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5332
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1852
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3960
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3132
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
              PID:3712
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                PID:3356
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {1592e5fc-e6a0-4c6a-a45b-1abf26db5a15} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                  6⤵
                    PID:4316
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {95ab7d57-ea1b-4bf3-9606-4bd2b3fb3d6e} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                    6⤵
                      PID:5144
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3972 -prefsLen 25213 -prefMapHandle 3976 -prefMapSize 270279 -jsInitHandle 3980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3988 -initialChannelId {9fde9e1d-98c2-4891-9a38-b966898a840e} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                      6⤵
                      • Checks processor information in registry
                      PID:696
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4128 -prefsLen 27323 -prefMapHandle 4132 -prefMapSize 270279 -ipcHandle 4200 -initialChannelId {b98e50d7-1ab8-4169-86f2-0f221902ba64} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                      6⤵
                        PID:2388
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1632 -prefsLen 34822 -prefMapHandle 2928 -prefMapSize 270279 -jsInitHandle 2956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2624 -initialChannelId {171e6c4e-c492-4a04-b1e9-e46eeda37f12} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                        6⤵
                        • Checks processor information in registry
                        PID:1924
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 35010 -prefMapHandle 5124 -prefMapSize 270279 -ipcHandle 5136 -initialChannelId {58162985-54c3-4ad5-b081-534549533726} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                        6⤵
                        • Checks processor information in registry
                        PID:2084
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5576 -initialChannelId {3b406222-e8ab-4827-87ba-7a4f9f496cd6} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                        6⤵
                        • Checks processor information in registry
                        PID:2740
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5796 -prefsLen 32952 -prefMapHandle 5800 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5808 -initialChannelId {1b4a1051-b4fa-4498-84bc-797f17c6b782} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                        6⤵
                        • Checks processor information in registry
                        PID:5972
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5980 -prefsLen 32952 -prefMapHandle 5984 -prefMapSize 270279 -jsInitHandle 5988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5996 -initialChannelId {5b57338b-5e86-44ce-bf2a-d0a66496df93} -parentPid 3356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                        6⤵
                        • Checks processor information in registry
                        PID:2956
                • C:\Users\Admin\AppData\Local\Temp\10393980101\f347cd7492.exe
                  "C:\Users\Admin\AppData\Local\Temp\10393980101\f347cd7492.exe"
                  3⤵
                  • Modifies Windows Defender DisableAntiSpyware settings
                  • Modifies Windows Defender Real-time Protection settings
                  • Modifies Windows Defender TamperProtection settings
                  • Modifies Windows Defender notification settings
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Windows security modification
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1880
                • C:\Users\Admin\AppData\Local\Temp\10393990101\328778265b.exe
                  "C:\Users\Admin\AppData\Local\Temp\10393990101\328778265b.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:900
                • C:\Users\Admin\AppData\Local\Temp\10394000101\95504398c7.exe
                  "C:\Users\Admin\AppData\Local\Temp\10394000101\95504398c7.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3348
                • C:\Users\Admin\AppData\Local\Temp\10394010101\f6aff33f65.exe
                  "C:\Users\Admin\AppData\Local\Temp\10394010101\f6aff33f65.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3028
                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    "C:\Users\Admin\AppData\Local\Temp\10394010101\f6aff33f65.exe"
                    4⤵
                    • Downloads MZ/PE file
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:5396
                • C:\Users\Admin\AppData\Local\Temp\10394020101\f3f6c04f82.exe
                  "C:\Users\Admin\AppData\Local\Temp\10394020101\f3f6c04f82.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3564
                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    "C:\Users\Admin\AppData\Local\Temp\10394020101\f3f6c04f82.exe"
                    4⤵
                    • Downloads MZ/PE file
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4020
                • C:\Users\Admin\AppData\Local\Temp\10394030101\bprz1VA.exe
                  "C:\Users\Admin\AppData\Local\Temp\10394030101\bprz1VA.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:996
                  • C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe
                    "C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3668
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3348
                  • C:\Users\Admin\AppData\Local\Temp\Built.exe
                    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:5984
                    • C:\Users\Admin\AppData\Local\Temp\Built.exe
                      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5460
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
                        6⤵
                          PID:3548
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
                            7⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1012
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                          6⤵
                            PID:4388
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                              7⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3028
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                            6⤵
                              PID:4652
                              • C:\Windows\system32\tasklist.exe
                                tasklist /FO LIST
                                7⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5788
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                              6⤵
                                PID:4936
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic csproduct get uuid
                                  7⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1164
                          • C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe
                            "C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe"
                            4⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:3116
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:772
                        • C:\Users\Admin\AppData\Local\Temp\10394040101\3e29231df2.exe
                          "C:\Users\Admin\AppData\Local\Temp\10394040101\3e29231df2.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          PID:1104
                        • C:\Users\Admin\AppData\Local\Temp\10394050101\bf348d1036.exe
                          "C:\Users\Admin\AppData\Local\Temp\10394050101\bf348d1036.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Writes to the Master Boot Record (MBR)
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          PID:3148
                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5848
                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5284
                    • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                      C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2116
                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:2360
                    • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                      C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                      1⤵
                      • Executes dropped EXE
                      PID:656

                    Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          1
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          4
                          T1543

                          Windows Service

                          4
                          T1543.003

                          Pre-OS Boot

                          1
                          T1542

                          Bootkit

                          1
                          T1542.003

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          4
                          T1543

                          Windows Service

                          4
                          T1543.003

                          Defense Evasion

                          Impair Defenses

                          5
                          T1562

                          Disable or Modify Tools

                          5
                          T1562.001

                          Modify Registry

                          6
                          T1112

                          Pre-OS Boot

                          1
                          T1542

                          Bootkit

                          1
                          T1542.003

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          Credential Access

                          Unsecured Credentials

                          1
                          T1552

                          Credentials In Files

                          1
                          T1552.001

                          Discovery

                          Process Discovery

                          1
                          T1057

                          Query Registry

                          6
                          T1012

                          System Information Discovery

                          4
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          Lateral Movement

                          Collection

                          Data from Local System

                          1
                          T1005

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          soft[1]
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I9E42P7O\soft[1]
                          • Size 3.0MB
                          • SHA256 c89a0fea7c3850c8bf4b6a231a34cfb699c97783b1b2b1176070dd4d9cb4bd4a
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          dll[1]
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J0P9XO8O\dll[1]
                          • Size 236KB
                          • SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          service[1].htm
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XMDVK1P0\service[1].htm
                          • Size 1B
                          • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                          • MD5 SHA1 SHA512
                          Submit Download

                          A585344A45AF937E3AB7D706291A9A3ED8D581D9
                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9
                          • Size 13KB
                          • SHA256 94744a0e893e90052caf733b06476ba224f344d8d56102b021a4e3d8332bf8bb
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1
                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1
                          • Size 20KB
                          • SHA256 7b44ef2723568fb8e83af5030f50992adee3304694a7e10641ef34b13d962dd1
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          f0effb0ce4.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10046280101\f0effb0ce4.exe
                          • Size 4.3MB
                          • SHA256 eab57fe16344a4a935192a58a4a539c57735bdd423206e58070f1f51b17648b0
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          7043974004.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10046290101\7043974004.exe
                          • Size 4.4MB
                          • SHA256 f3978a907e9afb0c69059a295212eefda54289fbbbbfafec1f452792ae5287e6
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          Natsu.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393770101\Natsu.exe
                          • Size 3.5MB
                          • SHA256 3045c4c630d44383a7153d9d13e4cdaa3284095cb580627a9adb0b9e4033d9e3
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          1317ddcae1.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393920101\1317ddcae1.exe
                          • Size 1.1MB
                          • SHA256 28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          amnew.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393930101\amnew.exe
                          • Size 429KB
                          • SHA256 87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          3288aa81bf.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393940101\3288aa81bf.exe
                          • Size 716KB
                          • SHA256 29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          3288aa81bf.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393940101\3288aa81bf.exe
                          • Size 358KB
                          • SHA256 6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          e4a33717ca.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393950101\e4a33717ca.exe
                          • Size 2.0MB
                          • SHA256 9a5b27acd03abbcb09e9904343749305c876b5b3d71fcf55c75af5136daaf4b1
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          93e8970edf.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393960101\93e8970edf.exe
                          • Size 1.8MB
                          • SHA256 c92f3f57e1bc9e19a4f8f1e08b15513f9e0bbaaf20afd431878e1eb31e99d2b0
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          c7b3c05149.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393970101\c7b3c05149.exe
                          • Size 946KB
                          • SHA256 35b68fc6adda43d6460ebbe66fad5d4bb4869bb432965c4acccf07b6dae8bbbf
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          f347cd7492.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393980101\f347cd7492.exe
                          • Size 1.7MB
                          • SHA256 ec01822fa52b8add42b28f2e8c0487cae866c989fdc60b821969c64358421ff9
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          328778265b.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10393990101\328778265b.exe
                          • Size 1.8MB
                          • SHA256 ffca491caacfe1fd3cc6ac243756d9611cd354a03b24752df5825997cdb2d21e
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          95504398c7.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10394000101\95504398c7.exe
                          • Size 480KB
                          • SHA256 960670b325ad49c1bf269c9816f2c254fa5371f96b3ad7371c5150c49591a3c7
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          95504398c7.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10394000101\95504398c7.exe
                          • Size 240KB
                          • SHA256 79c986fd9c87542256a607eff10f5a2f84165b08bd9dd161e2d33e213607b487
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          bprz1VA.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10394030101\bprz1VA.exe
                          • Size 11.2MB
                          • SHA256 fe0b20c7595251a2b626f8643c29ada476410ddc9d87b9c4dc84f637fe99dc95
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          3e29231df2.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10394040101\3e29231df2.exe
                          • Size 1.8MB
                          • SHA256 60bead78ba4e8eb9bb6f01f9b70fbcb8e8e931d6efb81f8835a5114d66952074
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          bf348d1036.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\10394050101\bf348d1036.exe
                          • Size 2.0MB
                          • SHA256 1083afc11613978675b03cd27d4c25c72a5f3cf117bd5f26ae06997afdcf5e21
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          Built.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\Built.exe
                          • Size 8.2MB
                          • SHA256 0705041d5f680ce4dd9e8d472f2dadd04f3802dc66fb01f8e1fc6f5a6a3eecc2
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          Luma_Crypt_Packlab.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe
                          • Size 2.1MB
                          • SHA256 4a68f65ec41bd361d2f54fc9d8152a2e6c584296be0eaf302078a2b0cbc881d6
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          VCRUNTIME140.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\VCRUNTIME140.dll
                          • Size 116KB
                          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          _ctypes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_ctypes.pyd
                          • Size 58KB
                          • SHA256 20bc81c1b70f741375751ae7c4a177a409b141bfcd32b4267975c67fc1b11e87
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          api-ms-win-core-console-l1-1-0.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\api-ms-win-core-console-l1-1-0.dll
                          • Size 21KB
                          • SHA256 af9675ac90bae8a0d8623f6fdaff9d39e1b8810e8e46a5b044baaa3396e745b3
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          api-ms-win-core-datetime-l1-1-0.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\api-ms-win-core-datetime-l1-1-0.dll
                          • Size 21KB
                          • SHA256 f918b0c45f59b2cb29f1eb3653d2f2679095e85e082a1198c933a76edf1f33ef
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          base_library.zip
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\base_library.zip
                          • Size 1.4MB
                          • SHA256 da04714dbefa733acba1eca9886ca1b34ff584f6d2adf7e6952ec4d64444ad93
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          libffi-8.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\libffi-8.dll
                          • Size 29KB
                          • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          python311.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\python311.dll
                          • Size 1.6MB
                          • SHA256 28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          ucrtbase.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\ucrtbase.dll
                          • Size 1.1MB
                          • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          __PSScriptPolicyTest_1i3miurk.laq.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1i3miurk.laq.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512
                          Submit Download

                          rapes.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                          • Size 1.8MB
                          • SHA256 83c18fb1aeabee9c2108288562cef143babeabe3eed9e14eece66cfe7ecfa880
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          svchost015.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                          • Size 2.9MB
                          • SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          tmpaddon
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          • Size 14.0MB
                          • SHA256 a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          tmpaddon
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          • Size 502KB
                          • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          wow_6262_build (9).exe
                          • Path C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe
                          • Size 2.1MB
                          • SHA256 06a0c5ec948b65d8377b784b32f0beed36585a0c800b7ef378ed4d2bc6619f66
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          AlternateServices.bin
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\AlternateServices.bin
                          • Size 17KB
                          • SHA256 732883fe2e437d35b6dabd404b96dc195d6a70b60fdc90b753143f9b271443c5
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          AlternateServices.bin
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\AlternateServices.bin
                          • Size 10KB
                          • SHA256 fd22bc00340b683b087a4ea527de6b27f0ddd58d7c18794ad67f6276925c9c27
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          data.safe.tmp
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp
                          • Size 5KB
                          • SHA256 6df0d39023ba753d8c2bae672224bdc8cf67322b87a1fa1e9a80aebf594de320
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          data.safe.tmp
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp
                          • Size 7KB
                          • SHA256 00129424b1af2a6d0efc086e362a60bddc8d3ca10f3d9830c795271627628f39
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          data.safe.tmp
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp
                          • Size 6KB
                          • SHA256 1664dbfefc65720c050dd4f3a589fb6cebe6a787234a02d0d95c3d061f54baf3
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          data.safe.tmp
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp
                          • Size 6KB
                          • SHA256 89afd88677c3509780e95839f09a67ea4685b983f6c00caa0842685abb4a6880
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          events
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\events\events
                          • Size 1KB
                          • SHA256 c863a4054b27294b265f72b14b20768c397f94042d286223532bbbe3c0d983fa
                          • MD5 SHA1 SHA512
                          Submit Download

                          1b233079-039a-4a97-8844-449e2a97c0c5
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\1b233079-039a-4a97-8844-449e2a97c0c5
                          • Size 886B
                          • SHA256 51cfd802858b3c211ee89d5d6dfa26f3e2a37b5fceff0bf34cdc3007d3809008
                          • MD5 SHA1 SHA512
                          Submit Download

                          33c1fba6-ea54-47a7-8dc1-4fd1a38c1b24
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\33c1fba6-ea54-47a7-8dc1-4fd1a38c1b24
                          • Size 235B
                          • SHA256 065478c7bc6c7f1a51d44121668df29fa34d4323bba6c2f9b37c7cbf45469286
                          • MD5 SHA1 SHA512
                          Submit Download

                          611031b3-37ce-41de-8d0d-186a456e1824
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\611031b3-37ce-41de-8d0d-186a456e1824
                          • Size 883B
                          • SHA256 ebbe6e1992cff996001e71174d5c34e01f7bfb75bab36b7707ddae8ad33082c8
                          • MD5 SHA1 SHA512
                          Submit Download

                          8c82036f-7dfd-4f1d-8610-c3280d6ad03f
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\8c82036f-7dfd-4f1d-8610-c3280d6ad03f
                          • Size 235B
                          • SHA256 ae6d14c4094ce94ddd0c8aaf17f4b00b396c19627ba5ca952367ae60523a5f9c
                          • MD5 SHA1 SHA512
                          Submit Download

                          d5840a38-5cbb-43f7-aa1e-fb5fe71cfe7a
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\d5840a38-5cbb-43f7-aa1e-fb5fe71cfe7a
                          • Size 2KB
                          • SHA256 e529c2f396956250ebe2873b92c4bd532c79bb7105565ff1c0d6bbbd08167640
                          • MD5 SHA1 SHA512
                          Submit Download

                          fe1dfda0-b186-4270-814b-62760d111a1d
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\fe1dfda0-b186-4270-814b-62760d111a1d
                          • Size 16KB
                          • SHA256 5cd5e43ed67a0befa5f2da98f856762f9edf6de95c165218c89d9873077215e0
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          extensions.json
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\extensions.json
                          • Size 16KB
                          • SHA256 348711d37e7737bcc224a912c48770c8f7d5fc6d80b0ae77d4aef6067df388ed
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          gmpopenh264.dll
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                          • Size 1.1MB
                          • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          gmpopenh264.info
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                          • Size 116B
                          • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                          • MD5 SHA1 SHA512
                          Submit Download

                          manifest.json
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                          • Size 1001B
                          • SHA256 4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce
                          • MD5 SHA1 SHA512
                          Submit Download

                          widevinecdm.dll
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                          • Size 18.5MB
                          • SHA256 3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          prefs-1.js
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs-1.js
                          • Size 6KB
                          • SHA256 7fb0a9e2b1369dc460a721fac7f6b21856d44d791617cb41eea7c9534a93ec27
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          prefs-1.js
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs-1.js
                          • Size 8KB
                          • SHA256 9f77d11f81a2a3cdd584c98df3a1ec07eacc9db976ec05dfef3b4e20c61bef54
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          prefs.js
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs.js
                          • Size 6KB
                          • SHA256 552603c2e5cb5768d5203a79362332752770ee306641e5bf3a1613bb15780838
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          recovery.baklz4
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4
                          • Size 1KB
                          • SHA256 31f97d62d2ca429a4e7f1aed5b1d00e9f3473381b367d7f361a44d8bc83c9bdb
                          • MD5 SHA1 SHA512
                          Submit Download

                          3870112724rsegmnoittet-es.sqlite
                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                          • Size 3.3MB
                          • SHA256 8f7f23bcc56be243e55a594d7d9360f17be6d515e42d716d6142238f45ee037a
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          memory/404-627-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/404-204-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/404-694-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/404-206-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/404-1125-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/404-1253-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/772-1248-0x0000000000400000-0x0000000000464000-memory.dmp
                          Download

                          memory/772-1247-0x0000000000400000-0x0000000000464000-memory.dmp
                          Download

                          memory/900-691-0x0000000000F60000-0x0000000001414000-memory.dmp
                          Download

                          memory/900-681-0x0000000000F60000-0x0000000001414000-memory.dmp
                          Download

                          memory/908-54-0x0000000000400000-0x0000000000558000-memory.dmp
                          Download

                          memory/908-57-0x0000000005460000-0x00000000054F2000-memory.dmp
                          Download

                          memory/908-56-0x0000000005A10000-0x0000000005FB6000-memory.dmp
                          Download

                          memory/908-58-0x0000000005430000-0x000000000544A000-memory.dmp
                          Download

                          memory/908-63-0x0000000005720000-0x0000000005786000-memory.dmp
                          Download

                          memory/908-59-0x0000000005650000-0x000000000565A000-memory.dmp
                          Download

                          memory/972-1-0x0000000077CD6000-0x0000000077CD8000-memory.dmp
                          Download

                          memory/972-2-0x0000000000E81000-0x0000000000EAF000-memory.dmp
                          Download

                          memory/972-3-0x0000000000E80000-0x0000000001336000-memory.dmp
                          Download

                          memory/972-0-0x0000000000E80000-0x0000000001336000-memory.dmp
                          Download

                          memory/972-5-0x0000000000E80000-0x0000000001336000-memory.dmp
                          Download

                          memory/972-16-0x0000000000E80000-0x0000000001336000-memory.dmp
                          Download

                          memory/1012-1280-0x0000014FEFD50000-0x0000014FEFD72000-memory.dmp
                          Download

                          memory/1236-199-0x0000000000400000-0x0000000000DFE000-memory.dmp
                          Download

                          memory/1236-208-0x0000000000400000-0x0000000000DFE000-memory.dmp
                          Download

                          memory/1880-645-0x0000000000CA0000-0x000000000110A000-memory.dmp
                          Download

                          memory/1880-646-0x0000000000CA0000-0x000000000110A000-memory.dmp
                          Download

                          memory/1880-647-0x0000000000CA0000-0x000000000110A000-memory.dmp
                          Download

                          memory/1880-695-0x0000000000CA0000-0x000000000110A000-memory.dmp
                          Download

                          memory/1880-698-0x0000000000CA0000-0x000000000110A000-memory.dmp
                          Download

                          memory/3028-745-0x0000000000400000-0x0000000000DFE000-memory.dmp
                          Download

                          memory/3028-757-0x0000000000400000-0x0000000000DFE000-memory.dmp
                          Download

                          memory/3176-202-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-64-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-20-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-19-0x00000000004E1000-0x000000000050F000-memory.dmp
                          Download

                          memory/3176-22-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-17-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-33-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-23-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-752-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-1102-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-560-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-682-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-970-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-21-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-65-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-107-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-141-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3176-62-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/3348-1242-0x0000000000400000-0x0000000000462000-memory.dmp
                          Download

                          memory/3348-1241-0x0000000000400000-0x0000000000462000-memory.dmp
                          Download

                          memory/3368-164-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/3368-1098-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/3368-1084-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/3368-161-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/3368-626-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/3368-209-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/3368-520-0x0000000010000000-0x000000001001C000-memory.dmp
                          Download

                          memory/3548-81-0x0000000000400000-0x0000000000464000-memory.dmp
                          Download

                          memory/3548-80-0x0000000000400000-0x0000000000464000-memory.dmp
                          Download

                          memory/3564-777-0x0000000000400000-0x0000000000CCB000-memory.dmp
                          Download

                          memory/3564-785-0x0000000000400000-0x0000000000CCB000-memory.dmp
                          Download

                          memory/3684-201-0x00000000000C0000-0x000000000076B000-memory.dmp
                          Download

                          memory/3684-188-0x00000000000C0000-0x000000000076B000-memory.dmp
                          Download

                          memory/3700-140-0x0000000000400000-0x0000000000CCB000-memory.dmp
                          Download

                          memory/3700-166-0x0000000000400000-0x0000000000CCB000-memory.dmp
                          Download

                          memory/4020-784-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/4020-1093-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/5284-747-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/5284-749-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/5396-756-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/5396-1070-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/5396-1109-0x0000000000400000-0x000000000042E000-memory.dmp
                          Download

                          memory/5460-1320-0x00007FFC01A50000-0x00007FFC01B6C000-memory.dmp
                          Download

                          memory/5460-1308-0x00007FFC0BB10000-0x00007FFC0BB1F000-memory.dmp
                          Download

                          memory/5460-1270-0x00007FFC01A50000-0x00007FFC01B6C000-memory.dmp
                          Download

                          memory/5460-1268-0x00007FFC050C0000-0x00007FFC050D4000-memory.dmp
                          Download

                          memory/5460-1267-0x00007FFC064E0000-0x00007FFC064ED000-memory.dmp
                          Download

                          memory/5460-1266-0x000002A884160000-0x000002A884689000-memory.dmp
                          Download

                          memory/5460-1289-0x00007FFBE94A0000-0x00007FFBE9A90000-memory.dmp
                          Download

                          memory/5460-1264-0x00007FFC01B70000-0x00007FFC01C3D000-memory.dmp
                          Download

                          memory/5460-1319-0x00007FFC064E0000-0x00007FFC064ED000-memory.dmp
                          Download

                          memory/5460-1318-0x00007FFC050C0000-0x00007FFC050D4000-memory.dmp
                          Download

                          memory/5460-1317-0x00007FFBE8F70000-0x00007FFBE9499000-memory.dmp
                          Download

                          memory/5460-1316-0x00007FFC01B70000-0x00007FFC01C3D000-memory.dmp
                          Download

                          memory/5460-1315-0x00007FFC01C40000-0x00007FFC01C73000-memory.dmp
                          Download

                          memory/5460-1314-0x00007FFC091D0000-0x00007FFC091DD000-memory.dmp
                          Download

                          memory/5460-1313-0x00007FFC057F0000-0x00007FFC05809000-memory.dmp
                          Download

                          memory/5460-1312-0x00007FFC01C80000-0x00007FFC01DF6000-memory.dmp
                          Download

                          memory/5460-1311-0x00007FFC01E00000-0x00007FFC01E23000-memory.dmp
                          Download

                          memory/5460-1310-0x00007FFC01E30000-0x00007FFC01E5D000-memory.dmp
                          Download

                          memory/5460-1309-0x00007FFC05850000-0x00007FFC05869000-memory.dmp
                          Download

                          memory/5460-1269-0x00007FFBE94A0000-0x00007FFBE9A90000-memory.dmp
                          Download

                          memory/5460-1307-0x00007FFC06550000-0x00007FFC06574000-memory.dmp
                          Download

                          memory/5460-1265-0x00007FFBE8F70000-0x00007FFBE9499000-memory.dmp
                          Download

                          memory/5460-1263-0x00007FFC01C40000-0x00007FFC01C73000-memory.dmp
                          Download

                          memory/5460-1262-0x00007FFC091D0000-0x00007FFC091DD000-memory.dmp
                          Download

                          memory/5460-1261-0x00007FFC057F0000-0x00007FFC05809000-memory.dmp
                          Download

                          memory/5460-1259-0x00007FFC01E00000-0x00007FFC01E23000-memory.dmp
                          Download

                          memory/5460-1260-0x00007FFC01C80000-0x00007FFC01DF6000-memory.dmp
                          Download

                          memory/5460-1243-0x00007FFC06550000-0x00007FFC06574000-memory.dmp
                          Download

                          memory/5460-1244-0x00007FFC0BB10000-0x00007FFC0BB1F000-memory.dmp
                          Download

                          memory/5460-1233-0x00007FFBE94A0000-0x00007FFBE9A90000-memory.dmp
                          Download

                          memory/5460-1246-0x00007FFC01E30000-0x00007FFC01E5D000-memory.dmp
                          Download

                          memory/5460-1245-0x00007FFC05850000-0x00007FFC05869000-memory.dmp
                          Download

                          memory/5672-155-0x0000000000BF0000-0x00000000010AA000-memory.dmp
                          Download

                          memory/5672-158-0x0000000000BF0000-0x00000000010AA000-memory.dmp
                          Download

                          memory/5848-61-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/5848-52-0x00000000004E0000-0x0000000000996000-memory.dmp
                          Download

                          memory/6124-53-0x0000000000430000-0x00000000007BE000-memory.dmp
                          Download